server/example.env at main · Gryt-chat/server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
# WebSocket Voice Chat Server Configuration
# Copy this file to .env and fill in your actual values

# Port clients connect to (optional, defaults to 5000)
# PORT=5000

# Your secure SFU host (WebRTC signaling server)
SFU_WS_HOST="wss://your-sfu-server.com"

# Comma separated list of STUN servers for WebRTC
STUN_SERVERS="stun:stun.l.google.com:19302,stun:stun1.l.google.com:19302"

# Voice capacity ("seats")
# If VOICE_MAX_USERS is not set, the server derives seats from SFU_UDP_PORT_MIN/MAX (max-min+1)
# VOICE_MAX_USERS=200
SFU_UDP_PORT_MIN=10000
SFU_UDP_PORT_MAX=10019

# Display name for the server (optional)
# SERVER_NAME="My Voice Server"

# Websocket allowed origins (use "*" for development, specific domains for production)
# Always include https://app.gryt.chat to allow the hosted web client to connect.
# Include http://127.0.0.1:15738 to allow the Electron desktop app.
CORS_ORIGIN="http://127.0.0.1:15738,https://app.gryt.chat"

# Server-to-SFU shared secret (NOT a user join password). Optional.
# Leave empty unless you need to restrict SFU registrations.
# SERVER_PASSWORD="your-internal-sfu-shared-secret"

# Invite brute-force protection (optional)
# Two-tier: per (IP + user) and per IP. Cooldowns escalate exponentially
# on repeated lockouts (base × 2^(n-1)), capped at MAX_COOLDOWN.
# SERVER_INVITE_MAX_RETRIES=8            # per (IP+user) invalid invites before lockout
# SERVER_INVITE_RETRY_WINDOW_MS=300000   # sliding window for attempt counting (5 min)
# SERVER_INVITE_RETRY_COOLDOWN_MS=60000  # base cooldown after lockout (1 min)
# SERVER_INVITE_MAX_COOLDOWN_MS=3600000  # escalation cap (1 hour)
# SERVER_INVITE_IP_MAX_RETRIES=20        # per-IP invalid invites (across all users) before lockout

# JWT secret for signing access tokens (REQUIRED in production)
# Generate with: openssl rand -base64 48
JWT_SECRET=change-me-in-production

# Refresh token lifetime in days (default: 7)
# REFRESH_TOKEN_TTL_DAYS=7

# Gryt central authentication (Keycloak / OIDC)
# - required: users must sign in with a Gryt account to join (default)
# - disabled: nobody can join (opt-out mode)
# GRYT_AUTH_MODE=required

# All URLs below default to the official Gryt services.
# Only override these if you run your own auth infrastructure.
# GRYT_OIDC_ISSUER=https://auth.gryt.chat/realms/gryt
# GRYT_OIDC_AUDIENCE=gryt-web
# GRYT_IDENTITY_JWKS_URL=https://id.gryt.chat/.well-known/jwks.json

# Database (SQLite, stored in DATA_DIR)
DATA_DIR=./data

# Unique instance ID (used in multi-instance setups to distinguish servers)
# SERVER_INSTANCE_ID=default

# S3 / Object storage (AWS S3, Cloudflare R2, Wasabi, MinIO)
S3_REGION=auto
S3_ENDPOINT=https://your-s3-endpoint.com
S3_ACCESS_KEY_ID=your_s3_access_key
S3_SECRET_ACCESS_KEY=your_s3_secret_key
S3_BUCKET=your-bucket-name
S3_FORCE_PATH_STYLE=true

# Additional channels configuration (JSON array of channel objects)
ADDITIONAL_CHANNELS=[{"name":"Announcements","type":"text","id":"announcements","description":"Server announcements and important updates"}]

# Example additional channels:
# ADDITIONAL_CHANNELS=[
#   {"name":"General","type":"text","id":"general","description":"General discussion"},
#   {"name":"Voice Chat","type":"voice","id":"voice","description":"Main voice channel"},
#   {"name":"Announcements","type":"text","id":"announcements","description":"Server announcements"}
# ]

# Join is invite-only once an owner exists. Create invites from the client under Server settings → Invites.