WeKan

# This docker-compose.yml uses FerretDB v1 with SQLite from
# https://github.com/wekan/FerretDB by default.
#
# WeKan with FerretDB v1 + embedded SQLite (no PostgreSQL, no MongoDB)
#
# This is the DEFAULT WeKan compose file (docker-compose.yml): a light,
# self-contained database — FerretDB v1 (the wekan/FerretDB fork,
# https://github.com/wekan/FerretDB) with its embedded pure-Go SQLite backend,
# which speaks the MongoDB wire protocol. There is no separate PostgreSQL or
# MongoDB server — FerretDB stores everything in SQLite files on a volume, and
# WeKan stores attachments/avatars on the filesystem.
#
# The other WeKan compose files:
#   docker-compose.yml                           FerretDB v1 + SQLite (default)
#   docker-compose-ferretdb-v1-postgresql.yml    FerretDB v1 + PostgreSQL
#   docker-compose-ferretdb-v1-mysql.yml         FerretDB v1 + MySQL
#   docker-compose-ferretdb-v1-mariadb.yml       FerretDB v1 + MariaDB
#   docker-compose-ferretdb-v1-sap-hana.yml      FerretDB v1 + SAP HANA
#   docker-compose-ferretdb-v2-postgresql.yml    FerretDB 2 + PostgreSQL
#   docker-compose-mongodb-v7.yml                MongoDB 7
#   docker-compose-multitenancy.yml              MongoDB, multitenancy example
#
# The FerretDB binary is downloaded (once, then cached on the volume) from the
# newest wekan/FerretDB release: https://github.com/wekan/FerretDB/releases
# Each platform is a separate ferretdb-<arch> asset there; the container downloads
# only the one matching its architecture (amd64, arm64, ppc64le, s390x, riscv64, ...).
#
# Setup (this is the default docker-compose.yml, so no -f is needed):
#   docker compose up -d
#
# To follow the logs:
#   docker compose logs -f
#
# To stop:
#   docker compose down

services:

  # FerretDB v1 with the embedded SQLite backend (MongoDB-compatible on :27017).
  # A tiny Debian container fetches the wekan/FerretDB v1 release binary for its
  # architecture (cached on the volume and replaced when this required release
  # changes) and runs it.
  # SQLite data lives in /data/sqlite on the ferretdb-data volume.
  ferretdb:
    image: debian:bookworm-slim
    container_name: wekan-ferretdb
    restart: always
    environment:
      DO_NOT_TRACK: "1"
      FERRETDB_TELEMETRY: disable
      # Follow the newest published release. A specific download/vX.Y.Z remains
      # available for rollback; the marker below upgrades an older cached binary.
      FERRETDB_RELEASE: ${FERRETDB_RELEASE:-latest/download}
    command:
      - sh
      - -c
      - |
        set -eu
        BIN=/data/bin/ferretdb
        RELEASE_FILE=/data/bin/ferretdb.release
        if ! command -v curl >/dev/null 2>&1; then
          apt-get update -qq
          apt-get install -y -qq --no-install-recommends curl ca-certificates >/dev/null
        fi
        DOWNLOAD_RELEASE="$$FERRETDB_RELEASE"
        REQUIRED_RELEASE="$$FERRETDB_RELEASE"
        if [ "$$FERRETDB_RELEASE" = latest/download ]; then
          LATEST_URL="$$(curl -fsSIL --retry 5 -o /dev/null -w '%{url_effective}' \
            https://github.com/wekan/FerretDB/releases/latest)"
          REQUIRED_RELEASE="$${LATEST_URL##*/}"
          [ -n "$$REQUIRED_RELEASE" ]
          DOWNLOAD_RELEASE="download/$$REQUIRED_RELEASE"
        fi
        CACHED_RELEASE="$$(cat "$$RELEASE_FILE" 2>/dev/null || true)"
        if [ ! -x "$$BIN" ] || [ "$$CACHED_RELEASE" != "$$REQUIRED_RELEASE" ]; then
          echo "Fetching newest FerretDB v1 $${REQUIRED_RELEASE} from the wekan/FerretDB release ..."
          arch="$$(dpkg --print-architecture)"
          case "$$arch" in ppc64el) arch=ppc64le ;; esac
          mkdir -p /data/bin
          # Download only this arch's binary (per-arch release assets, no ferretdb.zip).
          curl -fSL --retry 5 -o "$$BIN.new" \
            "https://github.com/wekan/FerretDB/releases/$${DOWNLOAD_RELEASE}/ferretdb-$${arch}"
          curl -fSL --retry 5 -o "$$BIN.new.sha256sum" \
            "https://github.com/wekan/FerretDB/releases/$${DOWNLOAD_RELEASE}/ferretdb-$${arch}.sha256sum"
          EXPECTED="$$(awk '{print $$1; exit}' "$$BIN.new.sha256sum")"
          ACTUAL="$$(sha256sum "$$BIN.new" | awk '{print $$1}')"
          [ -n "$$EXPECTED" ] && [ "$$ACTUAL" = "$$EXPECTED" ]
          chmod +x "$$BIN.new"
          mv "$$BIN.new" "$$BIN"
          rm "$$BIN.new.sha256sum"
          printf '%s\n' "$$REQUIRED_RELEASE" > "$$RELEASE_FILE"
          chmod +x "$$BIN"
        fi
        mkdir -p /data/files/db
        # --repl-set-name only makes FerretDB keep local.oplog.rs, which Admin Panel /
        # Attachments / Continuous backup streams the database from (maintainer
        # decision of 2026-10-03). WeKan itself still polls: no MONGO_OPLOG_URL.
        exec "$$BIN" \
          --handler=sqlite \
          --sqlite-url=file:/data/files/db/ \
          --listen-addr=0.0.0.0:27017 \
          --repl-set-name=rs0 \
          --telemetry=disable \
          --log-level=error
    # Healthy only once FerretDB is actually accepting connections on 27017 — i.e.
    # AFTER the first-run binary download (apt-get + curl) has finished and the server
    # is listening. WeKan's depends_on: condition: service_healthy waits for this, so it
    # never starts against a not-yet-ready database (which showed up as the browser
    # getting "Connection reset by peer" on a fresh `docker compose up`). bash + /dev/tcp
    # needs no extra tools in debian-slim. start_period covers a slow first download.
    healthcheck:
      test: ["CMD-SHELL", "bash -c '</dev/tcp/127.0.0.1/27017' 2>/dev/null"]
      interval: 5s
      timeout: 3s
      retries: 40
      start_period: 30s
    volumes:
      - ferretdb-data:/data
    networks:
      - wekan-tier
    # Expose only on localhost by default; remove to keep it internal to the network.
    ports:
      - 127.0.0.1:27017:27017

  wekan:
    #-------------------------------------------------------------------------------------
    # ==== WEKAN FROM GITHUB/QUAY/DOCKER HUB ====
    # All of GitHub, Quay and Docker Hub have latest, but because
    # latest tag changes when is newest release,
    # when upgrading would be better to use version tag.
    # a) Using specific version tag is better:
    # image: ghcr.io/wekan/wekan:v6.89
    # image: quay.io/wekan/wekan:v6.89
    # image: wekanteam/wekan:v6.89
    # b) GitHub Container registry.
    # b1) Latest release tag:
    image: ghcr.io/wekan/wekan:latest
    # b2) Newest git commit automatic build:
    #image: ghcr.io/wekan/wekan:main
    # c) Quay:
    #image: quay.io/wekan/wekan:latest
    # d) Docker Hub:
    #image: wekanteam/wekan:latest
    #-------------------------------------------------------------------------------------
    container_name: wekan-app
    # On CentOS 7 there is seccomp issue with glibc 6,
    # so CentOS 7 users shoud use these security_opt seccomp:unconfined
    # settings to get WeKan working. See:
    #   - https://github.com/wekan/wekan/issues/4585
    #   - https://github.com/wekan/wekan/issues/4587
    #security_opt:
    #  - seccomp:unconfined
    restart: always
    networks:
      - wekan-tier
    #-------------------------------------------------------------------------------------
    # ==== BUILD wekan-app DOCKER CONTAINER FROM SOURCE, if you uncomment these ====
    # ==== and use commands: docker compose up -d --build
    #build:
    #  context: .
    #  dockerfile: Dockerfile
    #-------------------------------------------------------------------------------------
    ports:
      # Docker outsideport:insideport. Do not add anything extra here.
      # For example, if you want to have wekan on port 3001,
      # use 3001:8080 . Do not add any extra address etc here, that way it does not work.
      # remove port mapping if you use nginx reverse proxy, port 8080 is already exposed to wekan-tier network
      - 80:8080
    environment:
      # FerretDB v1 deployments are polling-only. Use docker-compose-mongodb-v7.yml
      # for MongoDB replica-set/change-stream reactivity.
      - DEFAULT_METEOR_REACTIVITY_ORDER=polling
      - METEOR_REACTIVITY_ORDER=polling
      # uws does not work at s390x. sockjs works.
      # sockjs is the only transport WeKan ships: no bundle or image carries
      # uWebSockets.js, and DDP_TRANSPORT=uws is coerced to sockjs at startup.
      - DDP_TRANSPORT=sockjs
      #-----------------------------------------------------------------
      # ==== WRITEABLE PATH FOR FILE UPLOADS ====
      - WRITABLE_PATH=/data
      #-----------------------------------------------------------------
      # ==== AWS S3 FOR FILES ====
      # Any region. For example:
      #   us-standard,us-west-1,us-west-2,
      #   eu-west-1,eu-central-1,
      #   ap-southeast-1,ap-northeast-1,sa-east-1
      #
      #- S3='{"s3":{"key": "xxx", "secret": "xxx", "bucket": "xxx", "region": "xxx"}}'
      #- S3_SECRET_KEY_FILE=/run/secrets/s3_secret_key
      #-----------------------------------------------------------------
      # ==== MONGO_URL — points to FerretDB (MongoDB-compatible) ====
      #- MONGO_URL=mongodb://wekan-ferretdb:27017/wekan?directConnection=true
      # directConnection: FerretDB answers as a one-member replica set whose
      # member is its listen address 0.0.0.0, which is nowhere from this container.
      - MONGO_URL=mongodb://ferretdb:27017/wekan?directConnection=true
      #- MONGO_URL_FILE=/run/secrets/mongo_url
      #---------------------------------------------------------------
      # ==== ROOT_URL SETTING ====
      # Change ROOT_URL to your real Wekan URL, for example:
      # If you have Caddy/Nginx/Apache providing SSL
      #  - https://example.com
      #  - https://boards.example.com
      # This can be problematic with avatars https://github.com/wekan/wekan/issues/1776
      #  - https://example.com/wekan
      # If without https, can be only wekan node, no need for Caddy/Nginx/Apache if you don't need them
      #  - http://example.com
      #  - http://boards.example.com
      #  - http://192.168.1.100    <=== using at local LAN
      - ROOT_URL=http://localhost  #   <=== using only at same laptop/desktop where Wekan is installed
      #---------------------------------------------------------------
      # ==== EMAIL SETTINGS ====
      # In Admin Panel / People / Email, enable "Enable below email settings"
      # to reveal additional email sending options below the checkbox.
      #   see https://github.com/wekan/wekan/blob/main/docs/Email/Troubleshooting-Mail.md
      #   For SSL in email, change smtp:// to smtps://
      # NOTE: Special characters need to be url-encoded in MAIL_URL.
      #       You can encode those characters for example at: https://www.urlencoder.org
      #- MAIL_URL=smtp://user:[email protected]:25/
      - MAIL_URL=smtp://<mail_url>:25/?ignoreTLS=true&tls={rejectUnauthorized:false}
      - MAIL_FROM=Wekan Notifications <[email protected]>
      # Currently MAIL_SERVICE is not in use.
      #- MAIL_SERVICE=Outlook365
      #- [email protected]
      #- MAIL_SERVICE_PASSWORD=SecretPassword
      #- MAIL_URL_FILE=/run/secrets/mail_url
      #---------------------------------------------------------------
      # https://github.com/wekan/wekan/issues/3585#issuecomment-1021522132
      # Add more Node heap, this is done by default at Dockerfile:
      #   - NODE_OPTIONS="--max_old_space_size=4096"
      # Add more stack, this is done at Dockerfile:
      #   bash -c "ulimit -s 65500; exec node --stack-size=65500 main.js"
      #---------------------------------------------------------------
      # ==== OPTIONAL: KADIRA PERFORMANCE MONITORING FOR METEOR ====
      # https://github.com/edemaine/kadira-compose
      # https://github.com/meteor/meteor-apm-agent
      # https://blog.meteor.com/kadira-apm-is-now-open-source-490469ffc85f
      #- APM_OPTIONS_ENDPOINT=http://<kadira-ip>:11011
      #- APM_APP_ID=
      #- APM_APP_SECRET=
      #---------------------------------------------------------------
      # ==== OPTIONAL: LOGS AND STATS ====
      # https://github.com/wekan/wekan/blob/main/docs/Features/Logs.md
      #
      # Daily export of Wekan changes as JSON to Logstash and ElasticSearch / Kibana (ELK)
      # https://github.com/wekan/wekan-logstash
      #
      # Statistics Python script for Wekan Dashboard
      # https://github.com/wekan/wekan-stats
      #
      # The legacy Winston/Zulip database-change logger was removed in 2017:
      # replacing Meteor's default console transport could prevent database startup (#1094).
      # Use the current logging integrations documented above instead.
      #
      # There is Feature Request: Logging date and time of all activity with summary reports,
      # and requesting reason for changing card to other column https://github.com/wekan/wekan/issues/1598
      #---------------------------------------------------------------
      # ==== NUMBER OF SEARCH RESULTS PER PAGE BY DEFAULT ====
      #- RESULTS_PER_PAGE=20
      #---------------------------------------------------------------
      # ==== AFTER OIDC LOGIN, ADD USERS AUTOMATICALLY TO THIS BOARD ID ====
      # https://github.com/wekan/wekan/pull/5098
      #- DEFAULT_BOARD_ID=abcd1234
      #---------------------------------------------------------------
      # ==== WEKAN API AND EXPORT BOARD ====
      # Wekan Export Board works when WITH_API=true.
      # https://github.com/wekan/wekan/blob/main/docs/API/REST-API.md
      # https://github.com/wekan/wekan-gogs
      # If you disable Wekan API with false, Export Board does not work.
      - WITH_API=true
      #---------------------------------------------------------------
      # ==== PASSWORD BRUTE FORCE PROTECTION ====
      #https://atmospherejs.com/lucasantoniassi/accounts-lockout
      #Defaults below. Uncomment to change. wekan/server/accounts-lockout.js
      #- ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3
      #- ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60
      #- ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15
      #- ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3
      #- ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60
      #- ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15
      #---------------------------------------------------------------
      # ==== ACCOUNT OPTIONS ====
      # https://docs.meteor.com/api/accounts-multi.html#AccountsCommon-config
      # Defaults below. Uncomment to change. wekan/server/accounts-common.js
      # - ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90
      #---------------------------------------------------------------
      #---------------------------------------------------------------
      # ==== CARD LOADING: all (default) or lazy ====
      # 'all'  = load every card of a board into the browser (default).
      # 'lazy' = each list loads only the cards currently visible
      #          (infinite scroll) plus a live count, so boards with
      #          thousands of cards use less memory/bandwidth.
      # Also changeable at runtime in Admin Panel / Features.
      - CARDS_LOADING=auto
      #---------------------------------------------------------------
      # ==== CARD OPENED, SEND WEBHOOK MESSAGE ====
      # https://github.com/wekan/wekan/issues/2518
      - CARD_OPENED_WEBHOOK_ENABLED=false
      #---------------------------------------------------------------
      # ==== Allow configuration to validate uploaded attachments ====
      #-ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM=/usr/local/bin/avscan {file}
      #-ATTACHMENTS_UPLOAD_MIME_TYPES=image/*,text/*
      #-ATTACHMENTS_UPLOAD_MAX_SIZE=5000000
      #---------------------------------------------------------------
      # ==== Allow configuration to validate uploaded avatars ====
      #-AVATARS_UPLOAD_EXTERNAL_PROGRAM=/usr/local/bin/avscan {file}
      #-AVATARS_UPLOAD_MIME_TYPES=image/*
      #-AVATARS_UPLOAD_MAX_SIZE=500000
      # DEFAULT_AVATAR_URL : avatar of users who have not set one, a URL with {username},
      # {userId}, {emailMd5} or {emailSha256} replaced. Example: http://192.168.1.200/avatars/{username}.png
      #- DEFAULT_AVATAR_URL=
      #---------------------------------------------------------------
      # ==== Allow to shrink attached/pasted image ====
      # https://github.com/wekan/wekan/pull/2544
      #- MAX_IMAGE_PIXEL=1024
      #- IMAGE_COMPRESS_RATIO=80
      #---------------------------------------------------------------
      # ==== NOTIFICATION TRAY AFTER READ DAYS BEFORE REMOVE =====
      # Number of days after a notification is read before we remove it.
      # Default: 2
      #- NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE=2
      #---------------------------------------------------------------
      # ==== BIGEVENTS DUE ETC NOTIFICATIONS =====
      # https://github.com/wekan/wekan/pull/2541
      # Introduced a system env var BIGEVENTS_PATTERN default as "NONE",
      # so any activityType matches the pattern, system will send out
      # notifications to all board members no matter they are watching
      # or tracking the board or not. Owner of the wekan server can
      # disable the feature by setting this variable to "NONE" or
      # change the pattern to any valid regex. i.e. '|' delimited
      # activityType names.
      # a) Example
      #- BIGEVENTS_PATTERN=due
      # b) All
      #- BIGEVENTS_PATTERN=received|start|due|end
      # c) Disabled
      - BIGEVENTS_PATTERN=NONE
      #---------------------------------------------------------------
      # ==== NOTIFY ON ASSIGN =====
      # Notify the user directly when they are added as a card member or
      # assignee. Set false to disable.
      #- NOTIFY_ON_ASSIGN=true
      #---------------------------------------------------------------
      # ==== EMAIL DUE DATE NOTIFICATION =====
      # https://github.com/wekan/wekan/pull/2536
      # System timelines will be showing any user modification for
      # dueat startat endat receivedat, also notification to
      # the watchers and if any card is due, about due or past due.
      #
      # Notify due days, default is None, 2 days before and on the event day
      #- NOTIFY_DUE_DAYS_BEFORE_AND_AFTER=2,0
      #
      # Notify due at hour of day. Default every morning at 8am. Can be 0-23.
      # If env variable has parsing error, use default. Notification sent to watchers.
      #- NOTIFY_DUE_AT_HOUR_OF_DAY=8
      #-----------------------------------------------------------------
      # ==== EMAIL NOTIFICATION TIMEOUT, ms =====
      # Default: 30000 ms = 30s
      #- EMAIL_NOTIFICATION_TIMEOUT=30000
      #-----------------------------------------------------------------
      # ==== CORS =====
      # CORS: Set Access-Control-Allow-Origin header.
      #- CORS=*
      # CORS_ALLOW_HEADERS: Set Access-Control-Allow-Headers header.  "Authorization,Content-Type" is required for cross-origin use of the API.
      #- CORS_ALLOW_HEADERS=Authorization,Content-Type
      # CORS_EXPOSE_HEADERS: Set Access-Control-Expose-Headers header.  This is not needed for typical CORS situations
      #- CORS_EXPOSE_HEADERS=*
      #-----------------------------------------------------------------
      # ==== MATOMO INTEGRATION ====
      # Optional: Integration with Matomo https://matomo.org that is installed to your server
      # The address of the server where Matomo is hosted.
      #- MATOMO_ADDRESS=https://example.com/matomo
      # The value of the site ID given in Matomo server for Wekan
      #- MATOMO_SITE_ID=1
      # The option do not track which enables users to not be tracked by matomo
      #- MATOMO_DO_NOT_TRACK=true
      # The option that allows matomo to retrieve the username:
      #- MATOMO_WITH_USERNAME=true
      #-----------------------------------------------------------------
      # ==== BROWSER POLICY AND TRUSTED IFRAME URL ====
      # Enable browser policy and allow one trusted URL that can have iframe that has Wekan embedded inside.
      # Setting this to false is not recommended, it also disables all other browser policy protections
      # and allows all iframing etc. See wekan/server/policy.js
      - BROWSER_POLICY_ENABLED=true
      # When browser policy is enabled, HTML code at this Trusted URL can have iframe that embeds Wekan inside.
      #- TRUSTED_URL=https://intra.example.com
      #-----------------------------------------------------------------
      # ==== METRICS ALLOWED IP ADDRESSES ====
      # https://github.com/wekan/wekan/blob/main/docs/Features/Metrics.md
      #- METRICS_ALLOWED_IP_ADDRESSES=192.168.0.100,192.168.0.200
      #-----------------------------------------------------------------
      # ==== OUTGOING WEBHOOKS ====
      # What to send to Outgoing Webhook, or leave out. If commented out the default values will be: cardId,listId,oldListId,boardId,comment,user,card,commentId,swimlaneId,customerField,customFieldValue
      #- WEBHOOKS_ATTRIBUTES=cardId,listId,oldListId,boardId,comment,user,card,board,list,swimlane,commentId
      #-----------------------------------------------------------------
      # ==== Debug OIDC OAuth2 etc ====
      #- DEBUG=true
      #---------------------------------------------
      # ==== AUTOLOGIN WITH OIDC/OAUTH2 ====
      # https://github.com/wekan/wekan/blob/main/docs/Login/autologin.md
      #- OIDC_REDIRECTION_ENABLED=true
      # OIDC RP-initiated logout endpoint (end_session_endpoint). When set, the
      # "Log Out" menu redirects to this endpoint so the identity provider session
      # is also ended and the user is returned to Wekan (ROOT_URL) via
      # post_logout_redirect_uri, instead of landing on the provider home page
      # (which errors for non-admin users). See https://github.com/wekan/wekan/issues/6158
      # Keycloak example:
      #- OAUTH2_LOGOUT_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/logout
      #-----------------------------------------------------------------
      # ==== OAUTH2 ORACLE on premise identity manager OIM ====
      #- ORACLE_OIM_ENABLED=true
      #-----------------------------------------------------------------
      # ==== OAUTH2 AZURE ====
      # https://github.com/wekan/wekan/blob/main/docs/Login/Azure/Azure.md
      # 1) Register the application with Azure. Make sure you capture
      #    the application ID as well as generate a secret key.
      # 2) Configure the environment variables. This differs slightly
      #     by installation type, but make sure you have the following:
      #- OAUTH2_ENABLED=true
      # Optional OAuth2 CA Cert, see https://github.com/wekan/wekan/issues/3299
      #- OAUTH2_CA_CERT=ABCD1234
      # Use OAuth2 ADFS additional changes. Also needs OAUTH2_ENABLED=true setting.
      #- OAUTH2_ADFS_ENABLED=false
      # Azure AD B2C. https://github.com/wekan/wekan/issues/5242
      #- OAUTH2_B2C_ENABLED=false
      # SECURITY (GHSA-mp7g-hj5q-gxhq): Link an OIDC login to a pre-existing
      # Wekan account (password/LDAP) with the same email. OFF by default; when
      # false an OIDC login whose email already exists is rejected instead of
      # merged, preventing account takeover via spoofed email claims. Only
      # enable if you fully trust your OIDC provider's email claims, and even
      # then the provider must send email_verified=true for the merge to happen.
      #- OAUTH2_MERGE_EXISTING_USERS=false
      # When false, OAuth2/OIDC login is refused for users that do not already
      # have a Wekan account (matched by verified email).
      #- OAUTH2_AUTO_REGISTRATION=true
      # Comma/space separated OAuth2/OIDC group names whose members become Wekan
      # admins. Empty = off.
      #- OAUTH2_ADMIN_GROUPS=
      # OAuth2 login style: redirect (default) or popup.
      #- OAUTH2_LOGIN_STYLE=redirect
      # Application GUID captured during app registration:
      #- OAUTH2_CLIENT_ID=xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
      # Secret key generated during app registration:
      #- OAUTH2_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
      #- OAUTH2_SECRET_FILE=/run/secrets/oauth2_secret
      #- OAUTH2_SERVER_URL=https://login.microsoftonline.com/
      #- OAUTH2_AUTH_ENDPOINT=/oauth2/v2.0/authorize
      #- OAUTH2_USERINFO_ENDPOINT=https://graph.microsoft.com/oidc/userinfo
      #- OAUTH2_TOKEN_ENDPOINT=/oauth2/v2.0/token
      # The claim name you want to map to the unique ID field:
      #- OAUTH2_ID_MAP=email
      # The claim name you want to map to the username field:
      #- OAUTH2_USERNAME_MAP=email
      # The claim name you want to map to the full name field:
      #- OAUTH2_FULLNAME_MAP=name
      # The claim name you want to map to the email field:
      #- OAUTH2_EMAIL_MAP=email
      # Optional exact email domains for generic OAuth2/OIDC login (on-premise supported).
      #- OAUTH2_ALLOWED_EMAIL_DOMAINS=example.internal,other.internal
      # OAUTH2_DEFAULT_ORGANIZATION : an existing organization that every account
      # created by an OAuth2/OIDC login joins (short name, display name or id).
      #- OAUTH2_DEFAULT_ORGANIZATION=Nextcloud users
      #-----------------------------------------------------------------
      # ==== OAUTH2 Nextcloud ====
      # 1) Register the application with Nextcloud: https://your.nextcloud/index.php/settings/admin/security
      #    Make sure you capture the application ID as well as generate a secret key.
      #    Use https://your.wekan/_oauth/oidc for the redirect URI.
      # 2) Configure the environment variables. This differs slightly
      #     by installation type, but make sure you have the following:
      #- OAUTH2_ENABLED=true
      # OAuth2 login style: redirect (default) or popup.
      #- OAUTH2_LOGIN_STYLE=redirect
      # Application GUID captured during app registration:
      #- OAUTH2_CLIENT_ID=xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
      # Secret key generated during app registration:
      #- OAUTH2_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
      #- OAUTH2_SECRET_FILE=/run/secrets/oauth2_secret
      #- OAUTH2_SERVER_URL=https://your-nextcloud.tld
      #- OAUTH2_AUTH_ENDPOINT=/index.php/apps/oauth2/authorize
      #- OAUTH2_USERINFO_ENDPOINT=/ocs/v2.php/cloud/user?format=json
      #- OAUTH2_TOKEN_ENDPOINT=/index.php/apps/oauth2/api/v1/token
      # The claim name you want to map to the unique ID field:
      #- OAUTH2_ID_MAP=id
      # The claim name you want to map to the username field:
      #- OAUTH2_USERNAME_MAP=id
      # The claim name you want to map to the full name field:
      #- OAUTH2_FULLNAME_MAP=display-name
      # The claim name you want to map to the email field:
      #- OAUTH2_EMAIL_MAP=email
      #-----------------------------------------------------------------
      # ==== OAUTH2 KEYCLOAK ====
      # https://github.com/wekan/wekan/blob/main/docs/Login/Keycloak/Keycloak.md  <== MAPPING INFO, REQUIRED
      #- OAUTH2_ENABLED=true
      # OAuth2 login style: redirect (default) or popup.
      #- OAUTH2_LOGIN_STYLE=redirect
      #- OAUTH2_CLIENT_ID=<Keycloak create Client ID>
      #- OAUTH2_SERVER_URL=<Keycloak server url - https://keycloak.example.com>
      #- OAUTH2_AUTH_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/auth
      #- OAUTH2_USERINFO_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/userinfo
      #- OAUTH2_TOKEN_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/token
      #- OAUTH2_SECRET=<keycloak client secret>
      #- OAUTH2_SECRET_FILE=/run/secrets/oauth2_secret
      #- OAUTH2_ID_MAP=sub
      #- OAUTH2_USERNAME_MAP=preferred_username
      #- OAUTH2_EMAIL_MAP=email
      #- OAUTH2_FULLNAME_MAP=name
      #-----------------------------------------------------------------
      # ==== OAUTH2 AUTHELIA ====
      # https://github.com/wekan/wekan/blob/main/docs/Features/Login-Page/Authelia.md  <== MAPPING INFO, REQUIRED
      # https://www.authelia.com/integration/openid-connect/introduction/
      #- OAUTH2_ENABLED=true
      # OAuth2 login style: redirect (default) or popup.
      #- OAUTH2_LOGIN_STYLE=redirect
      #- OAUTH2_CLIENT_ID=<Authelia client id>
      #- OAUTH2_SERVER_URL=https://auth.yourserver.com
      #- OAUTH2_AUTH_ENDPOINT=/api/oidc/authorization
      #- OAUTH2_USERINFO_ENDPOINT=/api/oidc/userinfo
      #- OAUTH2_TOKEN_ENDPOINT=/api/oidc/token
      #- OAUTH2_SECRET=<Authelia client secret>
      #- OAUTH2_SECRET_FILE=/run/secrets/oauth2_secret
      #- OAUTH2_ID_MAP=sub
      #- OAUTH2_USERNAME_MAP=preferred_username
      #- OAUTH2_EMAIL_MAP=email
      #- OAUTH2_FULLNAME_MAP=name
      #- OAUTH2_REQUEST_PERMISSIONS=openid profile email
      #-----------------------------------------------------------------
      # ==== OAUTH2 DOORKEEPER ====
      # https://github.com/wekan/wekan/issues/1874
      # https://github.com/wekan/wekan/blob/main/docs/Login/OAuth2.md2
      # Enable the OAuth2 connection
      #- OAUTH2_ENABLED=true
      # OAuth2 docs: https://github.com/wekan/wekan/blob/main/docs/Login/OAuth2.md
      # OAuth2 login style: redirect (default) or popup.
      #- OAUTH2_LOGIN_STYLE=redirect
      # OAuth2 Client ID.
      #- OAUTH2_CLIENT_ID=abcde12345
      # OAuth2 Secret.
      #- OAUTH2_SECRET=54321abcde
      #- OAUTH2_SECRET_FILE=/run/secrets/oauth2_secret
      # OAuth2 Server URL.
      #- OAUTH2_SERVER_URL=https://chat.example.com
      # OAuth2 Authorization Endpoint.
      #- OAUTH2_AUTH_ENDPOINT=/oauth/authorize
      # OAuth2 Userinfo Endpoint.
      #- OAUTH2_USERINFO_ENDPOINT=/oauth/userinfo
      # OAuth2 Token Endpoint.
      #- OAUTH2_TOKEN_ENDPOINT=/oauth/token
      # OAUTH2 ID Token Whitelist Fields.
      #- OAUTH2_ID_TOKEN_WHITELIST_FIELDS=""
      # OAUTH2 Request Permissions.
      #- OAUTH2_REQUEST_PERMISSIONS=openid profile email
      # OAuth2 ID Mapping
      #- OAUTH2_ID_MAP=
      # OAuth2 Username Mapping
      #- OAUTH2_USERNAME_MAP=
      # OAuth2 Fullname Mapping
      #- OAUTH2_FULLNAME_MAP=
      # OAuth2 Email Mapping
      #- OAUTH2_EMAIL_MAP=
      #-----------------------------------------------------------------
      # ==== LDAP: UNCOMMENT ALL TO ENABLE LDAP ====
      # https://github.com/wekan/wekan/blob/main/docs/Login/LDAP.md
      # For Snap settings see https://github.com/wekan/wekan/blob/main/docs/Platforms/FOSS/Container/Snap/Supported-settings-keys.md
      # Most settings work both on Snap and Docker below.
      # Note: Do not add single quotes '' to variables. Having spaces still works without quotes where required.
      #
      # The default authentication method used if a user does not exist to create and authenticate. Can be set as ldap.
      # (this is set properly in the Admin Panel, changing this item does not remove Password login option)
      #- DEFAULT_AUTHENTICATION_METHOD=ldap
      #
      # Enable or not the connection by the LDAP
      #- LDAP_ENABLE=true
      #
      # The port of the LDAP server
      #- LDAP_PORT=389
      #
      # The host server for the LDAP server
      #- LDAP_HOST=localhost
      #
      #-----------------------------------------------------------------
      # ==== LDAP AD Simple Auth ====
      #
      # Set to true, if you want to connect with Active Directory by Simple Authentication.
      # When using AD Simple Auth, LDAP_BASEDN is not needed.
      #
      # Example:
      #- LDAP_AD_SIMPLE_AUTH=true
      #
      # === LDAP User Authentication ===
      #
      # a) Option to login to the LDAP server with the user's own username and password, instead of
      #    an administrator key. Default: false (use administrator key).
      #
      # b) When using AD Simple Auth, set to true, when login user is used for binding,
      #    and LDAP_BASEDN is not needed.
      #
      # Example:
      #- LDAP_USER_AUTHENTICATION=true
      #
      # Which field is used to find the user for the user authentication. Default: uid.
      #- LDAP_USER_AUTHENTICATION_FIELD=uid
      #
      # === LDAP Default Domain ===
      #
      # a) In case AD SimpleAuth is configured, the default domain is appended to the given
      #    loginname for creating the correct username for the bind request to AD.
      #
      # b) The default domain of the ldap it is used to create email if the field is not map
      #     correctly with the LDAP_SYNC_USER_DATA_FIELDMAP
      #
      # Example :
      #- LDAP_DEFAULT_DOMAIN=mydomain.com
      #
      #-----------------------------------------------------------------
      # ==== LDAP BASEDN Auth ====
      #
      # The base DN for the LDAP Tree
      #- LDAP_BASEDN=ou=user,dc=example,dc=org
      #
      #-----------------------------------------------------------------
      # Fallback on the default authentication method
      #- LDAP_LOGIN_FALLBACK=false
      #
      # Reconnect to the server if the connection is lost
      #- LDAP_RECONNECT=true
      #
      # Overall timeout, in milliseconds
      #- LDAP_TIMEOUT=10000
      #
      # Specifies the timeout for idle LDAP connections in milliseconds
      #- LDAP_IDLE_TIMEOUT=10000
      #
      # Connection timeout, in milliseconds
      #- LDAP_CONNECT_TIMEOUT=10000
      #
      # If the LDAP needs a user account to search
      #- LDAP_AUTHENTIFICATION=true
      #
      # The search user DN - You need quotes when you have spaces in parameters
      # 2 examples:
      #- LDAP_AUTHENTIFICATION_USERDN=CN=ldap admin,CN=users,DC=domainmatter,DC=lan
      #- LDAP_AUTHENTIFICATION_USERDN=CN=wekan_adm,OU=serviceaccounts,OU=admin,OU=prod,DC=mydomain,DC=com
      #
      # The password for the search user
      #- LDAP_AUTHENTIFICATION_PASSWORD=pwd
      #- LDAP_AUTHENTIFICATION_PASSWORD_FILE=/run/secrets/ldap_auth_password
      #
      # Enable logs for the module
      #- LDAP_LOG_ENABLED=true
      #
      # If the sync of the users should be done in the background
      #- LDAP_BACKGROUND_SYNC=false
      #
      # LDAP_BACKGROUND_SYNC_INTERVAL : How often the background task syncs: milliseconds (3600000 = hourly) or text
      # Text is later.js text, quotes allowed, as specified in:
      # https://bunkat.github.io/later/parsers.html#text
      #- LDAP_BACKGROUND_SYNC_INTERVAL=every 1 hours
      # Unset or empty uses the default (hourly). A value it cannot read is logged
      # and the default is used; it no longer stops WeKan (#2354).
      # https://github.com/wekan/wekan/issues/2354#issuecomment-515305722
      - LDAP_BACKGROUND_SYNC_INTERVAL=''
      #
      #- LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false
      #
      #- LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false
      #
      # LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS : When true, the LDAP
      # background sync disables users no longer present in LDAP (and re-enables
      # them when they reappear).
      #- LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false
      #
      # If using LDAPS: LDAP_ENCRYPTION=ssl
      #- LDAP_ENCRYPTION=false
      #
      # The certification for the LDAPS server. Certificate needs to be included in this docker compose.yml file.
      #- LDAP_CA_CERT=-----BEGIN CERTIFICATE-----MIIE+G2FIdAgIC...-----END CERTIFICATE-----
      #
      # Reject Unauthorized Certificate
      #- LDAP_REJECT_UNAUTHORIZED=false
      #
      # Optional extra LDAP filters. Don't forget the outmost enclosing parentheses if needed
      #- LDAP_USER_SEARCH_FILTER=
      #
      # base (search only in the provided DN), one (search only in the provided DN and one level deep), or sub (search the whole subtree)
      #- LDAP_USER_SEARCH_SCOPE=one
      #
      # Which field is used to find the user, like uid / sAMAccountName
      #- LDAP_USER_SEARCH_FIELD=sAMAccountName
      #
      # Used for pagination (0=unlimited)
      #- LDAP_SEARCH_PAGE_SIZE=0
      #
      # The limit number of entries (0=unlimited)
      #- LDAP_SEARCH_SIZE_LIMIT=0
      #
      # Enable the login restriction group filter. Note the authenticated ldap user must be able to query all relevant group data with own login data from ldap.
      # When true, only members of LDAP_GROUP_FILTER_GROUP_NAME are allowed to log in.
      # NOTE: This flag ONLY controls the login restriction. Admin status sync
      # (LDAP_SYNC_ADMIN_STATUS / LDAP_SYNC_ADMIN_GROUPS) and group->role sync
      # (LDAP_SYNC_GROUP_ROLES) query LDAP groups independently and do NOT require
      # this flag to be true. The group filter metadata below
      # (LDAP_GROUP_FILTER_OBJECTCLASS, LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE,
      # LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT, LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE)
      # must still be configured for any group search to work.
      #- LDAP_GROUP_FILTER_ENABLE=false
      #
      # Where the GROUPS are, when they are not under LDAP_BASEDN. Leave this
      # unset when users and groups share one subtree: the group searches then
      # use LDAP_BASEDN, exactly as they always have. Set it when the directory
      # keeps them apart - ou=groups beside ou=people is a common layout - or
      # every group search runs under the USER base, finds nothing, and
      # LDAP_GROUP_FILTER_ENABLE=true refuses every login (wekan/wekan#5539).
      #- LDAP_GROUP_BASEDN=ou=groups,dc=example,dc=org
      #
      # The object class for filtering. Example: group
      #- LDAP_GROUP_FILTER_OBJECTCLASS=
      #
      # The attribute of a group identifying it. Example: cn
      #- LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE=
      #
      # The attribute inside a group object listing its members. Example: member
      #- LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE=
      #
      # The format of the value of LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE. Example: 'dn' if the users dn is saved as value into the attribute.
      #- LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT=
      #
      # Active Directory nested groups (#6744). When true, a user who is a member of
      # LDAP_GROUP_FILTER_GROUP_NAME through another group (team group -> access
      # group) is a member too: the group searches use AD's
      # LDAP_MATCHING_RULE_IN_CHAIN (1.2.840.113556.1.4.1941). Needs a DN-valued
      # member attribute (member, with LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT=dn).
      # Also applies to admin status, group->role and org/team sync. Default: false.
      #- LDAP_GROUP_FILTER_NESTED=true
      #
      # Let users moved from local password login to LDAP still log in with their old local password (true). Default: false
      #- LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN=
      #
      # Comma separated LDAP attributes to read for a user. Empty: all attributes. Example: uid,cn,mail
      #- LDAP_USER_ATTRIBUTES=
      #
      # The OIDC user info claim that holds the avatar URL. Default: picture
      #- OAUTH2_AVATAR_MAP=
      #
      # Update groups, admin status, e-mail, full name and username from the OIDC provider at every login (true). Default: false
      #- PROPAGATE_OIDC_DATA=
      #
      # Sign in with Apple: path to the private key (.p8) that signs the client secret JWT. Empty: OAUTH2_SECRET is used
      #- OAUTH2_SECRET_JWT_KEY_PATH=
      #
      # Sign in with Apple: the Team ID, issuer of the client secret JWT
      #- OAUTH2_SECRET_JWT_ISSUER=
      #
      # Sign in with Apple: the Key ID of the private key
      #- OAUTH2_SECRET_JWT_KEY_ID=
      #
      # Audience of the client secret JWT. Default: https://appleid.apple.com
      #- OAUTH2_SECRET_JWT_AUDIENCE=
      #
      # Subject of the client secret JWT. Default: OAUTH2_CLIENT_ID
      #- OAUTH2_SECRET_JWT_SUBJECT=
      #
      # Lifetime of the client secret JWT in seconds. Default: 300
      #- OAUTH2_SECRET_JWT_EXPIRES_IN=
      #
      # Let a CAS login take over an existing local account with the same username (true). Default: false
      #- CAS_MERGE_EXISTING_USERS=
      #
      # The group name (id) that matches all users.
      #- LDAP_GROUP_FILTER_GROUP_NAME=
      #
      # LDAP_UNIQUE_IDENTIFIER_FIELD : This field is sometimes class GUID (Globally Unique Identifier). Example: guid
      #- LDAP_UNIQUE_IDENTIFIER_FIELD=
      #
      # LDAP_UTF8_NAMES_SLUGIFY : Convert the username to utf8
      #- LDAP_UTF8_NAMES_SLUGIFY=true
      #
      # LDAP_USERNAME_FIELD : Which field contains the ldap username. username / sAMAccountName
      #- LDAP_USERNAME_FIELD=sAMAccountName
      #
      # LDAP_FULLNAME_FIELD : Which field contains the ldap fullname. fullname / sAMAccountName
      #- LDAP_FULLNAME_FIELD=fullname
      #
      #- LDAP_MERGE_EXISTING_USERS=false
      #
      # Allow existing account matching by e-mail address when username does not match
      #- LDAP_EMAIL_MATCH_ENABLE=true
      #
      # LDAP_EMAIL_MATCH_REQUIRE : require existing account matching by e-mail address when username does match
      #- LDAP_EMAIL_MATCH_REQUIRE=true
      #
      # LDAP_EMAIL_MATCH_VERIFIED : require existing account email address to be verified for matching
      #- LDAP_EMAIL_MATCH_VERIFIED=true
      #
      # LDAP_EMAIL_FIELD : which field contains the LDAP e-mail address
      #- LDAP_EMAIL_FIELD=mail
      #-----------------------------------------------------------------
      #- LDAP_SYNC_USER_DATA=false
      #
      #- LDAP_SYNC_USER_DATA_FIELDMAP={"cn":"name", "mail":"email"}
      #
      #- LDAP_SYNC_GROUP_ROLES=
      #
      # The default domain of the ldap it is used to create email if the field is not map correctly
      # with the LDAP_SYNC_USER_DATA_FIELDMAP is defined in setting LDAP_DEFAULT_DOMAIN above.
      #
      # Enable/Disable syncing of admin status based on ldap groups:
      # NOTE: Admin status sync and group->role sync (LDAP_SYNC_GROUP_ROLES) query
      # LDAP groups on their own. They no longer require LDAP_GROUP_FILTER_ENABLE=true,
      # which only controls the login restriction filter. The group filter metadata
      # (LDAP_GROUP_FILTER_OBJECTCLASS, LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE,
      # LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT, LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE)
      # must still be configured for the group search to work.
      #- LDAP_SYNC_ADMIN_STATUS=true
      #
      # Comma separated list of admin group names to sync.
      #- LDAP_SYNC_ADMIN_GROUPS=group1,group2
      #
      # When true, sync a user's LDAP groups as Wekan Organizations.
      #- LDAP_SYNC_ORGANIZATIONS=false
      #
      # Comma separated allowlist of LDAP group names/patterns to sync as Organizations.
      # Wildcards supported: * (any chars), ? (single char). Empty = all of the user's groups.
      #- LDAP_SYNC_ORGANIZATIONS_GROUPS=
      #
      # When true, sync a user's LDAP groups as Wekan Teams.
      #- LDAP_SYNC_TEAMS=false
      #
      # Comma separated allowlist of LDAP group names/patterns to sync as Teams.
      # Wildcards supported: * (any chars), ? (single char). Empty = all of the user's groups.
      #- LDAP_SYNC_TEAMS_GROUPS=
      #---------------------------------------------------------------------
      # Login to LDAP automatically with HTTP header.
      # In below example for siteminder, at right side of = is header name.
      #- HEADER_LOGIN_ID=HEADERUID
      #- HEADER_LOGIN_FIRSTNAME=HEADERFIRSTNAME
      #- HEADER_LOGIN_LASTNAME=HEADERLASTNAME
      #- HEADER_LOGIN_EMAIL=HEADEREMAILADDRESS
      # SECURITY (GHSA-jggc-qvfc-jr6x): comma-separated allowlist of source IPs
      # permitted to use header login. The source IP is the real TCP peer of the
      # connection (your reverse proxy), NOT the spoofable X-Forwarded-For header.
      # REQUIRED when header login is enabled: if empty/unset, header login fails
      # CLOSED and authenticates no one.
      #- HEADER_LOGIN_TRUSTED_IPS=127.0.0.1,10.0.0.2
      # Optional: if WeKan sits behind MULTIPLE proxy hops, list the intermediate
      # proxy IPs here. X-Forwarded-For is then honored ONLY when the immediate
      # TCP peer is one of these trusted proxies, and the right-most hop that is
      # not itself a trusted proxy (the real client) is matched against
      # HEADER_LOGIN_TRUSTED_IPS above.
      #- HEADER_LOGIN_TRUSTED_PROXIES=10.0.0.1,10.0.0.2
      #---------------------------------------------------------------------
      # ==== LOGOUT TIMER, probably does not work yet ====
      # LOGOUT_WITH_TIMER : Enables or not the option logout with timer
      # example : LOGOUT_WITH_TIMER=true
      #- LOGOUT_WITH_TIMER=
      #
      # LOGOUT_IN : The number of days
      # example : LOGOUT_IN=1
      #- LOGOUT_IN=
      #
      # LOGOUT_ON_HOURS : The number of hours
      # example : LOGOUT_ON_HOURS=9
      #- LOGOUT_ON_HOURS=
      #
      # LOGOUT_ON_MINUTES : The number of minutes
      # example : LOGOUT_ON_MINUTES=55
      #- LOGOUT_ON_MINUTES=
      #---------------------------------------------------------------
      # USERS_DISABLE_INACTIVE_AFTER_DAYS : once a night, disable accounts that
      # have not used WeKan for this many days (Admin Panel > People > Last
      # active). Admins are never disabled. Accounts with no recorded activity
      # yet are counted from the first run. Re-enabling an account restarts its
      # count. Unset or 0 = off (default). Admin Panel / People / Login can set
      # it too, and its value there wins.
      #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
      #---------------------------------------------------------------
      # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
      # local (filesystem) backups older than this many days; the newest is
      # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments
      # / Backup can set it too, and its value there wins. docs/Backup/Backup.md
      #- BACKUP_KEEP_DAYS=7
      #---------------------------------------------------------------
      # ACCOUNTS_COOKIE_REFRESH_RATE_LIMIT : Login-cookie refreshes allowed per
      # 10 seconds from one address (Meteor default 30); raise it behind a
      # reverse proxy that is not trusted for the client address. Admin Panel /
      # People / Login overrides it; applies from the next start.
      #- ACCOUNTS_COOKIE_REFRESH_RATE_LIMIT=100
      # INBOUND_IMAP_POLL_SECONDS : Email to card: how often IMAP mailboxes are
      # read, in seconds (default 60, at least 15).
      #- INBOUND_IMAP_POLL_SECONDS=60
      # INBOUND_EMAIL_PER_ADDRESS_PER_HOUR : Email to card: cards one sender
      # address can make per hour (default 60).
      #- INBOUND_EMAIL_PER_ADDRESS_PER_HOUR=60
      # INBOUND_EMAIL_WEBHOOK_SECRET : the secret the mail provider must send
      # with each webhook POST, if not set in the Admin Panel.
      #- INBOUND_EMAIL_WEBHOOK_SECRET=long-random-value
      # INBOUND_EMAIL_MAX_BYTES : Email to card: largest message in bytes
      # (default 31457280, 30 MB).
      #- INBOUND_EMAIL_MAX_BYTES=31457280
      # INBOUND_EMAIL_MAX_ATTACHMENT_BYTES : Email to card: largest attachment
      # in bytes (default 26214400, 25 MB).
      #- INBOUND_EMAIL_MAX_ATTACHMENT_BYTES=26214400
      # EMAIL_VIEW_SENDS_PER_HOUR : Emails one user can send from the email view
      # per hour (default 50).
      #- EMAIL_VIEW_SENDS_PER_HOUR=50
      # Admin Panel / People / Notification Settings / Email to card overrides the email ones.
      #---------------------------------------------------------------
      # Per server process, environment only:
      # INBOUND_IMAP_DISABLED : true stops THIS server process from reading IMAP
      # mailboxes - for a multi-pod deployment where one pod should read them.
      # Environment only: an Admin Panel value would be shared by every pod.
      #- INBOUND_IMAP_DISABLED=true
      # WEKAN_DISK_MONITOR : false turns off the disk-usage monitor of this
      # server (Admin Panel / Problems / Disk usage). Default on.
      #- WEKAN_DISK_MONITOR=false
      # WEKAN_DISK_WATCH_PATHS : Comma-separated paths on this server whose disk
      # usage is watched, instead of the data and files directories.
      #- WEKAN_DISK_WATCH_PATHS=/data,/var/lib/wekan
      # WEKAN_RAM_MONITOR : false turns off the memory monitor of this server
      # (Admin Panel / Problems / Memory usage). Default on.
      #- WEKAN_RAM_MONITOR=false
      # WEKAN_IMPORT_RUN_STALE_MS : Milliseconds after which an import with no
      # progress counts as interrupted and can be resumed or discarded (at least
      # 60000).
      #- WEKAN_IMPORT_RUN_STALE_MS=600000
      #---------------------------------------------------------------
      # ATTACHMENT RETENTION (models/lib/attachmentRetention.js). Off unless set.
      # ATTACHMENTS_RETENTION_DAYS : once a night, delete card attachments older
      # than this many days. A normal delete: restorable from the card history.
      #- ATTACHMENTS_RETENTION_DAYS=730
      # ATTACHMENTS_RETENTION_MODE : uploaded (default) = by upload date;
      # card-inactive = also only when the card has had no activity for as long.
      #- ATTACHMENTS_RETENTION_MODE=uploaded
      # ATTACHMENTS_PURGE_DELETED_AFTER_DAYS : remove for good, file included,
      # attachments deleted (by retention or by anyone) this many days ago.
      # Only this frees storage.
      #- ATTACHMENTS_PURGE_DELETED_AFTER_DAYS=30
      # ATTACHMENTS_RETENTION_DRY_RUN=true : only log what would happen.
      #- ATTACHMENTS_RETENTION_DRY_RUN=true
      # ATTACHMENTS_RETENTION_MAX_PER_RUN : per step per night (default 1000).
      #- ATTACHMENTS_RETENTION_MAX_PER_RUN=1000
      #-------------------------------------------------------------------
      # Hide password login form
      # - PASSWORD_LOGIN_ENABLED=true
      #-------------------------------------------------------------------
      #- CAS_ENABLED=true
      #- CAS_BASE_URL=https://cas.example.com/cas
      #- CAS_LOGIN_URL=https://cas.example.com/login
      #- CAS_VALIDATE_URL=https://cas.example.com/cas/p3/serviceValidate
      #---------------------------------------------------------------------
      # SAML 2.0 (SP-initiated) login, see docs/Features/Login-Page/SAML.md.
      # SAML_ENABLED : turn the "Sign In with SAML" login button on.
      #- SAML_ENABLED=true
      # SAML_PROVIDER : short name for the identity provider, used to build
      # the ACS/callback URL and shown in Meteor.settings.public.
      #- SAML_PROVIDER=
      # SAML_ENTRYPOINT : the identity provider's SSO redirect endpoint.
      #- SAML_ENTRYPOINT=
      # SAML_ISSUER : this WeKan instance's SAML issuer/entity ID.
      #- SAML_ISSUER=
      # SAML_CERT : the identity provider's signing certificate (PEM, no
      # header/footer needed), used to verify the SAML response signature.
      #- SAML_CERT=
      #- SAML_IDPSLO_REDIRECTURL=
      # SAML_PRIVATE_KEYFILE / SAML_PUBLIC_CERTFILE : optional, paths (under
      # private/) to this WeKan instance's own key/cert, only needed if the
      # identity provider requires signed AuthnRequests.
      #- SAML_PRIVATE_KEYFILE=
      #- SAML_PUBLIC_CERTFILE=
      # SAML_IDENTIFIER_FORMAT : NameID format requested from the IdP.
      # Defaults to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.
      #- SAML_IDENTIFIER_FORMAT=
      # SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE : assertion attribute whose value becomes
      # the WeKan username (e.g. username). Empty = the email / NameID. With
      # SAML_MERGE_EXISTING_USERS=true an existing account is found by that
      # username, or - when the value is the assertion's email - by a verified
      # email, so an LDAP account with its own short username can be linked.
      # Linking an existing account ALSO requires the assertion to carry the
      # attribute email_verified=true (SAML has no standard one: add it at the
      # IdP only if the IdP verifies addresses) and that email to be verified on
      # the local account. A refused link logs its reason in the server log.
      # docs/Features/Login-Page/SAML.md
      #- SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE=
      # SAML_ATTRIBUTES : not used by login at the moment; attributes are read
      # from the validated assertion as named (email, username, displayName).
      #- SAML_ATTRIBUTES=
      #- SAML_MERGE_EXISTING_USERS=false
      #- SAML_IDP_PROFILE=standard
      #- SAML_WANT_RESPONSE_SIGNED=
      #- SAML_WANT_ASSERTIONS_SIGNED=
      #- SAML_LOGIN_FLOW=
      #---------------------------------------------------------------------
      # Login with Meteor accounts providers, see docs/Features/Login-Page/OAuth-Providers.md
      # and docs/Features/Login-Page/Passwordless.md. Every one of these can be overridden
      # in Admin Panel / People / Login; a value set there wins over the environment
      # variable. Register this callback URL at the provider:
      #   <ROOT_URL>/_oauth/<service>  where service is google, github, facebook,
      #   twitter, meteor-developer, weibo or meetup.
      # ==== Google ==== create the app at https://console.cloud.google.com/apis/credentials
      # callback URL: <ROOT_URL>/_oauth/google
      #- OAUTH_GOOGLE_ENABLED=true
      #- OAUTH_GOOGLE_CLIENT_ID=
      #- OAUTH_GOOGLE_SECRET=
      # OAUTH_GOOGLE_SECRET_FILE : read the secret from a file (Docker secrets) instead
      #- OAUTH_GOOGLE_SECRET_FILE=/run/secrets/oauth_google_secret
      # ==== GitHub ==== create the app at https://github.com/settings/developers
      # callback URL: <ROOT_URL>/_oauth/github
      #- OAUTH_GITHUB_ENABLED=true
      #- OAUTH_GITHUB_CLIENT_ID=
      #- OAUTH_GITHUB_SECRET=
      # OAUTH_GITHUB_SECRET_FILE : read the secret from a file (Docker secrets) instead
      #- OAUTH_GITHUB_SECRET_FILE=/run/secrets/oauth_github_secret
      # ==== Facebook ==== create the app at https://developers.facebook.com/apps/
      # callback URL: <ROOT_URL>/_oauth/facebook
      #- OAUTH_FACEBOOK_ENABLED=true
      #- OAUTH_FACEBOOK_APP_ID=
      #- OAUTH_FACEBOOK_SECRET=
      # OAUTH_FACEBOOK_SECRET_FILE : read the secret from a file (Docker secrets) instead
      #- OAUTH_FACEBOOK_SECRET_FILE=/run/secrets/oauth_facebook_secret
      # ==== Twitter / X ==== create the app at https://developer.x.com/en/portal/dashboard
      # callback URL: <ROOT_URL>/_oauth/twitter
      #- OAUTH_TWITTER_ENABLED=true
      #- OAUTH_TWITTER_CONSUMER_KEY=
      #- OAUTH_TWITTER_SECRET=
      # OAUTH_TWITTER_SECRET_FILE : read the secret from a file (Docker secrets) instead
      #- OAUTH_TWITTER_SECRET_FILE=/run/secrets/oauth_twitter_secret
      # ==== Meteor Developer ==== create the app at https://www.meteor.com/
      # callback URL: <ROOT_URL>/_oauth/meteor-developer
      #- OAUTH_METEOR_DEVELOPER_ENABLED=true
      #- OAUTH_METEOR_DEVELOPER_CLIENT_ID=
      #- OAUTH_METEOR_DEVELOPER_SECRET=
      # OAUTH_METEOR_DEVELOPER_SECRET_FILE : read the secret from a file (Docker secrets) instead
      #- OAUTH_METEOR_DEVELOPER_SECRET_FILE=/run/secrets/oauth_meteor_developer_secret
      # ==== Weibo ==== create the app at https://open.weibo.com/
      # callback URL: <ROOT_URL>/_oauth/weibo
      #- OAUTH_WEIBO_ENABLED=true
      #- OAUTH_WEIBO_CLIENT_ID=
      #- OAUTH_WEIBO_SECRET=
      # OAUTH_WEIBO_SECRET_FILE : read the secret from a file (Docker secrets) instead
      #- OAUTH_WEIBO_SECRET_FILE=/run/secrets/oauth_weibo_secret
      # ==== Meetup ==== create the app at https://www.meetup.com/api/oauth/list/
      # callback URL: <ROOT_URL>/_oauth/meetup
      #- OAUTH_MEETUP_ENABLED=true
      #- OAUTH_MEETUP_CLIENT_ID=
      #- OAUTH_MEETUP_SECRET=
      # OAUTH_MEETUP_SECRET_FILE : read the secret from a file (Docker secrets) instead
      #- OAUTH_MEETUP_SECRET_FILE=/run/secrets/oauth_meetup_secret
      # OAUTH_PROVIDERS_LOGIN_STYLE : redirect or popup, for all providers above. Default: redirect
      #- OAUTH_PROVIDERS_LOGIN_STYLE=redirect
      # OAUTH_PROVIDERS_MERGE_EXISTING_USERS : link a provider login to an existing WeKan
      # account with the same email. Default: false = the login is refused, not merged,
      # like OAUTH2_MERGE_EXISTING_USERS. Enable only if you trust the provider's emails.
      #- OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false
      # OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS : only these email domains may sign in with
      # the providers above, comma separated, like OAUTH2_ALLOWED_EMAIL_DOMAINS. Empty: all.
      #- OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS=example.com
      # PASSWORDLESS_ENABLED : email a one-time sign-in code instead of asking a
      # password. Needs MAIL_URL. Also switchable in Admin Panel / People / Login.
      #- PASSWORDLESS_ENABLED=true
      #---------------------------------------------------------------------
      # Wait spinner to use
      # - WAIT_SPINNER=Bounce
      #---------------------------------------------------------------------
    # Wait for MongoDB to be healthy (replica-set primary elected) before
    # starting WeKan, so index creation does not crash with "Topology is closed".
    # If you use FerretDB instead, comment out the wekandb block below and
    # uncomment the wekan-ferretdb block.
    depends_on:
      ferretdb:
        condition: service_healthy
    #  wekan-migrate:
    #    condition: service_completed_successfully
    #  wekan-ferretdb:
    #    condition: service_healthy
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - wekan-files:/data:rw

volumes:
  wekan-files:
    driver: local
  ferretdb-data:
    driver: local

networks:
  wekan-tier:
    driver: bridge