{{ message }}
Repository navigation
Expand file tree
/
Copy pathexample.env
More file actions
207 lines (189 loc) · 8.65 KB
/
Copy pathexample.env
File metadata and controls
207 lines (189 loc) · 8.65 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
###
### Base configuration defaults
###
BACKUP_PATH=${BACKUP_PATH:-./backup}
CONFIG_PATH=${CONFIG_PATH:-./config}
DATA_PATH=${DATA_PATH:-./data}
# Docker image tag for prebuilt images from GHCR
# Use 'latest' for development, or a specific git SHA/tag for production
# Example: IMAGE_TAG=abc1234 or IMAGE_TAG=v1.2.3
IMAGE_TAG=${IMAGE_TAG:-latest}
# Root domain for services. E.g. homy.local
DOMAIN=${DOMAIN-local}
LOCAL_SUBNET=${LOCAL_SUBNET:-172.1.1.0/24}
PUID=${PUID:-1000}
PGID=${PGID:-1000}
SECRETS_PATH=${SECRETS_PATH:-./secrets}
TZ=${TZ:-Europe/Sofia}
###
### VPN conviguration
###
VPN_CONFIG_PATH=${CONFIG_PATH}/wireguard
VPN_DATA_PATH=./data/wireguard
VPN_TEMPLATE_PEER_FILE=${VPN_CONFIG_PATH}/templates/peer.conf
VPN_TEMPLATE_SERVER_FILE=${VPN_CONFIG_PATH}/templates/server.conf
# Publicly accessible address to the vpn
VPN_PUBLIC_URL=vpn.${DOMAIN}
# Publicly accessible port of the vpn
VPN_PUBLIC_PORT=51820
# Number of vpn peers or comma-separated list of peer names to generate configuration for
# configuration is available in data/wireguard/peer_${peer-name} after first run
VPN_PEERS=node1,node2
# Subnet for the vpn - change if it clashes with something
VPN_SUBNET=10.13.13.0
###
### Ingress configuration
###
INGRESS_DATA_PATH=./data/ingress
INGRESSGEN_TEMPLATE_NGINX_FILE=${CONFIG_PATH}/ingressgen/templates/nginx.tmpl
# Subnet for the *dmz* network - nginx <-> vpn/broker - and, separately, the
# range VPN clients route over the tunnel (the vpn service's ALLOWEDIPS).
# Despite the name this is NOT the `ingress` network; see PROXY_BACKEND_SUBNET.
# Change if it clashes with something.
INGRESS_SUBNET=10.28.28.0/24
# nginx's address on the dmz network - must be inside INGRESS_SUBNET
INGRESS_ADDRESS=10.28.28.11
# Subnet for the `ingress` network - nginx <-> the services it proxies
# (ha, grafana, z2m, mongo-express). Pinned so Docker cannot renumber it: HA
# checks the proxy's address against trusted_proxies and answers 400 to every
# request if it does not match (#1555). Change if it clashes with something.
# All three PROXY_BACKEND_* vars are REQUIRED - compose aborts without them,
# deliberately, because an empty value here fails silently and recreates #1555.
PROXY_BACKEND_SUBNET=10.28.29.0/24
# Range Docker may hand out dynamically. Must be inside PROXY_BACKEND_SUBNET and
# must NOT contain PROXY_BACKEND_ADDRESS, so nginx's fixed address can never be
# given to another container first.
PROXY_BACKEND_DYNAMIC_RANGE=10.28.29.128/25
# nginx's address on the ingress network - must be inside PROXY_BACKEND_SUBNET
# and outside PROXY_BACKEND_DYNAMIC_RANGE. This is the single source for HA's
# TRUSTED_PROXIES, so the two cannot drift.
PROXY_BACKEND_ADDRESS=10.28.29.11
# Container name for the ingress - must be unique across the docker host
INGRESS_NAME=ingress
# Optional: domain suffix for short host names. With it set, a request for
# "grafana" is redirected (301) to "grafana.<suffix>". Leave empty to turn off.
INGRESS_SHORT_HOST_SUFFIX=homy.example.com
###
### Power configuration
###
POWER_CONFIG_PATH=${CONFIG_PATH}/modbus-serial
MAIN_POWER_CONFIG_FILE=${POWER_CONFIG_PATH}/main.config.js
SECONDARY_POWER_CONFIG_FILE=${POWER_CONFIG_PATH}/secondary.config.js
TETRIARY_POWER_CONFIG_FILE=${POWER_CONFIG_PATH}/tetriary.config.js
###
### Grafana configuration
###
GRAFANA_CONFIG_PATH=${CONFIG_PATH}/grafana
GRAFANA_CONFIG_FILE=${GRAFANA_CONFIG_PATH}/config.ini
GRAFANA_CONFIG_DATASOURCE_INFLUXDB_FILE=${GRAFANA_CONFIG_PATH}/datasources/influxdb.yaml
GRAFANA_DATA_PATH=${DATA_PATH}/grafana
###
### Home assistant configuration
###
HOMEASSISTANT_CONFIG=${CONFIG_PATH}/home-assistant
HOMEASSISTANT_CONFIG_CONFIGURATION_FILE=${HOMEASSISTANT_CONFIG}/configuration.yaml
HOMEASSISTANT_CONFIG_AUTOMATIONS_FILE=${HOMEASSISTANT_CONFIG}/configuration/automations.yaml
HOMEASSISTANT_CONFIG_CUSTOMIZE_FILE=${HOMEASSISTANT_CONFIG}/configuration/customize.yaml
HOMEASSISTANT_CONFIG_GROUPS_FILE=${HOMEASSISTANT_CONFIG}/configuration/groups.yaml
HOMEASSISTANT_CONFIG_SCENES_FILE=${HOMEASSISTANT_CONFIG}/configuration/scenes.yaml
HOMEASSISTANT_CONFIG_SCRIPTS_FILE=${HOMEASSISTANT_CONFIG}/configuration/scripts.yaml
HOMEASSISTANT_DOMAIN=ha.${DOMAIN}
HOMEASSISTANT_DATA_PATH=./data/home-assistant
###
### Influx configuration
###
INFLUXDB_CONFIG_FILE=${CONFIG_PATH}/influxdb/influxdb.conf
INFLUXDB_DATABASE=homy
INFLUXDB_SECRET_ADMIN_USER_FILE=${SECRETS_PATH}/influxdb_admin_user
INFLUXDB_SECRET_ADMIN_PASSWORD_FILE=${SECRETS_PATH}/influxdb_admin_password
INFLUXDB_SECRET_USER_FILE=${SECRETS_PATH}/influxdb_user
INFLUXDB_SECRET_USER_PASSWORD_FILE=${SECRETS_PATH}/influxdb_user_password
INFLUXDB_SECRET_READ_USER_FILE=${SECRETS_PATH}/influxdb_read_user
INFLUXDB_SECRET_READ_USER_PASSWORD_FILE=${SECRETS_PATH}/influxdb_read_user_password
INFLUXDB_SECRET_WRITE_USER_FILE=${SECRETS_PATH}/influxdb_write_user
INFLUXDB_SECRET_WRITE_USER_PASSWORD_FILE=${SECRETS_PATH}/influxdb_write_user_password
###
### Mongo configuration
###
# Data lives in ${DATA_PATH}/mongodb/{db,configdb}, owned by 999:999
MONGO_DATABASE=power
MONGO_SECRET_ROOT_PASSWORD_FILE=${SECRETS_PATH}/mongo_root_password
MONGO_SECRET_ROOT_USERNAME_FILE=${SECRETS_PATH}/mongo_root_username
###
### Raw readings (daily NDJSON files, issue #1622)
###
# Every modbus-serial service, every ya-modbus adapter and mqtt-ndjson-ioniq
# append raw readings to
# ${RAW_DATA_PATH}/<stream>/YYYY-MM-DD.<service>.ndjson (UTC days).
# Keep it a plain subdirectory of DATA_PATH, on the same ZFS dataset, not a
# dataset of its own: snapshot.sh stops every deploy when the data is on more
# than one dataset (see docs/DEPLOYMENT.md, "Where state lives").
# Create the directory before the first start and make it owned by 1000:1000,
# the uid both images run as; if docker creates it, it is owned by root and
# the writers refuse to start. About 770 MB of JSON per day in total
# (2026-09-28). Only the host-side archive job compresses or deletes finished
# days.
RAW_DATA_PATH=${DATA_PATH}/raw
###
### Mongo express configuration
###
MONGO_EXPRESS_DOMAIN=me.${DOMAIN}
MONGO_EXPRESS_SECRET_PASSWORD_FILE=${SECRETS_PATH}/mongo_express_password
MONGO_EXPRESS_SECRET_USERNAME_FILE=${SECRETS_PATH}/mongo_express_username
###
### Zigbee2MQTT configuration
###
# Zigbee2MQTT home1 instance - First floor Zigbee network
# Web UI URL for accessing Zigbee device management interface
Z2M_HOME1_DOMAIN=home1.z2m.${DOMAIN}
# Data directory for device database and logs (must be writable by PUID:PGID)
Z2M_HOME1_DATA_PATH=./data/zigbee2mqtt/home1
# Required secrets (create files in secrets/ directory):
# - z2m_home1_network_key: 16-byte array like [1,3,5,7,9,11,13,15,0,2,4,6,8,10,12,14]
# Generate: node -e "console.log(JSON.stringify(Array.from({length: 16}, () => Math.floor(Math.random() * 256))))"
# - z2m_home1_serial_port: tcp://192.168.1.100:6638 (network coordinator) or /dev/serial/by-id/usb-... (USB)
# - z2m_home1_adapter: zstack, deconz, ezsp, ember, or auto
# - z2m_home1_frontend_auth_token: Random token for web UI authentication
# Generate: openssl rand -base64 32
INFLUXDB_ADMIN_PASSWORD=secret
INFLUXDB_USER_PASSWORD=secret
INFLUXDB_READ_USER_PASSWORD=secret
INFLUXDB_WRITE_USER_PASSWORD=secret
###
### Sunseeker Lawn Mower configuration
###
# Device ID for the Sunseeker lawn mower
SUNSEEKER_DEVICE_ID=example-device-123456789
# App ID for MQTT communication
SUNSEEKER_APP_ID=example-app-987654321
###
### Outdoor weather (Open-Meteo)
###
# House location, rounded to 2 decimals. Used by the weather service and by
# the sunset/sunrise lights in automations.
# Private: set it only in the real .env, never in a tracked file.
WEATHER_LATITUDE=0.00
WEATHER_LONGITUDE=0.00
###
### Thermostat season guard (#1739)
###
# Checks the guard skips for a room, as room:check pairs separated by commas.
# The room is the last part of its thermostat topic. Checks: valveOpenLong,
# lowCoolingTargetTemp, coolingInColdNights. Empty: no exceptions.
# Example: THERMOSTAT_GUARD_SKIP=thermostat-example:coolingInColdNights
# Private: set it only in the real .env, never in a tracked file.
THERMOSTAT_GUARD_SKIP=
###
### Monthly energy report (#1757, docker/energy-report/CLAUDE.md)
###
# The first month of the current prices in config/home-assistant/energy.json.
# Months before it get no cost: they had other prices, in BGN. Change it every
# July together with the prices (docs/energy-dashboard.md). Empty: 2026-07.
ENERGY_REPORT_PRICES_FROM=2026-07
# Optional: a full link to the "Energy by month" dashboard for the Telegram
# message. Set it only in the real .env, and only to an address that opens on
# a phone away from home. Empty: the message names the dashboard, no link.
ENERGY_REPORT_DASHBOARD_URL=
# The first month of the report. It cannot be before 2023-11, the first full
# month after the main meter was swapped. Empty: 2023-11.
ENERGY_REPORT_FIRST_MONTH=2023-11
You can’t perform that action at this time.