# Copy to .env and edit. See docs/quickstart-compose.md for the full walkthrough.

# Image tag to run — set this to a released image/vX.Y.Z-N tag once you have
# one (see docs/versioning.md); "latest" is fine to try things out with.
APTLY_IMAGE_TAG=latest

# Host port nginx (reads + the auth-gated /api/) is published on.
APTLY_PUBLISH_PORT=8080

# --- Auth (security.preset "publicRead" equivalent) ---
# Password for the internal user aptly-reconcile/aptly-mirror-refresh use to
# talk through nginx. Required — has no default, compose refuses to start
# without it. Any non-trivial value; nothing external ever needs to know it.
APTLY_INTERNAL_PASSWORD=changeme-generate-a-real-secret

# Also edit config/users (copy from config/users.example) with the
# username:password pairs that external CI/uploaders should use.

# --- GPG signing ---
# true (default): publishing requires a signing key at config/gpg/private.asc
#   (+ config/gpg/passphrase if it's passphrase-protected). Missing key ->
#   aptly-init logs a WARN and publishes unsigned instead of failing to start
#   — check `docker compose logs aptly-init` after first boot.
# false: explicitly unsigned, no key needed. See docs/security.md.
APTLY_GPG_ENABLED=true

# Directory containing private.asc (and optionally passphrase). Defaults to
# ./config/gpg, gitignored.
#APTLY_GPG_DIR=./config/gpg

# --- Reconcile ---
# false (default): an unreachable mirror or malformed state.yaml entry only
#   warns — `docker compose up` still succeeds. Set true in CI to catch
#   mistakes in state.yaml.
APTLY_RECONCILE_FAIL_ON_ERROR=false

# --- Backup (docker compose --profile backup run --rm backup) ---
#APTLY_BACKUP_DIR=./backup