###############################################################################
#
# Configuration
#
# - To enable database credentials encryption, uncomment with a base64-encoded 256-bit key (warning: you cannot change this key once set).
# - To generate a key: `openssl rand -base64 32`
# - This key is also required for Connect UI functionality, as it is needed to generate Connect UI sessions.
#
# NANGO_ENCRYPTION_KEY=<ADD-BASE64-256BIT-KEY>
#
#
# - Customize database to store provider configurations and credentials.
#   (running 'npx nango start' creates a local Postgres database with the following credentials)
#
# NANGO_DB_USER=<PICK-A-USERNAME>
# NANGO_DB_PASSWORD=<PICK-A-PASSWORD>
# NANGO_DB_HOST=<PICK-A-HOST>
# NANGO_DB_PORT=<PICK-A-PORT>
# NANGO_DB_NAME=<PICK-A-DB-NAME>
# NANGO_DB_SCHEMA=<PICK-A-SCHEMA-NAME>
# NANGO_DB_ADDITIONAL_SCHEMAS=<PICK-A-SEARCH-PATH>,<PICK-ANOTHER-SEARCH-PATH>
# NANGO_DB_SSL=<PICK-TRUE-OR-FALSE>
# Override these 2 variables to configure the database connection pool / tune it for your needs i.e. serverless databases.
# NANGO_DB_POOL_MIN=<PICK-INT-OR-SKIP>
# NANGO_DB_POOL_MAX=<PICK-INT-OR-SKIP>
#
# - If empty, default to the main database URL
# RECORDS_DATABASE_URL=
# RECORDS_DATABASE_READ_URL= # Optional
# - If empty, default to nango_records
# RECORDS_DATABASE_SCHEMA=
#
#
# - Configure server and worker port (current value is the default for running Nango locally).
#
SERVER_PORT=3003
WORKER_PORT=3004
#
#
# - Configure server full URL (current value is the default for running Nango locally).
#
NANGO_SERVER_URL=http://localhost:3003
# Base-Url-Override SSRF hardening (enabled by default). Restart server and runners after changing these values.
NANGO_PROXY_BASE_URL_OVERRIDE_ENABLED=true
NANGO_PROXY_BASE_URL_OVERRIDE_DENYLIST='["169.254.169.254","metadata.google.internal","localhost","127.0.0.1","[::1]","[::ffff:127.0.0.1]","[::ffff:169.254.169.254]"]'
# To restore pre-remediation fail-open behavior: NANGO_PROXY_BASE_URL_OVERRIDE_DENYLIST='[]'
# To fully disable the override feature: NANGO_PROXY_BASE_URL_OVERRIDE_ENABLED=false
# Outbound URL SSRF policy (JSON) applied to proxy, customer webhooks, and uncontrolledFetch. Optional; secure
# defaults block DNS rebinding, private/link-local IPs, and cap redirects. Restart server and runners after changing.
# Example (allowlist mode): NANGO_OUTBOUND_URL_POLICY='{"mode":"allowlist","allowlist":[".hubspot.com","api.github.com"]}'
# Example (block private IPs + cap redirects): NANGO_OUTBOUND_URL_POLICY='{"blockPrivateIps":true,"maxRedirects":3}'
# Outbound URL SSRF policy overlay (JSON) for OAuth/token flows (token, refresh, STS, JWT-bearer endpoints).
# Applied on top of NANGO_OUTBOUND_URL_POLICY, but RFC1918/private IPs are allowed by default so self-hosted
# token endpoints keep working; loopback/metadata/link-local stay blocked. Set blockPrivateIps to lock down.
# Example (block private IPs for OAuth too): NANGO_OUTBOUND_URL_POLICY_OAUTH='{"blockPrivateIps":true}'
NANGO_PUBLIC_SERVER_URL=http://localhost:3000
# - Where the dashboard sends its API requests. If unset, NANGO_SERVER_URL is used.
#   Set this when self-hosting and you want the dashboard to reach Nango over an internal host, while
#   NANGO_SERVER_URL stays the public one that OAuth callbacks and webhooks must reach. It only changes
#   where the dashboard sends requests; callback and webhook URLs keep using NANGO_SERVER_URL.
#   `/` keeps requests on whichever host served the dashboard (same-origin). Use this when you front
#   one Nango process with two ingresses. An absolute URL is for a dashboard hosted separately from
#   the API; that origin must be an allowed CORS origin on the API host (see NANGO_PUBLIC_SERVER_URL).
#
# NANGO_DASHBOARD_API_URL=/
# NANGO_DASHBOARD_API_URL=https://nango.example.internal
CSP_REPORT_ONLY=false
# FLAG_AUTH_ENABLED=false
#
#
# - Configure server websockets path (current value is the default for running Nango locally).
#   If this is changed from the default, the client must be configured to use the same path using the `websocketsPath`
#   config option in the Nango constructor.
#
# NANGO_SERVER_WEBSOCKETS_PATH=/
#
#
# - Configure the username and password for securing Nango's dashboard.
# Uncommenting those env vars will disable regular login, signup and enable basic auth protection.
#
# FLAG_AUTH_ENABLED=false
# NANGO_DASHBOARD_USERNAME=<PICK-A-USERNAME>
# NANGO_DASHBOARD_PASSWORD=<PICK-A-PASSWORD>
#
#
# - Set the log level (debug: most verbose, info: recommended for production, error: least verbose)
#
LOG_LEVEL=info

###############################################################################

TZ=UTC

# Configure where integrations will be loaded from
NANGO_INTEGRATIONS_FULL_PATH=

# Internal Datadog Telemetry
# This telemetry logs metrics/traces in your own Datadog instance
NANGO_TELEMETRY_SDK=false
# Tag selected operational metrics with providerConfigKey (high cardinality; off by default)
NANGO_METRICS_INCLUDE_PROVIDER_CONFIG_KEY=false

# ----- Logs
NANGO_LOGS_ENABLED="false"
# elasticsearch (default) or opensearch — NANGO_LOGS_ES_* vars apply to both providers
NANGO_LOGS_PROVIDER="elasticsearch"
NANGO_LOGS_ES_URL="http://localhost:9500"
NANGO_LOGS_ES_USER=""
NANGO_LOGS_ES_PWD=""
# How many days activity/operation logs are kept before deletion (default 15)
NANGO_LOGS_ES_RETENTION_DAYS=15

# Hosted Auth Configuration
WORKOS_API_KEY=
WORKOS_CLIENT_ID=

# Google Cloud Configuration
GOOGLE_APPLICATION_CREDENTIALS=

# Key to send email
# MAILGUN_API_KEY=
# MAILGUN_URL=
# Or send email through any JSON-over-HTTP mail API (SendGrid, Resend, ...)
# EMAIL_HTTP_BODY is required whenever EMAIL_HTTP_URL is set, and must be a JSON object.
# EMAIL_HTTP_URL=
# EMAIL_HTTP_HEADERS=
# EMAIL_HTTP_BODY=
# EMAIL_HTTP_TIMEOUT_MS=10000

# Sender address for all providers. SendGrid wants a bare address, not "Name <addr>".
# SMTP_FROM=

# Redis (optional)
#NANGO_REDIS_URL=

# Orchestrator
ORCHESTRATOR_SERVICE_URL="http://localhost:3008"
# Max immediate tasks admitted per minute per rate limit key. 0 (the default) disables throttling.
# ORCHESTRATOR_THROTTLED_IMMEDIATE_PER_MIN=3200

# Key to display domain logo in the UI
# https://www.logo.dev/
PUBLIC_LOGODEV_KEY=

# ---- Connect UI
NANGO_PUBLIC_CONNECT_URL=http://localhost:3009
# Only relevant for self-hosted
NANGO_CONNECT_UI_PORT=3009
FLAG_SERVE_CONNECT_UI=true

# ---- Role-based authorization (optional)
# FLAG_AUTH_ROLES_ENABLED=false

# ---- Audit trail (optional)
# FLAG_AUDIT_TRAIL_ENABLED=false

# ---- E2B sandboxes for remote functions
# E2B_API_KEY=<E2B-API-KEY>
# E2B_SANDBOX_COMPILER_TEMPLATE=blank-workspace:staging

# ---- AWS
# AWS_ACCESS_KEY_ID=<ACCESS-KEY-ID>
# AWS_SECRET_ACCESS_KEY=<SECRET-ACCESS-KEY>

# ---- Orb (optional)
# ORB_API_KEY=<ORB-API-KEY>
# ORB_WEBHOOKS_SECRET=<ORB-WEBHOOKS-SECRET>

# API key for OpenCode agent used to sync OAuth2 provider scopes
# OPENCODE_API_KEY=
# ---- Clickhouse (optional)
# CLICKHOUSE_URL=http://default:@localhost:8123

# ---- Plain (in-app support chat, optional)
# PLAIN_APP_ID=<PLAIN-APP-ID>
# PLAIN_HMAC_SECRET=<PLAIN-HMAC-SECRET>

# ---- Internal mTLS (self-hosted, optional)
# Client certificate presented on service-to-service calls. mTLS is enforced outside the app
# (load balancer / service mesh); these only control what Nango sends as a client.
# Set on every service. Inline values accept raw PEM or base64-encoded PEM.
# NANGO_INTERNAL_TLS_CERT=<CLIENT-CERTIFICATE-CHAIN-PEM>
# NANGO_INTERNAL_TLS_KEY=<CLIENT-PRIVATE-KEY-PEM>
# NANGO_INTERNAL_TLS_CA=<INTERNAL-CA-PEM>
# Or point at mounted files instead (mutually exclusive with the inline form above)
# NANGO_INTERNAL_TLS_CERT_FILE=/etc/nango/tls/tls.crt
# NANGO_INTERNAL_TLS_KEY_FILE=/etc/nango/tls/tls.key
# NANGO_INTERNAL_TLS_CA_FILE=/etc/nango/tls/ca.crt
# NANGO_INTERNAL_TLS_KEY_PASSPHRASE=<PASSPHRASE-IF-KEY-IS-ENCRYPTED>
# Scheme for runner URLs built by the Kubernetes and Render providers
# NANGO_RUNNER_URL_SCHEME=https

# ---- Internal service auth (self-hosted, optional)
# Off by default. Shipping the image with these unset is a no-op until you inject secrets
# and set NANGO_INTERNAL_AUTH_REQUIRED=true. See docs/guides/platform/self-hosting.mdx.
# Control plane only (server, jobs, orchestrator). Never set on runners.
# NANGO_INTERNAL_AUTH_TOKEN=<SHARED-BEARER>
# Jobs only. Used to mint per-task HMAC JWTs for putTask/heartbeat and to seed the Ed25519
# runner-dispatch keypair. Never set on runners; jobs injects only the public key at node start.
# NANGO_INTERNAL_AUTH_SIGNING_KEY=<HMAC-SECRET>
# Fail closed. Default false. Flip independently on orchestrator, then jobs (runners inherit REQUIRED at node start).
# NANGO_INTERNAL_AUTH_REQUIRED=false