66 lines
2.4 KiB
Bash
66 lines
2.4 KiB
Bash
# Production mode has no built-in credentials. This password bootstraps the
|
|
# first administrator and remains the authoritative admin password on restart.
|
|
RMM_INSECURE_DEV_MODE=false
|
|
RMM_OPERATOR_USERNAME=admin
|
|
RMM_OPERATOR_PASSWORD=replace-with-a-long-random-password
|
|
|
|
# Production release images. Pin an exact server version after the first
|
|
# server-v* release; do not rely on latest for controlled upgrades.
|
|
RMM_RELEASE_VERSION=latest
|
|
RMM_SERVER_IMAGE=ghcr.io/benya9669/openwrt-rmm-server
|
|
RMM_TUNNEL_IMAGE=ghcr.io/benya9669/openwrt-rmm-tunnel
|
|
RMM_IMAGE_PULL_POLICY=always
|
|
|
|
# Optional emergency/API bearer token. Leave empty when browser sessions are enough.
|
|
RMM_OPERATOR_TOKEN=
|
|
|
|
# Shared enrollment is disabled by default. Users create one-time grants in the UI.
|
|
RMM_ALLOW_LEGACY_ENROLLMENT=false
|
|
RMM_ENROLLMENT_TOKEN=
|
|
RMM_ALLOW_LEGACY_LUCI_PROXY=false
|
|
|
|
# Set true when the UI is served through an HTTPS reverse proxy.
|
|
RMM_COOKIE_SECURE=true
|
|
RMM_PUBLIC_SCHEME=https
|
|
RMM_PUBLIC_URL=https://rmm.example.com
|
|
RMM_METRIC_RETENTION_DAYS=30
|
|
RMM_NOTIFICATION_RETENTION_DAYS=90
|
|
RMM_NOTIFICATION_MAX_ATTEMPTS=5
|
|
|
|
# Optional password recovery and alert notifications. Leave RMM_SMTP_HOST empty to disable e-mail.
|
|
# Use starttls for port 587 or tls for implicit TLS on port 465.
|
|
RMM_SMTP_HOST=
|
|
RMM_SMTP_PORT=587
|
|
RMM_SMTP_USERNAME=
|
|
RMM_SMTP_PASSWORD=
|
|
RMM_SMTP_FROM=OpenWrt RMM <rmm@example.com>
|
|
RMM_SMTP_TLS_MODE=starttls
|
|
RMM_SMTP_SERVER_NAME=
|
|
|
|
# Optional Telegram alert notifications. Users set only their numeric Chat ID in the UI.
|
|
# Keep the bot token in the deployment environment; never commit the real value.
|
|
RMM_TELEGRAM_BOT_TOKEN=
|
|
|
|
RMM_HTTP_BIND_IP=127.0.0.1
|
|
RMM_HTTP_PORT=18080
|
|
|
|
# The router connects to this port. Ports 22000-22099 are operator endpoints.
|
|
RMM_TUNNEL_BIND_IP=0.0.0.0
|
|
RMM_TUNNEL_SSH_PORT=2222
|
|
# Public address reached by routers. When empty, the host from RMM_PUBLIC_URL is used.
|
|
RMM_TUNNEL_PUBLIC_HOST=
|
|
RMM_TUNNEL_PUBLIC_PORT=2222
|
|
RMM_TUNNEL_OPERATOR_BIND_IP=127.0.0.1
|
|
RMM_TUNNEL_KEY_PATH=./secrets/router_tunnel_key.pub
|
|
|
|
# Optional HTTPS reverse proxy overlay.
|
|
RMM_DOMAIN=rmm.example.com
|
|
RMM_DEVICE_DOMAIN=routers.example.com
|
|
RMM_PROXY_HTTP_PORT=80
|
|
RMM_PROXY_HTTPS_PORT=443
|
|
|
|
# Required only with compose.keendns.yaml. The certificate must cover
|
|
# *.routers.example.com and the private key must not be committed.
|
|
RMM_WILDCARD_CERT_PATH=./secrets/routers-wildcard.crt
|
|
RMM_WILDCARD_KEY_PATH=./secrets/routers-wildcard.key
|