AnonymousFox

//proc/self/root/var/softaculous/lychee/.env

APP_NAME=Lychee
APP_ENV=production
APP_KEY=base64:[[APP_KEY]]
APP_DEBUG=false
# This MUST contain the host name up to the Top Level Domain (tld) e.g. .com, .org etc.
APP_URL=[[app_url]]
APP_FORCE_HTTPS=false

# If using Lychee in a sub folder, specify the path after the tld here.
# For example for https://lychee.test/path/to/lychee
# Set APP_URL=https://lychee.test
# and APP_DIR=/path/to/lychee
# We (LycheeOrg) do not recommend the use of APP_DIR.
APP_DIR=[[relativeurl]]/public

# enable or disable debug bar. By default it is disabled.
# Do note that this disable CSP!!
DEBUGBAR_ENABLED=false

# enable or disable log viewer. By default it is disabled
# Unfortunately, it is not possible to enable Log Viewer in production.
# If you wish to enable it, also switch your APP_ENV to 'local'
LOG_VIEWER_ENABLED=false

# disable logging 404 errors
# LOG_404_ERRORS=false

# enable or disable clockwork. By default it is disabled (and not provided on non-dev build).
CLOCKWORK_ENABLE=false
CLOCKWORK_DRIVER=laravel
CLOCKWORK_STORAGE_FILES_PATH=storage/clockwork

# enable or disable latency debug: adds a specific amount of time in milliseconds to wait before processing requests.
# Always disabled on production environment.
# APP_DEBUG_LATENCY=0

# All API requests to have the header "content-type: application/json"
# or "content-type: multipart/form-data" depending on the type.
#
# If you want to disable this requirement, set this to false.
#
# This requirement prevents the use of the API from the API documentation page.
REQUIRE_CONTENT_TYPE_ENABLED=true

# enable s3 bucket (required in addition to needing AWS_ACCESS_KEY_ID)
# S3_ENABLED=true

# If you spread old links of to your albums in your Lychee instance starting with
# https://lychee.text/#albumID/PhotoId
# Set this value to true to enable redirection.
LEGACY_V4_REDIRECT=false

##############################################################################
# IMPORTANT: To migrate from Lychee v3 you *MUST* use the same MySQL/MariaDB #
#            server as v3.                                                   #
##############################################################################

# Table prefix (e.g. lychee_) of a Lychee v3 instance for migration
DB_OLD_LYCHEE_PREFIX=

# DB_CONNECTION can be sqlite, mysql or pgsql. For sqlite the other entries are
# not required, but an existing sqlite3 database may be specified if desired.
# In this case, please use an absolute path. DB_DATABASE may be omitted but should
# *not* be left blank.
# Note that if DB_PASSWORD includes special characters, it must be enclosed in quotes.
# e.g. DB_PASSWORD="lychee!@#$%^&"
DB_CONNECTION=mysql
DB_HOST=[[softdbhost]]
DB_PORT=
DB_DATABASE=[[softdb]]
DB_USERNAME=[[softdbuser]]
DB_PASSWORD="[[softdbpass]]"
DB_LOG_SQL=false
DB_LOG_SQL_EXPLAIN=false #only for MySQL

# List foreign keys in diagnostic page
DB_LIST_FOREIGN_KEYS=false

# Application timezone. If not specified, the server's default timezone is used.
# Requires a named timezone identifier.
# See https://www.php.net/manual/en/timezones.php for the list of supported timezones.
# Don't use a timezone offset (like +01:00) or a timezone abbreviation (like CEST)
# TIMEZONE=Europe/Paris

# Visibility of directories and (media) files in LYCHEE_UPLOADS
# Possible values are:
#
#  - private: world group has neither read nor write access
#  - public: world group has read access but no write access (the default)
#  - world: world group has read and write access
#
# The default should suffice for most installations.
# For improved security, change this setting to "private".
# Some rare setups may require directories and files to be world writeable.
# In this case, use "world" here.
# USE WITH PRECAUTIONS: world writeable files and folders may be a SECURITY RISK.
# LYCHEE_IMAGE_VISIBILITY=public

# folders in which the files will be stored
# LYCHEE_UPLOADS="/var/www/html/Lychee-Laravel/public/uploads/"
# LYCHEE_DIST="/var/www/html/Lychee-Laravel/public/dist/"
# LYCHEE_SYM="/var/www/html/Lychee-Laravel/public/sym/"
# url to access those files
# LYCHEE_UPLOADS_URL="uploads/"
# LYCHEE_DIST_URL="dist/"
# LYCHEE_SYM_URL="sym/"

# Support for token based authentication used by API requests. Enabled by default.
# ENABLE_TOKEN_AUTH=true

# Lychee supports both Redis and file caching.
# To use Redis, set CACHE_DRIVER to redis and configure the Redis connection.
CACHE_DRIVER=file
# CACHE_FILE_PATH=storage/framework/cache/data
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379
# REDIS_URL=redis://<username>:<password>@<host>:<port>

# If you use Redis as cache driver, we strongly recommend
# to disable it for your Log Viewer.
# Should redis crash, you will no longer be able to access your logs.
LOG_VIEWER_CACHE_DRIVER=file
LOG_STDOUT=false

# Session configuration
SESSION_DRIVER=file
SESSION_LIFETIME=120
# Duration (in minutes) for the "Remember Me" cookie. Default: 40320 (4 weeks)
# REMEMBER_LIFETIME=40320

# `sync` if jobs need to be executed live (default) or `database` if they can be deferred.
QUEUE_CONNECTION=sync
# Choose this mode only if you have set up a queue worker (strongly recommended though).
# QUEUE_CONNECTION=database

SECURITY_HEADER_HSTS_ENABLE=false
SECURITY_HEADER_CSP_CONNECT_SRC=
SECURITY_HEADER_SCRIPT_SRC_ALLOW=
SECURITY_HEADER_CSP_CHILD_SRC=
SECURITY_HEADER_CSP_FONT_SRC=
SECURITY_HEADER_CSP_FORM_ACTION=
SECURITY_HEADER_CSP_FRAME_ANCESTORS=
SECURITY_HEADER_CSP_FRAME_SRC=
SECURITY_HEADER_CSP_IMG_SRC=
SECURITY_HEADER_CSP_MEDIA_SRC=
SESSION_SECURE_COOKIE=false

MAIL_DRIVER=smtp
MAIL_HOST=
MAIL_PORT=
MAIL_USERNAME=
MAIL_PASSWORD=
MAIL_ENCRYPTION=
MAIL_FROM_NAME=
MAIL_FROM_ADDRESS=

# Only used when MAIL_DRIVER is set to "mailgun" or "postmark" respectively.
# Both secrets also support the "_FILE" convention described above.
# MAILGUN_DOMAIN=
# MAILGUN_SECRET=
# MAILGUN_SECRET_FILE=/run/secrets/mailgun_secret
# MAILGUN_ENDPOINT=api.mailgun.net
# POSTMARK_TOKEN=
# POSTMARK_TOKEN_FILE=/run/secrets/postmark_token

# The trusted proxies if Lychee is behind a reverse proxy
# Accepted values:
#  - `null`: no proxy
#  - `*`: any proxy
#  - <ip address>[,<ip address>]: a comma-seperated list of IP addresses
TRUSTED_PROXIES=null

# Comma-separated list of class names of diagnostics checks that should be skipped.
#SKIP_DIAGNOSTICS_CHECKS=

VITE_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
VITE_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"

# Disable Basic Auth. This means that the only way to authenticate is via the API token or Oauth.
# This should only be toggled AFTER having set up the admin account and bound the Oauth client.
# DISABLE_BASIC_AUTH=false

# Disable WebAuthn. This means that the only way to authenticate is via the API token, Basic Auth or Oauth.
# DISABLE_WEBAUTHN=false

# White-label mode — hides all Lychee branding from the UI (footer link, generator meta tag,
# misconfiguration warning, left-menu "Lychee" section, and login-form branding).
# NOTE: This setting only takes effect when a valid Lychee Supporter Edition (SE) licence is active.
#       On non-SE installations the flag is ignored and Lychee branding remains visible.
# WHITE_LABEL_ENABLED=false

###################################################################
# Keygen License Management                                       #
###################################################################

# API token obtained from keygen.lycheeorg.dev.
# When set, Lychee will automatically rotate an expired license key
# on admin login and check the token health on the diagnostics page.
# KEYGEN_API_KEY=

###################################################################
# LDAP Authentication (enterprise directory integration)         #
###################################################################

# Enable LDAP authentication alongside or instead of basic auth
# LDAP_ENABLED=false

# LDAP Server connection settings
# LDAP_HOST=ldap.example.com
# LDAP_PORT=389
# For LDAPS (LDAP over SSL), use port 636
# LDAP_PORT=636

# Base DN for LDAP searches (e.g., dc=example,dc=com or dc=corp,dc=example,dc=com)
# LDAP_BASE_DN=dc=example,dc=com

# Service account credentials for LDAP bind
# This account needs read-only access to user and group attributes
# LDAP_BIND_DN=cn=lychee-service,ou=services,dc=example,dc=com
# LDAP_BIND_PASSWORD=securepassword

# LDAP user search filter (%s is replaced with username)
# For OpenLDAP:
# LDAP_USER_FILTER=(&(objectClass=person)(uid=%s))
# For Active Directory:
# LDAP_USER_FILTER=(&(objectClass=user)(sAMAccountName=%s))

# LDAP attribute mapping (maps LDAP attributes to Lychee user fields)
# OpenLDAP defaults:
# LDAP_ATTR_USERNAME=uid
# LDAP_ATTR_EMAIL=mail
# LDAP_ATTR_DISPLAY_NAME=displayName
# Active Directory alternatives:
# LDAP_ATTR_USERNAME=sAMAccountName
# LDAP_ATTR_EMAIL=userPrincipalName
# LDAP_ATTR_DISPLAY_NAME=displayName

# Admin role mapping via LDAP group
# Users in this group will have may_administrate=true
# LDAP_ADMIN_GROUP_DN=cn=lychee-admins,ou=groups,dc=example,dc=com

# Auto-provision users on first LDAP login
# If false, users must be pre-created in Lychee before they can log in via LDAP
# LDAP_AUTO_PROVISION=true

# TLS/SSL settings for secure LDAP connections
# LDAP_USE_TLS=true
# LDAP_TLS_VERIFY_PEER=true

# Connection timeout in seconds
# LDAP_CONNECTION_TIMEOUT=5

# Oauth token data
# XXX_REDIRECT_URI should be left as default unless you know exactly what you do.
#
# Docker/Kubernetes secrets: when running the official Docker image, every confidential
# value below - as well as AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY, MAILGUN_SECRET,
# POSTMARK_TOKEN, AI_VISION_FACE_API_KEY and AI_VISION_NSFW_API_KEY further down - can be
# provided via a file instead of in plaintext here: set "<VAR>_FILE" to the file's path
# (e.g. AMAZON_SIGNIN_SECRET_FILE=/run/secrets/amazon_signin_secret) and leave "<VAR>"
# itself unset. This is resolved by docker/scripts/01-validate-env.sh at container
# startup. See docker-compose.yaml for ready-to-use examples.

# AMAZON_SIGNIN_CLIENT_ID=
# AMAZON_SIGNIN_SECRET=
# AMAZON_SIGNIN_REDIRECT_URI=/auth/amazon/redirect

# https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple
# Note: the client secret used for "Sign In with Apple" is a JWT token that can have a maximum lifetime of 6 months.
# The article above explains how to generate the client secret on demand and you'll need to update this every 6 months.
# To generate the client secret for each request, see Generating A Client Secret For Sign In With Apple On Each Request.
# https://bannister.me/blog/generating-a-client-secret-for-sign-in-with-apple-on-each-request
# APPLE_CLIENT_ID=
# APPLE_CLIENT_SECRET=
# APPLE_REDIRECT_URI=/auth/apple/redirect

# FACEBOOK_CLIENT_ID=
# FACEBOOK_CLIENT_SECRET=
# FACEBOOK_REDIRECT_URI=/auth/facebook/redirect

# GITHUB_CLIENT_ID=
# GITHUB_CLIENT_SECRET=
# GITHUB_REDIRECT_URI=/auth/github/redirect

# GOOGLE_CLIENT_ID=
# GOOGLE_CLIENT_SECRET=
# GOOGLE_REDIRECT_URI=/auth/google/redirect

# MASTODON_DOMAIN=https://mastodon.social
# MASTODON_ID=
# MASTODON_SECRET=
# MASTODON_REDIRECT_URI=/auth/mastodon/redirect

# MICROSOFT_CLIENT_ID=
# MICROSOFT_CLIENT_SECRET=
# MICROSOFT_REDIRECT_URI=/auth/microsoft/redirect
# MICROSOFT_TENANT_ID=

# NEXTCLOUD_CLIENT_ID=
# NEXTCLOUD_CLIENT_SECRET=
# NEXTCLOUD_REDIRECT_URI=/auth/nextcloud/redirect
# NEXTCLOUD_BASE_URI=

# KEYCLOAK_CLIENT_ID=
# KEYCLOAK_CLIENT_SECRET=
# KEYCLOAK_REDIRECT_URI=/auth/keycloak/redirect
# KEYCLOAK_BASE_URL=
# KEYCLOAK_REALM=

# AUTHENTIK_BASE_URL=
# AUTHENTIK_CLIENT_ID=
# AUTHENTIK_CLIENT_SECRET=
# AUTHENTIK_REDIRECT_URI=/auth/authentik/redirect

# AUTHELIA_BASE_URL=
# AUTHELIA_CLIENT_ID=
# AUTHELIA_CLIENT_SECRET=
# AUTHELIA_REDIRECT_URI=/auth/authelia/redirect

# AWS support data

# AWS_ACCESS_KEY_ID=
# AWS_ACCESS_KEY_ID_FILE=/run/secrets/aws_access_key_id
# AWS_SECRET_ACCESS_KEY=
# AWS_SECRET_ACCESS_KEY_FILE=/run/secrets/aws_secret_access_key
# AWS_DEFAULT_REGION=
# AWS_BUCKET=
# AWS_URL=
# AWS_ENDPOINT=
# AWS_IMAGE_VISIBILITY=
# AWS_USE_PATH_STYLE_ENDPOINT=

###################################################################
# Vite local development without running a server.                #
# set VITE_LOCAL_DEV to true                                       #
# set VITE_HTTP_PROXY_TARGET to the rediction for the API calls.  #
###################################################################
# VITE_LOCAL_DEV=true
# VITE_HTTP_PROXY_TARGET=http://localhost:8000

# DISABLE_IMPORT_FROM_SERVER=false

# On shared hosting where sys_get_temp_dir() is not readable/writable,
# set to false to use storage/tmp/uploads_parts instead.
# USE_SYSTEM_TEMP_DIR=true

# When enabled, the caching settings (cache_enabled, cache_ttl,
# cache_event_logging) become visible in the admin settings panel.
# ENABLE_CACHING=false

###################################################################
# Payment integration (requires SE)                               #
###################################################################

# Enable test mode (Sandbox mode) for payment gateways.
# In test mode, no real money transactions are done.
# We set it to true by default for safety. Make sure to set it to false
# when you go live.
# OMNIPAY_TEST_MODE=true

# Configuration values for Mollie integration
# MOLLIE_API_KEY=
# MOLLIE_PROFILE_ID=

# Configuration values for Stripe integration (NOT WORKING YET, MAYBE LATER)
# STRIPE_API_KEY=
# STRIPE_PUBLISHABLE_KEY=

# Configuration values for PayPal integration
# PAYPAL_CLIENT_ID=
# PAYPAL_SECRET=

###################################################################
# AI Vision (facial recognition & NSFW classification)            #
###################################################################

# AI_VISION_FACE_URL=
# AI_VISION_FACE_API_KEY=
# AI_VISION_FACE_API_KEY_FILE=/run/secrets/ai_vision_face_api_key
# AI_VISION_NSFW_URL=
# AI_VISION_NSFW_API_KEY=
# AI_VISION_NSFW_API_KEY_FILE=/run/secrets/ai_vision_nsfw_api_key
#
# See the "lychee_facial_recognition" and "lychee_nsfw_classification" services
# in docker-compose.yaml for a ready-to-use sidecar setup for both.

###################################################################
# Local reverse geo-decoding                                      #
###################################################################

# Nominatim-API-compatible endpoint (e.g. a self-hosted Nominatim
# instance). When set, it is used instead of the public
# nominatim.openstreetmap.org server.
# This is a bring-your-own-service integration - see the commented
# "lychee_geo_decoding" example service in docker-compose.yaml.
# LOCAL_GEO_DECODING_URL=