env.example

# Copy to `.env` in the **repository root** (same folder as `README.md`) before
# `docker compose --project-directory . -f docker/docker-compose.yml up --build`.
# Never commit `.env`; it overrides the defaults documented in the handbook.

# --- First admin account (applied on first seed only / password sync rules in seed-database.php) ---
LOGANALYZER_ADMIN_USER=admin
LOGANALYZER_ADMIN_PASSWORD=loganalyzer

# --- MySQL (root used by seed; app user/pass used by LogAnalyzer UserDB connection) ---
MYSQL_ROOT_PASSWORD=loganalyzer_root
MYSQL_DATABASE=loganalyzer
MYSQL_USER=loganalyzer
MYSQL_PASSWORD=loganalyzer

# --- Install mode ---
# Consumer default in compose is 0 (no demo disk sources). Set to 1/true to seed bundled sample logs.
LOGANALYZER_SEED_SAMPLE_SOURCES=0

# --- Automatic disk sources (first DB seed only) ---
# Paths are INSIDE THE WEB CONTAINER — bind-mount host directories with docker-compose
# (see commented volume in docker/docker-compose.yml under `web`).
#
# Quick list: comma-separated absolute files, syslog line type; display name = basename(path).
# Example (after mounting `- /var/log:/mnt/hostlog:ro` on the web service):
# LOGANALYZER_DISK_SOURCE_PATHS=/mnt/hostlog/syslog,/mnt/hostlog/messages
#
# Advanced: records separated by ;; . Each record: name|path|syslog|description  OR name|path|event|description
#   (four fields max; the description may contain '|' — only the first three '|' separate name / path / kind / rest.)
#   syslog = RFC3164-ish text; event = EvntSLog / EventReporter file (winsyslog + eventlog parser).
# LOGANALYZER_DISK_SOURCES=Auth log|/mnt/hostlog/auth.log|syslog|PAM/ssh journal;;EVT|/mnt/winevt/report.log|event|Windows exporter
#
# Extra directories PHP may traverse (beyond auto-derived dirs from the paths above), comma-separated:
# LOGANALYZER_DISK_ALLOWED_EXTRA=/mnt/hostlog/,/srv/logs/