mirror of
https://github.com/snipe/snipe-it.git
synced 2026-04-02 22:11:01 +00:00
1482abc8b9
When PUBLIC_S3_PROXY=true, public uploads (images, logos, avatars) are served through a proxy controller instead of directly from S3. This allows using a single fully private S3 bucket for all storage, with no public ACLs or direct S3 URLs exposed to the browser. The proxy streams files from the configured public disk with proper cache headers (ETag, Last-Modified, Cache-Control). Disabled by default for full backward compatibility.
248 lines
6.9 KiB
Plaintext
248 lines
6.9 KiB
Plaintext
# --------------------------------------------
|
|
# REQUIRED: BASIC APP SETTINGS
|
|
# --------------------------------------------
|
|
APP_ENV=production
|
|
APP_DEBUG=false
|
|
APP_KEY=ChangeMe
|
|
APP_URL=null
|
|
APP_TIMEZONE='UTC'
|
|
APP_LOCALE='en-US'
|
|
MAX_RESULTS=500
|
|
|
|
# --------------------------------------------
|
|
# REQUIRED: UPLOADED FILE STORAGE SETTINGS
|
|
# --------------------------------------------
|
|
PRIVATE_FILESYSTEM_DISK=local
|
|
PUBLIC_FILESYSTEM_DISK=local_public
|
|
|
|
#PRIVATE_FILESYSTEM_DISK=s3_private
|
|
#PUBLIC_FILESYSTEM_DISK=s3_public
|
|
|
|
|
|
# --------------------------------------------
|
|
# REQUIRED: DATABASE SETTINGS
|
|
# --------------------------------------------
|
|
DB_CONNECTION=mysql
|
|
DB_HOST=127.0.0.1
|
|
DB_SOCKET=null
|
|
DB_PORT=3306
|
|
DB_DATABASE=null
|
|
DB_USERNAME=null
|
|
DB_PASSWORD=null
|
|
DB_PREFIX=null
|
|
DB_DUMP_PATH='/usr/bin'
|
|
DB_DUMP_SKIP_SSL=false
|
|
DB_CHARSET=utf8mb4
|
|
DB_COLLATION=utf8mb4_unicode_ci
|
|
DB_SANITIZE_BY_DEFAULT=false
|
|
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: SSL DATABASE SETTINGS
|
|
# --------------------------------------------
|
|
# Enable SSL connection to database (true/false)
|
|
DB_SSL=false
|
|
|
|
# Set to true for cloud databases like AWS RDS, Azure Database, Google Cloud SQL
|
|
# Set to false for self-hosted databases with client certificates
|
|
DB_SSL_IS_PAAS=false
|
|
|
|
# Required when DB_SSL_IS_PAAS=false (client certificate authentication)
|
|
DB_SSL_KEY_PATH=null
|
|
DB_SSL_CERT_PATH=null
|
|
|
|
# Path to CA certificate bundle (required for SSL connections)
|
|
# For AWS RDS, download from: https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
|
|
DB_SSL_CA_PATH=null
|
|
|
|
# SSL cipher (optional, leave null for default)
|
|
DB_SSL_CIPHER=null
|
|
|
|
# Verify server certificate (true/false, defaults to false if not set)
|
|
# Set to false for development or when using self-signed certificates
|
|
DB_SSL_VERIFY_SERVER=null
|
|
|
|
# --------------------------------------------
|
|
# REQUIRED: OUTGOING MAIL SERVER SETTINGS
|
|
# --------------------------------------------
|
|
MAIL_MAILER=smtp
|
|
MAIL_HOST=email-smtp.us-west-2.amazonaws.com
|
|
MAIL_PORT=587
|
|
MAIL_USERNAME=YOURUSERNAME
|
|
MAIL_PASSWORD=YOURPASSWORD
|
|
MAIL_FROM_ADDR=you@example.com
|
|
MAIL_FROM_NAME='Snipe-IT'
|
|
MAIL_REPLYTO_ADDR=you@example.com
|
|
MAIL_REPLYTO_NAME='Snipe-IT'
|
|
MAIL_AUTO_EMBED_METHOD='attachment'
|
|
MAIL_TLS_VERIFY_PEER=true
|
|
|
|
# MAIL_ENCRYPTION is no longer supported. SymfonyMailer will use tls if it's
|
|
# advertised, and won't if it's not. If you want to use your mail server's IP but it's failing
|
|
# because of certificate errors, set MAIL_TLS_VERIFY_PEER-true
|
|
|
|
# --------------------------------------------
|
|
# REQUIRED: IMAGE LIBRARY
|
|
# This should be gd or imagick
|
|
# --------------------------------------------
|
|
IMAGE_LIB=gd
|
|
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: BACKUP SETTINGS
|
|
# --------------------------------------------
|
|
MAIL_BACKUP_NOTIFICATION_DRIVER=null
|
|
MAIL_BACKUP_NOTIFICATION_ADDRESS=null
|
|
BACKUP_ENV=true
|
|
ALLOW_BACKUP_DELETE=false
|
|
ALLOW_DATA_PURGE=false
|
|
ALL_BACKUP_KEEP_DAYS=7
|
|
DAILY_BACKUP_KEEP_DAYS=16
|
|
WEEKLY_BACKUP_KEEP_WEEKS=8
|
|
MONTHLY_BACKUP_KEEP_MONTHS=4
|
|
YEARLY_BACKUP_KEEP_YEARS=2
|
|
BACKUP_PURGE_OLDEST_AT_MEGS=5000
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: SESSION SETTINGS
|
|
# --------------------------------------------
|
|
SESSION_DRIVER=file
|
|
SESSION_LIFETIME=12000
|
|
EXPIRE_ON_CLOSE=false
|
|
ENCRYPT=false
|
|
COOKIE_NAME=snipeit_session
|
|
PASSPORT_COOKIE_NAME='snipeit_passport_token'
|
|
COOKIE_DOMAIN=null
|
|
SECURE_COOKIES=false
|
|
API_TOKEN_EXPIRATION_YEARS=15
|
|
BS_TABLE_STORAGE=localStorage
|
|
BS_TABLE_DEEPLINK=true
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: SECURITY HEADER SETTINGS
|
|
# --------------------------------------------
|
|
APP_TRUSTED_PROXIES=192.168.1.1,10.0.0.1
|
|
ALLOW_IFRAMING=false
|
|
REFERRER_POLICY=same-origin
|
|
ENABLE_CSP=false
|
|
ADDITIONAL_CSP_URLS=null
|
|
CORS_ALLOWED_ORIGINS=null
|
|
ENABLE_HSTS=false
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: CACHE SETTINGS
|
|
# --------------------------------------------
|
|
CACHE_DRIVER=file
|
|
QUEUE_DRIVER=sync
|
|
CACHE_PREFIX=snipeit
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: REDIS SETTINGS
|
|
# --------------------------------------------
|
|
REDIS_HOST=null
|
|
REDIS_PASSWORD=null
|
|
REDIS_PORT=null
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: MEMCACHED SETTINGS
|
|
# --------------------------------------------
|
|
MEMCACHED_HOST=null
|
|
MEMCACHED_PORT=null
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: S3 PROXY
|
|
# When enabled, public uploads (images, logos, avatars) are served through
|
|
# the application instead of directly from S3. This allows using a single
|
|
# fully private S3 bucket for all storage.
|
|
# --------------------------------------------
|
|
PUBLIC_S3_PROXY=false
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: PUBLIC S3 Settings
|
|
# --------------------------------------------
|
|
PUBLIC_AWS_SECRET_ACCESS_KEY=null
|
|
PUBLIC_AWS_ACCESS_KEY_ID=null
|
|
PUBLIC_AWS_DEFAULT_REGION=null
|
|
PUBLIC_AWS_BUCKET=null
|
|
PUBLIC_AWS_URL=null
|
|
PUBLIC_AWS_ENDPOINT=null
|
|
PUBLIC_AWS_PATH_STYLE=null
|
|
PUBLIC_AWS_BUCKET_ROOT=null
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: PRIVATE S3 Settings
|
|
# --------------------------------------------
|
|
PRIVATE_AWS_ACCESS_KEY_ID=null
|
|
PRIVATE_AWS_SECRET_ACCESS_KEY=null
|
|
PRIVATE_AWS_DEFAULT_REGION=null
|
|
PRIVATE_AWS_BUCKET=null
|
|
PRIVATE_AWS_URL=null
|
|
PRIVATE_AWS_ENDPOINT=null
|
|
PRIVATE_AWS_PATH_STYLE=null
|
|
PRIVATE_AWS_BUCKET_ROOT=null
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: AWS Settings
|
|
# --------------------------------------------
|
|
AWS_ACCESS_KEY_ID=null
|
|
AWS_SECRET_ACCESS_KEY=null
|
|
AWS_DEFAULT_REGION=null
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: LOGIN THROTTLING
|
|
# --------------------------------------------
|
|
LOGIN_MAX_ATTEMPTS=5
|
|
LOGIN_LOCKOUT_DURATION=60
|
|
LOGIN_AUTOCOMPLETE=false
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: FORGOTTEN PASSWORD SETTINGS
|
|
# --------------------------------------------
|
|
RESET_PASSWORD_LINK_EXPIRES=15
|
|
PASSWORD_CONFIRM_TIMEOUT=10800
|
|
PASSWORD_RESET_MAX_ATTEMPTS_PER_MIN=50
|
|
INVITE_PASSWORD_LINK_EXPIRES=1500
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: MISC
|
|
# --------------------------------------------
|
|
LOG_CHANNEL=single
|
|
LOG_DEPRECATIONS=false
|
|
LOG_MAX_DAYS=10
|
|
APP_LOCKED=false
|
|
APP_CIPHER=AES-256-CBC
|
|
APP_FORCE_TLS=false
|
|
APP_ALLOW_INSECURE_HOSTS=false
|
|
GOOGLE_MAPS_API=
|
|
LDAP_MEM_LIM=500M
|
|
LDAP_TIME_LIM=600
|
|
BACKUP_TIME_LIMIT=600
|
|
IMPORT_TIME_LIMIT=600
|
|
IMPORT_MEMORY_LIMIT=500M
|
|
REPORT_TIME_LIMIT=12000
|
|
API_THROTTLE_PER_MINUTE=120
|
|
CSV_ESCAPE_FORMULAS=true
|
|
LIVEWIRE_URL_PREFIX=null
|
|
MAX_UNPAGINATED=5000
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: SAML SETTINGS
|
|
# --------------------------------------------
|
|
REQUIRE_SAML=false
|
|
SAML_KEY_SIZE=2048
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: HASHING
|
|
# --------------------------------------------
|
|
HASHING_DRIVER='bcrypt'
|
|
BCRYPT_ROUNDS=10
|
|
ARGON_MEMORY=1024
|
|
ARGON_THREADS=2
|
|
ARGON_TIME=2
|
|
|
|
# --------------------------------------------
|
|
# OPTIONAL: SCIM
|
|
# --------------------------------------------
|
|
SCIM_TRACE=false
|
|
SCIM_STANDARDS_COMPLIANCE=false
|