# arr-stack — deployment values, committed on purpose (repo convention, AGENTS.md §2)
#
# Why these live in git rather than in Portainer's stack environment list:
# Portainer clones the repository to a temp directory and runs `compose` with
# THE STACK DIRECTORY as the project directory, so this file IS the Compose
# .env. Keeping the values here is what makes a redeploy reproducible and stops
# the clone from disagreeing with the deployment. Leave the stack's Env list
# empty in Portainer; two sources of truth drift.
#
# Blast radius of each secret is described in README.md. Nothing here is
# machine-generated except by the *arr/RomM containers themselves, so a lost
# value is a lost credential, not a regenerable key.

# --- identity and paths ------------------------------------------------------
# /var/lib/config, not /home: node-02's /home is an 18 GB root filesystem.
FOLDER_FOR_CONFIGS=/var/lib/config
FOLDER_FOR_MEDIA=/mnt/jellyfin
TIMEZONE=Europe/Stockholm
PUID=1000
PGID=1000
UMASK=0002

# --- published ports ---------------------------------------------------------
# WEBUI_PORT_KAPOWARR was present in the Portainer stack and is deliberately
# dropped: no kapowarr service exists in this stack.
WEBUI_PORT_QBITTORRENT=8200
WEBUI_PORT_SABNZBD=8080
WEBUI_PORT_BAZARR=6767
WEBUI_PORT_PROWLARR=9696
WEBUI_PORT_RADARR=7878
WEBUI_PORT_SONARR=8989
QBIT_PORT_TCP=6881
QBIT_PORT_UDP=6881

# --- secrets -----------------------------------------------------------------
# Mullvad WireGuard key. Without it gluetun has no tunnel and every downloader
# on its netns is dead to the world by design. Issued by Mullvad: a replacement
# is generated in their portal, not here.
WIREGUARD_PRIVATE_KEY=eKm8Av1RayBxIy11zJ/DAn9hYuPzfKxT1DJTuiUti2A=

# Sonarr/Radarr API keys as configured inside those applications. They are not
# ours to rotate: they are read from Settings > General in each app, and
# unpackerr stops unpacking if they do not match.
UN_SONARR_0_API_KEY=6c68980aca4742a592da678a2371db7e
UN_RADARR_0_API_KEY=a4a2efc7767a4674a66513a1b606d748

# RomM session/auth signing key. Replacing it invalidates every logged-in
# session, which is the whole cost; library and metadata are unaffected.
ROMM_AUTH_SECRET_KEY=d2958fcf87e009f5c6cda2cdf00a9366552170136c191380d2ee3a3b14e67822

# RomM's database credentials. These must match what is inside the MariaDB
# data volume: changing them here alone breaks RomM's login to its own
# database. The same password is duplicated into backup/agent-node-02/.env as
# DBB_ROMM_PASSWORD so db-backup can dump it, which means rotation touches
# both files.
ROMM_DB_PASSWORD=romm_secure_db_pass
ROMM_DB_ROOT_PASSWORD=romm_secure_root_pass
