overleaf-cep/tools/reference_stack_compose/env.sample

# ============================================================================
# env.sample — template for /data_1/docker/compose/.env
#
# HOW TO USE:  cp env.sample .env   then fill in the <PLACEHOLDER> values.
# .env is git-ignored and is the ONLY place where real secrets live; compose
# injects these into the containers (no shell expansion in .env values —
# ${VAR} references work between keys, $(cmd) does NOT).
#
# NOTE: some values are auto-maintained (marked below) — do not hand-edit
# those or the change will be overwritten on the next up.
#
# THIS FILE CONTAINS NO SECRETS (it is committed). Never copy real values
# from .env into here.
# ============================================================================

##################
# Image versions #
##################
OVERLEAF_VERSION=ext-ce-v6.3.1
MONGO_VERSION=9.0
REDIS_VERSION=8.10-alpine
GIT_BRIDE_VERSION=6.3.1

######################
# Overleaf Global I. #
######################
# You need here the correct path (the compose.yaml is in /docker/compose_cep/overleaf)
COMPOSE_DIRECTORY=/data_1/docker/compose
TEX_LIVE_REPO=git.fb1.uni-bremen.de/davrot
OVERLEAF_LEFT_FOOTER='[]'
OVERLEAF_LOGIN_SUPPORT_TEXT="<img src=\"ub/logo.svg\" height=\"250\"></br><a href=\"https://sso.fb1.uni-bremen.de\"> University of Bremen Overleaf Wiki </a>"
COMPILES_HOST_DIR=${COMPOSE_DIRECTORY}/overleaf/data/data/compiles
COMPILES_HOST_DIR_CACHE=${COMPOSE_DIRECTORY}/overleaf/data/data/cache
CONVERSION_SANDBOX_HOST_DIR=${COMPOSE_DIRECTORY}/overleaf/data/tmp/conversions
OVERLEAF_OIDC_IS_ADMIN_FIELD_VALUE=davrot@uni-bremen.de

###########
# Grafana #
###########
GRAFANA_ADMIN_USER=<ADMINUSER>
GRAFANA_ADMIN_PASSWORD=<PASSWORD>
# admin account email (only applies when the admin user is first created —
# i.e. on a fresh grafana-data; Grafana has no API to retrofit it later)
GF_SECURITY_ADMIN_EMAIL=<Reuse OVERLEAF_ADMIN_EMAIL>
# where the UI is reachable (nginx subpath; default fits this stack)
GRAFANA_ROOT_URL=https://<DOMAIN>/grafana/

# Monitoring image pins (bump + autoupdate on upgrade)
GRAFANA_IMAGE=grafana/grafana-oss:11.6.0
PROMETHEUS_IMAGE=prom/prometheus:v2.53.5
NODE_EXPORTER_IMAGE=prom/node-exporter:v1.8.2

# Grafana SMTP: no extra vars — grafana/compose.yaml reuses the Overleaf
# settings below (OVERLEAF_EMAIL_SMTP_HOST/PORT/USER, OVERLEAF_EMAIL_PASSWORD,
# OVERLEAF_EMAIL_FROM_ADDRESS) as a single source of truth.

# instance-sensor (PR yu-i-i/overleaf-cep#178 sensors as live gauges):
# split active users into standard/guest (PR#176 rule)
INSTANCE_STATS_SEGMENTATION=false

#############
# Nginx SSL #
#############
# If you use certbot
SSL_KEY_FILE=/etc/letsencrypt/live/<DOMAINNAME>/privkey.pem
SSL_CERT_FILE=/etc/letsencrypt/live/<DOMAINNAME>/fullchain.pem

##############
# S3 Buckets #
##############
# openssl rand -base64 30 | tr -dc 'a-zA-Z0-9' | head -c 20; echo
AWS_ACCESS_KEY_ID=<AWS_ACCESS_KEY_ID>
# openssl rand -base64 60 | tr -dc 'a-zA-Z0-9' | head -c 40; echo
AWS_SECRET_ACCESS_KEY=<AWS_SECRET_ACCESS_KEY>

##########
# Zotero #
##########
# (credentials from your Zotero account: Settings -> Advanced -> Credentials)
ZOTERO_CLIENT_KEY=<ZOTERO_CLIENT_KEY>
ZOTERO_CLIENT_SECRET=<ZOTERO_CLIENT_SECRET>

##########
# Github #
##########
# (from your GitHub App settings)
GITHUB_SYNC_CLIENT_ID=<GITHUB_SYNC_CLIENT_ID>
GITHUB_SYNC_CLIENT_SECRET=<GITHUB_SYNC_CLIENT_SECRET>

###################
# Overleaf SECRET #
###################
# openssl rand -hex 32; echo
OVERLEAF_INVITE_TOKEN_SECRET=<OVERLEAF_INVITE_TOKEN_SECRET>

#####################
# Overleaf SSO OIDC #
#####################
# Keycloak OpenID Connect Configuration
OVERLEAF_OIDC_ISSUER=https://<SERVERURL>/sso/realms/master
# (from your SSO realm / client registration)
OVERLEAF_OIDC_CLIENT_ID=<OVERLEAF_OIDC_CLIENT_ID>
OVERLEAF_OIDC_CLIENT_SECRET=<OVERLEAF_OIDC_CLIENT_SECRET>
OVERLEAF_OIDC_IDENTITY_SERVICE_NAME='Log in with SSO FB1 Uni Bremen'

##################
# Overleaf eMail #
##################
# eMail Account Configuration
# (SMTP password for the user in OVERLEAF_EMAIL_SMTP_USER)
OVERLEAF_EMAIL_PASSWORD=<SMTP PASSWORD>
OVERLEAF_EMAIL_FROM_ADDRESS=<EMAIL ADDRESS>
OVERLEAF_EMAIL_SMTP_HOST=<SMTP SERVER>
OVERLEAF_EMAIL_SMTP_PORT=465
OVERLEAF_EMAIL_SMTP_SECURE=true
OVERLEAF_EMAIL_SMTP_USER=<SMTP USER>
OVERLEAF_EMAIL_SMTP_IGNORE_TLS=false

#######################
# Overleaf Global II. #
#######################

# Other Overleaf Configurations Configuration
OVERLEAF_SITE_URL=https://<URL>
OVERLEAF_ADMIN_EMAIL=<Reuse OVERLEAF_EMAIL_FROM_ADDRESS>
OVERLEAF_APP_NAME="Overleaf"
OVERLEAF_NAV_TITLE="Overleaf"
OVERLEAF_CUSTOM_EMAIL_FOOTER="Overleaf"

##########
# Wakapi #
##########
# openssl rand -base64 30 | tr -dc "a-zA-Z0-9" | head -c 24; echo
PG_PASSWORD=<PG_PASSWORD>

# HOST port for the wakapi web UI + API (3000 by convention; use 3001 if taken)
WAKA_API_PORT=3000

# image pins (bump + autoupdate on upgrade)
WAKA_API_IMAGE=ghcr.io/muety/wakapi:2.18.2
POSTGRES_IMAGE=postgres:18-alpine
PROBE_IMAGE=busybox:1.36

# overleaf container IP on this network (WAKAPI_TRUST_REVERSE_PROXY_IPS)
# — AUTO-MAINTAINED: up.sh / up_wakapi.sh rewrite this line from
#   `docker inspect overleaf` on every (re)start-adjacent run. Leave empty:
OVERLEAF_IP=

# wakapi SMTP implicit TLS (smtp.uni-bremen.de:465)
WAKAPI_MAIL_SMTP_TLS=true