Lynx/.env.example at main · BTreeMap/Lynx · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
# Database Configuration
# Options: sqlite, postgres
DATABASE_BACKEND=sqlite
# For SQLite
DATABASE_URL=sqlite://./lynx.db
# For PostgreSQL (example)
# DATABASE_URL=postgresql://user:password@localhost/lynx
# Database connection pool size (default: 30)
# DATABASE_MAX_CONNECTIONS=30

# Cache Configuration
# Maximum number of entries in the read cache (default: 500000, approximately 100MB)
# CACHE_MAX_ENTRIES=500000
# Interval in seconds to flush buffered click statistics to database (default: 5)
# CACHE_FLUSH_INTERVAL_SECS=5
# Actor buffer size for click counting (default: 1000000)
# Larger values prevent message loss during traffic spikes
# ACTOR_BUFFER_SIZE=1000000
# Fast flush interval in milliseconds for Layer 1→Layer 2 (default: 100)
# Controls staleness of real-time statistics
# ACTOR_FLUSH_INTERVAL_MS=100

# API Server Configuration (for management operations)
API_HOST=127.0.0.1
API_PORT=8080

# Redirect Server Configuration (for client-facing URL redirects)
REDIRECT_HOST=127.0.0.1
REDIRECT_PORT=3000
# Optional: Explicit redirect base URL advertised to clients (e.g., https://lynx.example)
# If not set, derived from REDIRECT_SCHEME (or inferred) + host/port
# REDIRECT_BASE_URL=https://lynx.example
# Optional: Override scheme used when deriving redirect base URL (default: http/https based on port)
# REDIRECT_SCHEME=https
# Optional: HTTP status code for redirects (default: 308)
# Valid values: 301 (Moved Permanently - legacy), 302 (Found - legacy), 303 (See Other),
#               307 (Temporary Redirect), 308 (Permanent Redirect - modern default)
# REDIRECT_STATUS_CODE=308

# Enable diagnostic timing headers in redirect responses (default: false)
# When true, adds X-Lynx-Cache-Hit, X-Lynx-Timing-Total-Ms, etc. to redirect responses
# ENABLE_TIMING_HEADERS=false

# Short code configuration
# Maximum length for custom short codes (default: 50)
# SHORT_CODE_MAX_LENGTH=50

# Authentication Configuration
# Options: none, oauth, cloudflare
AUTH_MODE=none
# Set to 'true' to completely disable authentication (legacy, use AUTH_MODE=none instead)
# DISABLE_AUTH=false

# OAuth Configuration (only needed when AUTH_MODE=oauth)
# OAUTH_ISSUER_URL=https://auth.yourdomain.com/realms/lynx
# OAUTH_CLIENT_ID=lynx-frontend
# OAUTH_REDIRECT_URI=http://localhost:8080/auth/callback
# OAUTH_SCOPES=openid profile email
# Optional: Audience claim expected by backend verifier (defaults to OAUTH_CLIENT_ID)
# OAUTH_AUDIENCE=lynx-frontend
# Optional: Override JWKS endpoint (defaults to issuer discovery document)
# OAUTH_JWKS_URL=https://auth.yourdomain.com/realms/lynx/protocol/openid-connect/certs
# Optional: JWKS cache TTL in seconds (default: 300)
# OAUTH_JWKS_CACHE_SECS=300

# Cloudflare Zero Trust Configuration (only needed when AUTH_MODE=cloudflare)
# Team domain should be like: https://your-team-name.cloudflareaccess.com
# CLOUDFLARE_TEAM_DOMAIN=https://your-team-name.cloudflareaccess.com
# Application Audience (AUD) tag from your Access Application
# CLOUDFLARE_AUDIENCE=your-application-aud-tag
# Optional: Certificate cache TTL in seconds (default: 86400 = 24 hours)
# CLOUDFLARE_CERTS_CACHE_SECS=86400

# Frontend Configuration
# Optional: Path to directory containing static frontend files
# If not set, uses embedded frontend (bundled at compile time)
# FRONTEND_STATIC_DIR=/path/to/frontend/dist

# Pagination Configuration
# HMAC secret for cursor-based pagination
# If not set, a dynamic key is generated at runtime (cursors won't survive server restarts)
# For production, set this to a random 32+ character string
# CURSOR_HMAC_SECRET=your-random-secret-key-here-at-least-32-characters

# Analytics Configuration (optional)
# Enable visitor IP analytics with GeoIP lookups
# ANALYTICS_ENABLED=false
# Path to MaxMind GeoLite2-City or GeoIP2-City database file (.mmdb)
# Download from: https://dev.maxmind.com/geoip/geolite2-free-geolocation-data
# ANALYTICS_GEOIP_CITY_DB_PATH=/path/to/GeoLite2-City.mmdb
# Path to MaxMind GeoLite2-ASN database file (.mmdb)
# ANALYTICS_GEOIP_ASN_DB_PATH=/path/to/GeoLite2-ASN.mmdb
# Enable IP address anonymization (truncate to /24 for IPv4, /48 for IPv6)
# ANALYTICS_IP_ANONYMIZATION=false
# Trusted proxy mode for client IP extraction
# Options: none (use socket address), standard (RFC 7239 / X-Forwarded-For), cloudflare (CF-Connecting-IP)
# ANALYTICS_TRUSTED_PROXY_MODE=none
# Comma-separated list of trusted proxy CIDR ranges (when using standard mode)
# ANALYTICS_TRUSTED_PROXIES=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
# Number of trusted proxies to skip from the right in X-Forwarded-For (alternative to CIDR list)
# ANALYTICS_NUM_TRUSTED_PROXIES=1
# Flush interval for analytics aggregator in seconds (default: 60)
# ANALYTICS_FLUSH_INTERVAL_SECS=60