deploy.env.example

# Non-secret inputs consumed by deploy/compose.example.yaml and the explicit
# deploy/saltbox/preflight.sh --env-file parser. Use one unquoted literal
# NAME=value per line; whitespace, quotes, and shell interpolation are rejected.
# Values marked REQUIRED intentionally stop deployment when unresolved.

MOVIENIGHT_IMAGE=ghcr.io/REPLACE_OWNER/movie-night@sha256:REPLACE_WITH_RELEASE_DIGEST
MOVIENIGHT_HOSTNAME=movie-night.example.com
MOVIENIGHT_SOURCE_URL=https://github.com/jcll/movie-night
MOVIENIGHT_PROXY_NETWORK_NAME=proxy
MOVIENIGHT_PRINCIPALS_FILE=/srv/movie-night/config/principals.json
MOVIENIGHT_PLEX_CONFIG_FILE=/srv/movie-night/config/plex.json
MOVIENIGHT_STATE_DIRECTORY=/srv/movie-night/state
MOVIENIGHT_CACHE_DIRECTORY=/srv/movie-night/cache
MOVIENIGHT_PREFLIGHT_SCRIPT=/srv/movie-night/preflight/preflight.sh

# These two positive byte counts have no production defaults. Set them only
# after the coexistence/storage review measures the aggregate cache budget and
# the free space that must remain for neighboring services.
MOVIENIGHT_CACHE_MAX_RESERVED_BYTES=REQUIRED_REVIEWED_AGGREGATE_CACHE_BYTES
MOVIENIGHT_CACHE_FREE_SPACE_FLOOR_BYTES=REQUIRED_REVIEWED_FREE_SPACE_FLOOR_BYTES

# These are paths to files owned by 65532:65532 with mode 0400, not secrets.
MOVIENIGHT_PROXY_HOP_SECRET_FILE=/srv/movie-night/secrets/proxy_hop_secret
MOVIENIGHT_PLEX_TOKEN_FILE=/srv/movie-night/secrets/plex_token
# Exactly 64 lowercase hexadecimal characters (32 random bytes), with an
# optional final newline. Keep this stable so sealed selections survive restarts.
MOVIENIGHT_MEDIA_SESSION_KEY_FILE=/srv/movie-night/secrets/media_session_key

# Replace these generic middleware names with names from the operator's proxy.
# The protected routers separately use the shipped file-provider chain:
# movienight-drop-client-identity, movienight-forward-auth, then
# movienight-proxy-hop.
MOVIENIGHT_HTTP_MIDDLEWARES=REQUIRED_HTTP_REDIRECT_MIDDLEWARES
MOVIENIGHT_COMMON_MIDDLEWARES=REQUIRED_COMMON_SECURITY_MIDDLEWARES
MOVIENIGHT_TLS_OPTIONS=REQUIRED_STRICT_TLS_OPTIONS
MOVIENIGHT_TLS_MAIN_DOMAIN=example.com
MOVIENIGHT_TLS_SANS=*.example.com
MOVIENIGHT_CERT_RESOLVER=REQUIRED_DNS_RESOLVER