97 lines
3.9 KiB
Bash
97 lines
3.9 KiB
Bash
# Overlord Configuration (Optional Overrides)
|
|
#
|
|
# Most users don't need to create a .env file!
|
|
# The docker-compose.yml has sensible defaults.
|
|
#
|
|
# On first startup, secrets are auto-generated and persisted in ./data/save.json
|
|
# when not explicitly provided.
|
|
#
|
|
# Only create .env if you want to customize:
|
|
|
|
# ============================================
|
|
# PRODUCTION: Use pre-built image
|
|
# ============================================
|
|
# Set this to pull from registry instead of building locally
|
|
# DOCKER_IMAGE=ghcr.io/yourusername/overlord-server:latest
|
|
|
|
# ============================================
|
|
# OPTIONAL: Custom initial admin username
|
|
# ============================================
|
|
# Default is "admin" - change if you prefer a different username
|
|
# OVERLORD_USER=myadmin
|
|
|
|
# OPTIONAL: Custom initial admin password
|
|
# Default is "admin"
|
|
# OVERLORD_PASS=admin
|
|
|
|
# ============================================
|
|
# OPTIONAL: Custom port
|
|
# ============================================
|
|
# Default is 5173
|
|
# PORT=8080
|
|
|
|
# ============================================
|
|
# ADVANCED: Custom JWT secret
|
|
# ============================================
|
|
# Leave empty to auto-generate and persist to save.json (recommended)
|
|
# JWT_SECRET=
|
|
|
|
# OPTIONAL: Agent authentication token
|
|
# Leave empty to auto-generate and persist to save.json
|
|
# OVERLORD_AGENT_TOKEN=
|
|
|
|
# ============================================
|
|
# OPTIONAL: OIDC / SSO login
|
|
# ============================================
|
|
# Generic OIDC works with providers such as Authentik, Authelia, Keycloak, Zitadel, and Dex.
|
|
# Configure your provider callback/redirect URI as:
|
|
# https://YOUR_OVERLORD_HOST/api/oidc/callback
|
|
# Keep local username/password login enabled as a fallback.
|
|
# OVERLORD_OIDC_ENABLED=true
|
|
# OVERLORD_OIDC_LABEL=Sign in with SSO
|
|
# OVERLORD_OIDC_ISSUER=https://auth.example.com/application/o/overlord/
|
|
# OVERLORD_OIDC_CLIENT_ID=overlord
|
|
# OVERLORD_OIDC_CLIENT_SECRET=change-me
|
|
# OVERLORD_OIDC_REDIRECT_URI=https://overlord.example.com/api/oidc/callback
|
|
# OVERLORD_OIDC_DEFAULT_ROLE=viewer
|
|
# OVERLORD_OIDC_ALLOWED_DOMAINS=example.com
|
|
# OVERLORD_OIDC_ADMIN_GROUPS=overlord-admins
|
|
# OVERLORD_OIDC_OPERATOR_GROUPS=overlord-operators
|
|
# OVERLORD_OIDC_VIEWER_GROUPS=overlord-viewers
|
|
|
|
# ============================================
|
|
# OPTIONAL: Login screen branding
|
|
# ============================================
|
|
# Use a logo URL, or leave it empty and set a Font Awesome icon class.
|
|
# Logo URLs may be absolute http(s) URLs or root-relative paths such as /assets/logo.png.
|
|
# OVERLORD_LOGIN_BRAND_NAME=Acme SOC
|
|
# OVERLORD_LOGIN_TITLE=Welcome to Acme Overlord
|
|
# OVERLORD_LOGIN_SUBTITLE=Sign in with your Acme identity
|
|
# OVERLORD_LOGIN_LOGO_URL=/assets/acme-logo.png
|
|
# OVERLORD_LOGIN_LOGO_ALT=Acme logo
|
|
# OVERLORD_LOGIN_ICON_CLASS=fa-solid fa-shield-halved
|
|
|
|
# ============================================
|
|
# ADVANCED: Custom TLS certificates
|
|
# ============================================
|
|
# Leave as defaults to use auto-generated self-signed certs
|
|
# OVERLORD_TLS_CERT=/custom/path/server.crt
|
|
# OVERLORD_TLS_KEY=/custom/path/server.key
|
|
|
|
# ============================================
|
|
# ADVANCED: Reverse proxy / domain deployments
|
|
# ============================================
|
|
# If Overlord sits behind a reverse proxy (nginx, Caddy, Cloudflare, Traefik, Render,
|
|
# etc.), the server otherwise sees the proxy's IP for every agent connection — the
|
|
# dashboard, audit log, and IP bans all end up showing the proxy/Docker bridge IP
|
|
# (commonly 172.x.x.x) instead of the real client. Set this to true ONLY when a
|
|
# trusted reverse proxy is in front of Overlord; otherwise agents could spoof
|
|
# their IP by sending their own X-Forwarded-For header. Auto-enabled when
|
|
# OVERLORD_TLS_OFFLOAD=true. Honors X-Forwarded-For, X-Real-IP, CF-Connecting-IP.
|
|
# OVERLORD_TRUST_PROXY=true
|
|
|
|
# Agent builder settings (only needed if building agents)
|
|
# TARGETS=windows/amd64,windows/386,windows/arm64,linux/amd64,linux/arm64,linux/arm/v7,darwin/amd64,darwin/arm64
|
|
# GO_BUILD_FLAGS=-trimpath
|
|
# LDFLAGS=-s -w
|