Moving environment variables to a .env file

[misraaks]

Per the Contributing note in the README, I wanted to check if a PR moving most of the compose environment/configuration variables to a .env file would be welcome, or if it is an intentional design choice to keep them in the compose.yaml? I have already done this in my own deployments using the below .env.example and find it easier to see what I need to edit. This also requires editing compose.yaml to remove the environment section of each service and adding env_file: .env instead.

# =============================================================================
# NPMplus Environment Variables Template
# =============================================================================
# Instructions:
# 1. Copy this file to .env: `cp .env.example .env`
# 2. Modify mandatory values in Section 1.
# 3. Uncomment (#) and modify optional values in other sections as needed.
# =============================================================================

###############################################################################
# SECTION 1: ESSENTIAL SETTINGS
# These settings are required for basic functionality.
###############################################################################

# Root path for all persistent data (logs, certs, DB)
# This path is used by docker-compose to bind volumes.
HOST_BIND_PATH=/opt

# Your timezone (required for logs and expiration checks)
# Values from "TZ identifier": https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
TZ=your-timezone

# Email address used for ACME (SSL) registration.
# Required for ZeroSSL and Google Public CA, highly recommended for Let's Encrypt.
ACME_EMAIL=your-email


###############################################################################
# SECTION 2: SYSTEM & USER PERMISSIONS
# Configure which user the process runs as and system-level settings.
###############################################################################

# User and Group ID (PUID/PGID)
# Needs to be a number >= 99 or 0. Default: 0 (root).
# If changing PUID/PGID, you might need: sysctl net.ipv4.ip_unprivileged_port_start=0
# PUID=1000
# PGID=1000

# Enables usage of gravatar images for user profiles.
# DISABLE_GRAVATAR=false

# Runs custom script before NPM starts (see README for details).
# ENABLE_PRERUN=false


###############################################################################
# SECTION 3: NETWORK & PORT BINDINGS
# Customize ports and IP addresses the services listen on.
###############################################################################

# Main Traffic Ports
# Changing these may break certbot HTTP challenge if not handled upstream.
# HTTP_PORT=80
# HTTPS_PORT=443

# NPM Admin UI Port (Default: 81)
# NPM_PORT=81

# GoAccess Statistics Port (Default: 91)
# GOA_PORT=91

# Traffic Control
# DISABLE_HTTP=false        # Prevents Nginx from listening on port 80
# DISABLE_IPV6=false        # Fully disables IPv6 listening and resolver

# IP Bindings (Defaults to all interfaces)
# IPV4_BINDING=0.0.0.0
# IPV6_BINDING=[::]
# NPM_IPV4_BINDING=0.0.0.0
# NPM_IPV6_BINDING=[::]
# GOA_IPV4_BINDING=0.0.0.0
# GOA_IPV6_BINDING=[::]

# Quick Localhost Bindings (Overrides specific IP bindings above)
# NPM_LISTEN_LOCALHOST=true
# GOA_LISTEN_LOCALHOST=true


###############################################################################
# SECTION 4: CERTIFICATE AUTHORITY (ACME) - ADVANCED
# Configure how SSL certificates are requested and renewed via Certbot.
###############################################################################

# ACME Server URL
# Default: https://acme-v02.api.letsencrypt.org/directory (Let's Encrypt)
# Google Public CA: https://dv.acme-v02.api.pki.goog/directory
# ZeroSSL: https://acme.zerossl.com/v2/DV90
# ACME_SERVER=https://acme-v02.api.letsencrypt.org/directory

# External Account Binding (EAB)
# Required for Google Public CA, optional for ZeroSSL, unsupported by Let's Encrypt.
# ACME_EAB_KID=123456789abcdef
# ACME_EAB_HMAC_KEY=123456789abcdef

# Certificate Profile (CA-specific)
# Let's Encrypt supports: "shortlived" (default: "shortlived" for LE, else "none")
# ACME_PROFILE=shortlived

# SSL Protocol Optimizations
# ACME_MUST_STAPLE=false      # Enable OCSP Must-Staple (Unsupported by Let's Encrypt)
# ACME_OCSP_STAPLING=false    # Enable OCSP Stapling (True by default for Google/ZeroSSL)
# ACME_KEY_TYPE=ecdsa         # Key type: ecdsa or rsa (Default: ecdsa)
# CUSTOM_OCSP_STAPLING=false  # Enable OCSP Stapling for custom certificates

# ACME Security
# ACME_SERVER_TLS_VERIFY=true # Verify ACME server TLS certificate

# Renewal Check Frequency
# Hours between certbot renewal attempts (Default: 6)
# CRT=6

# Default Certificate
# ID of cert to use instead of dummycerts (0 = dummycerts)
# DEFAULT_CERT_ID=0


###############################################################################
# SECTION 5: NGINX PERFORMANCE & SECURITY
# Fine-tune the underlying Nginx web server.
###############################################################################

# Worker Processes (Default and recommended: auto)
# NGINX_WORKER_PROCESSES=auto

# Logging Options
# NGINX_LOG_NOT_FOUND=false   # Log 404 errors to Docker logs

# SSL/TLS Hardening
# NGINX_FORCE_X25519MLKEM768=false # Force post-quantum key exchange (Disables TLS 1.2)
# NGINX_DISABLE_TLS12=false       # Disable TLS 1.2 (Require TLS 1.3)
# NGINX_TRUST_SECPR1=false        # Enable older NIST curves (For compatibility with some iOS clients)

# HTTP/3 & QUIC
# DISABLE_H3_QUIC=false           # Fully disable HTTP/3 and QUIC
# NGINX_QUIC_BPF=false            # Enable QUIC BPF (requires cap_add: [BPF, PERFMON, NET_ADMIN])

# Advanced Headers & Proxy
# LISTEN_PROXY_PROTOCOL=false     # Use PROXY protocol for listeners
# X_FRAME_OPTIONS=sameorigin      # Default X-Frame-Options (deny, sameorigin, none)

# UI/Config Optimizations
# DISABLE_NGINX_BEAUTIFIER=false  # Disables nginxbeautifier for custom configs


###############################################################################
# SECTION 6: LOGGING & ANALYTICS (GOACCESS)
# Configure log rotation and the GoAccess statistics dashboard.
###############################################################################

# Log Rotation
# LOGROTATE=false                 # Enable access log rotation (Daily)
# LOGROTATIONS=3                  # Number of rotated logs to keep

# GoAccess Dashboard
# GOA=false                       # Enable GoAccess (Overrides LOGROTATE=true)
# GOACLA=--agent-list --real-os --double-decode --anonymize-ip --anonymize-level=1 --keep-last=30 --with-output-resolver --no-query-string

# IP Whitelisting
# SKIP_IP_RANGES=true             # Skip fetching/whitelisting IP ranges from Cloudflare


###############################################################################
# SECTION 7: PHP INTEGRATION (OPTIONAL)
# Enable built-in PHP support. Dedicated PHP-FPM containers are recommended instead.
###############################################################################

# PHP 8.3
# PHP83=false
# PHP83_APKS=php83-curl php83-openssl

# PHP 8.4
# PHP84=false
# PHP84_APKS=php84-curl php84-openssl

# PHP 8.5
# PHP85=false
# PHP85_APKS=php85-curl php85-openssl

# General PHP Packages (Applied if any PHP version is enabled)
# PHP_APKS=php-pecl-apcu php-pecl-redis


###############################################################################
# SECTION 8: INITIAL SETUP (FIRST BOOT ONLY)
# These values apply only during the very first run of NPMplus.
###############################################################################

# INITIAL_ADMIN_EMAIL=admin@example.org
# INITIAL_ADMIN_PASSWORD=             # Defaults to a random password logged on start
# INITIAL_DEFAULT_PAGE=congratulations # Options: 404, 444, redirect, congratulations, html


###############################################################################
# SECTION 9: AUTHENTICATION (OIDC)
# Configure OpenID Connect for Single Sign-On.
# Redirect URL will be: https://$OIDC_REDIRECT_DOMAIN/api/oidc/callback
###############################################################################

# OIDC_REDIRECT_DOMAIN=<domain-ip>[:<port>]
# OIDC_ISSUER_URL=https://...
# OIDC_CLIENT_ID=...
# OIDC_CLIENT_SECRET=...
# OIDC_REQUIRE_VERIFIED_EMAIL=true
# OIDC_DISABLE_PASSWORD=false     # Disables plain email/password login

# Node.js Security (Affects backend requests like OIDC/GitHub)
# NODE_TLS_REJECT_UNAUTHORIZED=1  # Set to 0 to disable TLS verification (not recommended)


###############################################################################
# SECTION 10: OPTIONAL NGINX MODULES
# These modules require manual configuration after being loaded.
###############################################################################

# NGINX_LOAD_OPENAPPSEC_ATTACHMENT_MODULE=false # Requires ipc:host and shm-volume. Disables zstd.
# NGINX_LOAD_NJS_MODULE=false
# NGINX_LOAD_GEOIP_MODULE=false
# NGINX_LOAD_GEOIP2_MODULE=false
# NGINX_LOAD_LDAP_MODULE=false
# NGINX_LOAD_NTLM_MODULE=false
# NGINX_LOAD_VHOST_TRAFFIC_STATUS_MODULE=false


###############################################################################
# SECTION 11: EXTERNAL SERVICE INTEGRATIONS
# Configuration for 3rd party security and data services.
###############################################################################

# --- Crowdsec ---
# USE_WAL=true
# COLLECTIONS=ZoeyVid/npmplus

# --- Anubis ---
# TARGET=                         # IMPORTANT: must be a space if used
# POLICY_FNAME=/etc/botPolicies.yaml

# --- GeoIP Update (MaxMind) ---
# GEOIPUPDATE_EDITION_IDS=GeoLite2-Country GeoLite2-City GeoLite2-ASN
# GEOIPUPDATE_ACCOUNT_ID=<your-account-id>
# GEOIPUPDATE_LICENSE_KEY=<your-license-key>
# GEOIPUPDATE_FREQUENCY=24

# --- Openappsec ---
# autoPolicyLoad=true
# registered_server=NPMplus
# user_email=your-email           # For assistance/notifications
# AGENT_TOKEN=                    # For central Saas Management (https://my.openappsec.io)

# If NOT using AGENT_TOKEN, uncomment these:
# SHARED_STORAGE_HOST=openappsec-shared-storage
# LEARNING_HOST=openappsec-smartsync
# TUNING_HOST=openappsec-tuning-svc

# Database configuration for Openappsec
# QUERY_DB_PASSWORD=password      # Match POSTGRES_PASSWORD in openappsec-db
# QUERY_DB_USER=appsec
# QUERY_DB_HOST=openappsec-db
# POSTGRES_PASSWORD=password
# POSTGRES_USER=appsec

[Zoey2936]

it is wanted to have them in the compose.yaml since except for TZ no env is shared between containers, so it doesn't make sense to add envs to containers which don't use them, also .env files have no upside but the downside of now having two files