.env.example

# Failover LB settings.
#
# Copy this to .env and fill it in.  Running ./install.sh does this for you and
# generates the secrets, so most people never edit this by hand.
#
#   cp .env.example .env
#
# One .env per node.  The node name and address are different on every box.
# Everything else is usually the same across the cluster.

# ==============================================================================
# Who this node is
# ==============================================================================

# Short name for this box.  Shows up all over the GUI, so make it something you
# will recognize at 3am.  Has to be unique in the cluster.
NFM_NODE_NAME=lb-01

# The address other nodes use to reach this one.  Use an address on the network
# your load balancers share, not the public one and not 127.0.0.1.  The other
# nodes have to be able to open a connection to this address on the peer port.
NFM_NODE_ADDRESS=10.20.30.41

# Who wins the election when the cluster picks an active node.  Higher number
# wins.  Give your beefiest box the highest number.  Ties break on node name so
# the result is always the same, never a coin flip.
NFM_CLUSTER_PRIORITY=100

# ==============================================================================
# Ports
# ==============================================================================

# The web GUI.  Pick something that does not collide with the sites nginx is
# already serving on 80 and 443.
NFM_GUI_PORT=7443

# Node to node traffic.  This one requires a client cert signed by the cluster
# CA, so a browser hitting it gets nowhere.  Firewall it to your peers anyway.
NFM_PEER_PORT=7444

# What address to bind to.  0.0.0.0 is every interface.  If your management
# network is its own NIC, put that address here instead and cut your exposure.
NFM_BIND_ADDRESS=0.0.0.0

# ==============================================================================
# Security
# ==============================================================================

# Encrypts secrets at rest in the database: the OIDC client secret, DNS API
# tokens, and the per peer HMAC keys.  install.sh generates this.
#
# Make it yourself with:
#   openssl rand -base64 48
#
# Every node needs its OWN key.  Do not copy this between boxes.  Losing it
# means the encrypted settings have to be entered again, so put it wherever you
# keep secrets.
NFM_SECRET_KEY=

# Which networks may load the GUI at all.  Comma separated CIDRs.  This is
# checked before the login page even renders, so a stolen password from outside
# these ranges still gets nowhere.
#
# Leave it empty and anybody who can reach the port sees the login page.  Set it.
#
#   NFM_ADMIN_ALLOWLIST=10.20.30.0/24,192.168.50.10/32
NFM_ADMIN_ALLOWLIST=

# Whose X-Forwarded-For header we are willing to believe.  Comma separated
# CIDRs, and empty is the right answer unless you put a proxy in front.
#
# Empty means the header is ignored completely and we use the address the
# connection actually came from.  That is correct when the GUI is reached
# directly, because anybody can send that header, and believing it from a
# stranger lets them put a management address in it and walk through the allow
# list above.
#
# Set it when a proxy you control sits in front of the GUI, and set it to that
# proxy and nothing else.  Get it wrong in the other direction, by proxying
# without setting this, and every visitor arrives wearing the proxy's address,
# which is usually loopback, and the allow list passes the whole internet while
# looking like it is working.
#
#   NFM_TRUSTED_PROXIES=127.0.0.1/32
NFM_TRUSTED_PROXIES=

# Log people out after this many idle minutes.
NFM_SESSION_TIMEOUT_MINUTES=60

# ==============================================================================
# OIDC single sign on.  Optional.
# ==============================================================================
#
# Turn this on and your normal company logins work.  Local break glass accounts
# keep working no matter what, which matters, because if your identity provider
# is down you still need to get in and fix nginx.

NFM_OIDC_ENABLED=false

# The discovery document from your provider.  Usually ends in
# /.well-known/openid-configuration
NFM_OIDC_DISCOVERY_URL=

NFM_OIDC_CLIENT_ID=
NFM_OIDC_CLIENT_SECRET=

# The base URL people actually type to get here.  The redirect back from the
# provider gets built from this, so it has to match what you registered.
#   NFM_OIDC_REDIRECT_BASE=https://lb-01.mgmt.example.com:7443
NFM_OIDC_REDIRECT_BASE=

# Which claim in the token holds the group list, and which group maps to which
# role.  Admin can change anything, operator can change config but not users or
# cluster trust, viewer can only look.
NFM_OIDC_GROUPS_CLAIM=groups
NFM_OIDC_ADMIN_GROUP=nginx-admins
NFM_OIDC_OPERATOR_GROUP=nginx-operators
NFM_OIDC_VIEWER_GROUP=nginx-viewers

# ==============================================================================
# Certificates
# ==============================================================================

# Where Lets Encrypt sends the "your cert expires soon" mail.  Use a list that
# more than one person reads, not somebody's personal mailbox.
NFM_ACME_EMAIL=ssl-admin@example.com

# Point at the staging service while you are setting things up.  Staging certs
# are not trusted by browsers, but the rate limits are way looser, and the real
# service will lock you out for a week if you hammer it.  Flip this to false
# when you are ready for certs that actually work.
NFM_ACME_STAGING=true

# ==============================================================================
# Day to day
# ==============================================================================

# debug, info, warning, error
NFM_LOG_LEVEL=info

# Group id of the nginxmgr group on the host.  install.sh makes this group and
# gives it the agent socket.  Only change it if 10001 was already taken and the
# installer had to pick something else.
NFM_HOST_GID=10001

# Image tag to run.
NFM_VERSION=1.0.0