Files
downloadwf/.env.example
T
2026-08-25 12:57:54 +02:00

48 lines
1.9 KiB
Bash

# Network
HOST=0.0.0.0
PORT=3000
# Public base URL of the site (the domain your users see, including scheme,
# WITHOUT a trailing slash). When set, share links returned by the API and the
# dashboard are absolute URLs (e.g. https://files.example.com/xmK5lLMRErlN).
# Leave unset to keep relative paths (the browser host is used).
PUBLIC_BASE_URL=https://files.example.com
# Storage: persistent filesystem directory where uploaded files and
# metadata live. Files survive restarts.
STORAGE_DIR=./storage
# Maximum upload size. Accepts plain bytes or units (B, KB, MB, GB, TB,
# case-insensitive). A request larger than this is rejected with 413.
MAX_FILE_SIZE=10GB
# Maximum fraction of the storage filesystem that may be used, from 0.0 to 1.0.
# When usage exceeds this ratio uploads are rejected with 503 "try again later".
# Default 0.5 = block uploads once more than 50% of the disk is used.
MAX_STORAGE_USAGE=0.5
# How long an uploaded file lives before it expires and is deleted.
# In milliseconds. Default and hard maximum is 48 hours (172800000).
FILE_TTL_MS=172800000
# Length in characters of the upload/download key token (a-z0-9).
# Default 8. Longer keys are harder to brute-force.
KEY_LENGTH=8
# Brute-force protection: rate limit per client IP on download and
# deletion endpoints. Set RATE_LIMIT_ENABLED=0 to disable.
RATE_LIMIT_ENABLED=1
RATE_LIMIT_MAX=300
RATE_LIMIT_WINDOW_MS=60000
# Set to 1 ONLY when running behind a reverse proxy that sets or
# overwrites X-Forwarded-For (e.g. nginx: proxy_set_header
# X-Forwarded-For $proxy_add_x_forwarded_for). Never enable this when
# clients can reach the server directly - they could spoof the header.
TRUST_PROXY=0
# Strip embedded metadata (EXIF/GPS/author/comments, video moov/udta, EBML
# Tags, etc.) from uploaded images and videos on the server. Best-effort:
# unrecognized or unparseable formats are stored untouched. Set 0 to disable.
STRIP_METADATA=1