.env.example

# Collie configuration. Copy to your plugin config dir as `.env`:
#   cp .env.example "$(herdr plugin config-dir herdr.collie)/.env"
# All values are optional; the defaults suit a single-user, tailnet-only setup.

# --- Networking ---
# Port the bridge listens on (loopback only; tailscale serve proxies to it).
COLLIE_PORT=8787
# Bind host. Keep this loopback. Binding 0.0.0.0 makes identity checks meaningless.
COLLIE_HOST=127.0.0.1
# How the bridge is published on the tailnet (read by collie-ctl.sh when it runs `tailscale serve`,
# not by the bridge itself): "https" (default — tailnet :443, Tailscale-managed cert) or "http"
# (plain HTTP on :$COLLIE_PORT — for Headscale / `.internal` domains without HTTPS certs; then set
# COLLIE_PUBLIC_HOSTS below, and note PWA install + Web Push need a secure context).
# COLLIE_SERVE_MODE=https
# Skip tailscale serve entirely (set to 1 when using a reverse proxy like Caddy/Nginx).
# The bridge stays on 127.0.0.1 only — your proxy handles TLS, auth, and public access.
# With this enabled, set COLLIE_ALLOWED_ORIGINS and COLLIE_PUBLIC_HOSTS to match your proxy's hostname.
# In this mode COLLIE_TRUSTED_USER has no effect (no tailscale serve injects the identity header) —
# use COLLIE_DEVICE_HEADER for per-device auth instead (README → Variant C).
# COLLIE_SKIP_SERVE=1
# Your public URL behind the proxy — shown as the "proxy" address by `collie-ctl.sh status`.
# COLLIE_PUBLIC_URL=https://collie.example.com

# --- Herdr connection ---
# Usually injected by the systemd unit; override only if your socket is elsewhere.
# HERDR_SOCKET_PATH=/home/you/.config/herdr/herdr.sock
# Poll cadence (ms) and scrollback lines pulled for the detail view.
COLLIE_POLL_MS=1500
COLLIE_READ_LINES=200
# Keys sent to submit a reply after the text (comma-separated). Agent-dependent.
COLLIE_SUBMIT_KEYS=Enter
# Multi-session support (default on). One bridge fronts every running herdr session it finds under
# the config root (<HERDR_SOCKET_PATH dir>/herdr.sock + sessions/<name>/herdr.sock), and the UI gains
# a session switcher. Set "off" (or 0/false) to pin the bridge to the primary session only — no
# discovery, identical to the pre-multi-session behaviour.
# COLLIE_MULTI_SESSION=on

# --- Security ---
# If set, requests must carry a matching Tailscale-User-Login header (from `tailscale serve`).
# COLLIE_TRUSTED_USER=you@example.com
#
# Optional per-device authorisation (OFF by default). When Collie sits behind a reverse proxy that
# authenticates the device and injects its identity as a request header, name that header here to
# trust and enforce it. Proxy-agnostic — the value is just an opaque device id; Collie doesn't care
# how the proxy derived it. The header is trusted only because the bridge binds loopback behind the
# proxy (a direct client can't set it). Leave unset to disable.
# COLLIE_DEVICE_HEADER=X-Device-Id
# Device ids allowed to perform sensitive actions (typing into agents, creating tabs/spaces). Any
# other device carrying the header is read-only; an absent header is the on-host operator (unchanged).
# To revoke a device, drop its id from this list and `systemctl --user restart collie`. With the
# header set but this list empty, EVERY device is read-only (fail-closed).
# COLLIE_DEVICE_ALLOWLIST=my-phone,my-laptop
# Extra allowed browser origins (comma-separated, each a FULL origin incl. scheme).
# The bridge is same-origin only: a request passes when the browser's Origin host equals the Host
# header the bridge receives (loopback always allowed). A plain `tailscale serve` on your MagicDNS
# name matches automatically, so you DON'T need this for a normal Tailscale setup.
# You DO need it when a *different* public hostname or an extra reverse proxy / TLS terminator fronts
# Collie (a custom/vanity domain, a load balancer, Headscale + upstream TLS) — the public origin then
# no longer matches the forwarded Host and API calls return 403 "cross-origin rejected". Add that
# exact origin here. e.g.:
# COLLIE_ALLOWED_ORIGINS=https://collie.example.com
#
# Host allowlist (comma-separated host[:port] values). Every remotely received Host must match one of
# these entries after canonicalization. Loopback Host values are accepted only from an actual
# loopback socket peer on a direct request; forwarding headers disable that local-only exception.
# COLLIE_ALLOWED_ORIGINS never expands this list. Remote requests are denied when this is unset,
# so list every IP, FQDN, or MagicDNS name used to reach Collie.
# COLLIE_PUBLIC_HOSTS=herd.your-tailnet.ts.net

# --- Web Push (optional) ---
# Generate with: bunx web-push generate-vapid-keys   (after `bun add web-push`)
# COLLIE_VAPID_PUBLIC=
# COLLIE_VAPID_PRIVATE=
# COLLIE_VAPID_SUBJECT=mailto:you@example.com