iu
eef7c6c5d0
Build signed object URLs as path-only (/api/objects/...) instead of prefixing APP_BASE_URL, so media loads from whatever host or reverse proxy served the app. Remove the now-unused base URL from the signer and drop the APP_BASE_URL / Server.BaseURL config.
76 lines
2.5 KiB
Bash
76 lines
2.5 KiB
Bash
# PostgreSQL (pg.localnet)
|
|
PG_HOST=pg.localnet
|
|
PG_PORT=5432
|
|
PG_USER=album
|
|
PG_PASSWORD=change_me
|
|
PG_DATABASE=galo
|
|
PG_SSLMODE=disable
|
|
|
|
# Metadata backend: sqlite (default, embedded single instance) or postgres
|
|
DB_BACKEND=sqlite
|
|
# Path to the SQLite database file (used when DB_BACKEND=sqlite)
|
|
SQLITE_PATH=./galo.db
|
|
|
|
# S3 (Garage on s3.localnet) - internal storage, never exposed to clients
|
|
S3_ENDPOINT=http://s3.localnet:3900
|
|
S3_REGION=garage
|
|
S3_ACCESS_KEY=GKchange_me
|
|
S3_SECRET_KEY=change_me
|
|
S3_BUCKET=galo-data
|
|
S3_USE_PATH_STYLE=true
|
|
|
|
# Storage backend: fs (default, local filesystem) or s3 (S3-compatible/Garage).
|
|
# Blobs are always delivered through the backend via /api/objects/<key>.
|
|
STORAGE_BACKEND=fs
|
|
# Root directory for object blobs (STORAGE_BACKEND=fs)
|
|
FS_ROOT=./data
|
|
# Signs object URLs; falls back to the metadata-layer secret when empty
|
|
URL_SECRET=
|
|
# Lifetime of signed object URLs
|
|
OBJECT_URL_TTL=1h
|
|
# Quantizes URL expiry so the same object keeps an identical URL within a window
|
|
# (capped at OBJECT_URL_TTL), letting clients reuse cached previews
|
|
OBJECT_URL_SIGN_WINDOW=10m
|
|
# Cache-Control max-age for object responses (blobs are immutable)
|
|
OBJECT_CACHE_MAX_AGE=1h
|
|
|
|
# Auth. The token signing secret is generated on first start and stored in the
|
|
# metadata layer (app_settings); it is not configured here.
|
|
JWT_ACCESS_TTL=15m
|
|
JWT_REFRESH_TTL=720h
|
|
|
|
# Server
|
|
HTTP_ADDR=:8080
|
|
|
|
# SSE
|
|
SSE_HEARTBEAT_INTERVAL=25s
|
|
SSE_CLIENT_BUFFER=64
|
|
|
|
# Background worker (variant generation + object GC).
|
|
# Throughput is roughly WORKER_BATCH per WORKER_INTERVAL; WORKER_CONCURRENCY caps
|
|
# how many of those jobs are processed in parallel (CPU-bound, scales with cores).
|
|
WORKER_INTERVAL=5s
|
|
WORKER_BATCH=100
|
|
WORKER_CONCURRENCY=4
|
|
WORKER_PENDING_TTL=10m
|
|
|
|
# Upload size limits per media kind (plain bytes or KB/MB/GB suffix).
|
|
IMAGE_MAX_UPLOAD_SIZE=100MB
|
|
VIDEO_MAX_UPLOAD_SIZE=2GB
|
|
|
|
# Video processing toolchain. Video is prepared for browser playback with
|
|
# ffmpeg/ffprobe installed on the host (no Docker). When either binary is
|
|
# missing, video upload is disabled and /api/health reports video: unavailable;
|
|
# images keep working.
|
|
FFMPEG_PATH=ffmpeg
|
|
FFPROBE_PATH=ffprobe
|
|
# How many video transcodes run in parallel (kept separate from image workers).
|
|
VIDEO_TRANSCODE_CONCURRENCY=1
|
|
# Directory for temporary spool/transcode files (empty = system temp dir).
|
|
VIDEO_TEMP_DIR=
|
|
|
|
# Logging. LOG_LEVEL=debug adds per-request access logs and expected 4xx errors.
|
|
# LOG_FORMAT selects the output encoding.
|
|
LOG_LEVEL=info
|
|
LOG_FORMAT=json
|