at-container-registry/deploy/.env.prod.template

# ATCR Production Environment Configuration
# Copy this file to .env and fill in your values
#
# Usage:
#   1. cp deploy/.env.prod.template .env
#   2. Edit .env with your configuration
#   3. systemctl restart atcr
#
# NOTE: This file is loaded by docker-compose.prod.yml

# ==============================================================================
# Domain Configuration
# ==============================================================================

# Main AppView domain (registry API + web UI)
# REQUIRED: Update with your domain
APPVIEW_DOMAIN=atcr.io

# Hold service domain (presigned URL generator)
# REQUIRED: Update with your domain
HOLD_DOMAIN=hold01.atcr.io

# ==============================================================================
# Hold Service Configuration
# ==============================================================================

# Your ATProto DID (REQUIRED for hold registration)
# Get your DID from: https://bsky.social/xrpc/com.atproto.identity.resolveHandle?handle=yourhandle.bsky.social
# Example: did:plc:abc123xyz789
HOLD_OWNER=did:plc:pddp4xt5lgnv2qsegbzzs4xg

# Allow public blob reads (pulls) without authentication
# - true: Anyone can pull images (read-only)
# - false: Only authenticated users can pull
# Default: false (private)
HOLD_PUBLIC=false

# ==============================================================================
# S3/UpCloud Object Storage Configuration
# ==============================================================================

# Storage driver type
# Options: s3, filesystem
# Default: s3
STORAGE_DRIVER=s3

# S3 Access Credentials
# Get these from UpCloud Object Storage console
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=

# S3 Region
# UpCloud regions: us-chi1, us-nyc1, de-fra1, uk-lon1, sg-sin1, etc.
# Default: us-chi1
AWS_REGION=us-chi1

# S3 Bucket Name
# Create this bucket in UpCloud Object Storage
# Example: atcr-blobs
S3_BUCKET=atcr

# S3 Endpoint (for custom domain or UpCloud endpoint)
# If using custom domain (blobs.atcr.io):
#   S3_ENDPOINT=https://blobs.atcr.io
# If using UpCloud default endpoint:
#   S3_ENDPOINT=https://s3.us-chi1.upcloudobjects.com
#
# IMPORTANT: If using custom domain, create CNAME:
#   blobs.atcr.io → [bucket].us-chi1.upcloudobjects.com
#   (with Cloudflare proxy DISABLED - gray cloud)
S3_ENDPOINT=https://blobs.atcr.io

# S3 Region Endpoint (alternative to S3_ENDPOINT)
# Use this if your S3 driver requires region-specific endpoint format
# Example: s3.us-chi1.upcloudobjects.com
# S3_REGION_ENDPOINT=

# ==============================================================================
# AppView Configuration
# ==============================================================================

# JWT token expiration in seconds
# Default: 300 (5 minutes)
ATCR_TOKEN_EXPIRATION=300

# Enable web UI
# Default: true
ATCR_UI_ENABLED=true

# ==============================================================================
# Logging Configuration
# ==============================================================================

# Log level: debug, info, warn, error
# Default: info
ATCR_LOG_LEVEL=info

# Log formatter: text, json
# Default: text
ATCR_LOG_FORMATTER=text

# ==============================================================================
# Jetstream Configuration (ATProto event streaming)
# ==============================================================================

# Jetstream WebSocket URL for real-time ATProto events
# Default: wss://jetstream2.us-west.bsky.network/subscribe
JETSTREAM_URL=wss://jetstream2.us-west.bsky.network/subscribe

# Enable backfill worker to sync historical records
# Default: true (recommended for production)
ATCR_BACKFILL_ENABLED=true

# ATProto relay endpoint for backfill sync API
# Default: https://relay1.us-east.bsky.network
ATCR_RELAY_ENDPOINT=https://relay1.us-east.bsky.network

# Backfill interval
# Examples: 30m, 1h, 2h, 24h
# Default: 1h
ATCR_BACKFILL_INTERVAL=1h

# ==============================================================================
# Optional: Filesystem Storage (alternative to S3)
# ==============================================================================

# If using filesystem storage instead of S3:
# 1. Uncomment these lines
# 2. Comment out all S3 variables above
# 3. Set STORAGE_DRIVER=filesystem

# STORAGE_DRIVER=filesystem
# STORAGE_ROOT_DIR=/var/lib/atcr/hold

# ==============================================================================
# Advanced Configuration
# ==============================================================================

# Override service name (defaults to APPVIEW_DOMAIN)
# ATCR_SERVICE_NAME=atcr.io

# Debug listen address (optional - for pprof debugging)
# ATCR_DEBUG_ADDR=:5001

# ==============================================================================
# CHECKLIST
# ==============================================================================
#
# Before starting ATCR, ensure you have:
#
# ☐ Set APPVIEW_DOMAIN (e.g., atcr.io)
# ☐ Set HOLD_DOMAIN (e.g., hold01.atcr.io)
# ☐ Set HOLD_OWNER (your ATProto DID)
# ☐ Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
# ☐ Set S3_BUCKET (created in UpCloud Object Storage)
# ☐ Set S3_ENDPOINT (UpCloud endpoint or custom domain)
# ☐ Configured DNS records:
#     - A record: atcr.io → server IP
#     - A record: hold01.atcr.io → server IP
#     - CNAME: blobs.atcr.io → [bucket].us-chi1.upcloudobjects.com
# ☐ Disabled Cloudflare proxy (gray cloud, not orange)
# ☐ Waited for DNS propagation (check with: dig atcr.io)
#
# After starting:
# ☐ Complete hold OAuth registration (run: /opt/atcr/get-hold-oauth.sh)
# ☐ Test registry: docker pull atcr.io/test/image
# ☐ Monitor logs: /opt/atcr/logs.sh