# ──────────────────────────────────────────────────────────────────────────────
# MISP Environment Template - Full configuration options.
#
# Copy this file to env_file_misp and customize as needed:
#   cp docker/env_file_misp_template docker/env_file_misp
#
# Only the uncommented values are required for basic operation.
# All commented values show defaults from the upstream misp-docker project.
# Reference: https://github.com/MISP/misp-docker/blob/main/template.env
# ──────────────────────────────────────────────────────────────────────────────

##
# Admin Settings
##

# Email/username for user #1, defaults to MISP's default (admin@admin.test)
ADMIN_EMAIL=admin@admin.test
# defaults to MISP's default (admin)
ADMIN_PASSWORD=admin
# name of org #1
ADMIN_ORG=IntelOwl
# uuid of org #1, defaults to an automatically generated one
# ADMIN_ORG_UUID=
# API key for the MISP admin user.
# This key is used to authenticate IntelOwl's MISP connector.
# MISP 2.5+ uses advanced authkeys - the CLI getAuthkey command won't work.
# Set a known key here so IntelOwl can connect out of the box.
# Change this in production!
ADMIN_KEY=mispdefaultintelowladminapikeychgme01234
# Prevent MISP from printing ADMIN_KEY and ADMIN_PASSWORD in plaintext logs
# DISABLE_PRINTING_PLAINTEXT_CREDENTIALS=true
# defaults to 'passphrase'
# GPG_PASSPHRASE=

##
# Database (must match misp-db service in misp.override.yml)
##

MYSQL_HOST=misp-db
MYSQL_PORT=3306
MYSQL_USER=misp
MYSQL_PASSWORD=misp_password
MYSQL_DATABASE=misp

# MySQL TLS settings
# MYSQL_TLS=false
# MYSQL_TLS_CA=
# MYSQL_TLS_CERT=
# MYSQL_TLS_KEY=

##
# Redis (must match misp-redis service in misp.override.yml)
##

REDIS_HOST=misp-redis
REDIS_PORT=6379
REDIS_PASSWORD=misp_redis_password
# ENABLE_REDIS_EMPTY_PASSWORD=false

##
# Core Settings
##

# Base URL - internal Docker hostname
BASE_URL=https://misp-core

# Disable SSL redirect - IntelOwl connects via internal Docker network
DISABLE_SSL_REDIRECT=true

# defaults to 1 (the admin user)
# CRON_USER_ID=
# store settings in db. true/false, defaults to false
# ENABLE_DB_SETTINGS=
# encryption key. defaults to empty string
# ENCRYPTION_KEY=
# salt, autogenerated if blank
# SALT=
# instance uuid, autogenerated if blank
# UUID=
# enable background updates. defaults to false
# ENABLE_BACKGROUND_UPDATES=
# custom attachments directory. defaults to /var/www/MISP/app/files
# ATTACHMENTS_DIR=
# enable UI themes
# ENABLE_THEMES=false

# Disable IPv6 completely
# DISABLE_IPV6=true
# Disable CA refresh
# DISABLE_CA_REFRESH=true

# Timezone (UTC, Europe/Berlin etc.). Default is UTC.
# TZ=UTC

##
# Synchronization
##

# Daily synchronization frequency (in seconds)
# CRON_PULLALL=86400
# CRON_PUSHALL=86400
# FETCH_FEED_INTERVAL=86400
# CACHE_FEED_INTERVAL=86400

# Sync servers (comma separated IDs, e.g. SYNCSERVERS=1)
# SYNCSERVERS=
# SYNCSERVERS_1_URL=
# SYNCSERVERS_1_NAME=
# SYNCSERVERS_1_UUID=
# SYNCSERVERS_1_KEY=
# SYNCSERVERS_1_PULL_RULES=

##
# SMTP / Mail
##

# SMTP_FQDN=
# SMTP_PORT=25
# SMARTHOST_ADDRESS=
# SMARTHOST_PORT=
# SMARTHOST_USER=
# SMARTHOST_PASSWORD=
# SMARTHOST_ALIASES=

##
# PHP Settings
##

# PHP_MEMORY_LIMIT=2048M
# PHP_MAX_EXECUTION_TIME=300
# PHP_UPLOAD_MAX_FILESIZE=50M
# PHP_POST_MAX_SIZE=50M
# PHP_MAX_INPUT_TIME=300
# PHP_MAX_FILE_UPLOADS=50

# PHP FPM pool
# PHP_FCGI_CHILDREN=5
# PHP_FCGI_START_SERVERS=2
# PHP_FCGI_SPARE_SERVERS=1
# PHP_FCGI_MAX_REQUESTS=0

# PHP Session
# PHP_SESSION_TIMEOUT=60
# PHP_SESSION_COOKIE_TIMEOUT=10080
# PHP_SESSION_DEFAULTS=php
# PHP_SESSION_AUTO_REGENERATE=false
# PHP_SESSION_CHECK_AGENT=false
# PHP_SESSION_COOKIE_SECURE=true
# PHP_SESSION_COOKIE_DOMAIN=
# PHP_SESSION_COOKIE_SAMESITE=Lax

##
# Nginx / FastCGI
##

# NGINX_X_FORWARDED_FOR=false
# NGINX_SET_REAL_IP_FROM=127.0.0.1
# NGINX_CLIENT_MAX_BODY_SIZE=50M
# FASTCGI_READ_TIMEOUT=300s
# FASTCGI_SEND_TIMEOUT=300s
# FASTCGI_CONNECT_TIMEOUT=300s
# FASTCGI_STATUS_LISTEN=

##
# Security
##

# HSTS_MAX_AGE=
# X_FRAME_OPTIONS=
# CONTENT_SECURITY_POLICY=

##
# Proxy
##

# PROXY_ENABLE=false
# PROXY_HOST=
# PROXY_PORT=
# PROXY_METHOD=
# PROXY_USER=
# PROXY_PASSWORD=

##
# S3 Attachment Storage
##

# S3_BUCKET=
# S3_ENDPOINT=
# S3_ACCESS_KEY=
# S3_SECRET_KEY=

##
# OIDC Authentication
# Ref: https://github.com/MISP/MISP/blob/2.5/app/Plugin/OidcAuth/README.md
##

# OIDC_ENABLE=false
# OIDC_PROVIDER_URL=
# OIDC_ISSUER=
# OIDC_CLIENT_ID=
# OIDC_CLIENT_SECRET=
# OIDC_CODE_CHALLENGE_METHOD=S256
# OIDC_ROLES_PROPERTY=roles
# OIDC_ROLES_MAPPING=
# OIDC_DEFAULT_ORG=
# OIDC_MIXEDAUTH=true
# OIDC_LOGIN_TEXT=Login with OIDC
# OIDC_AUTH_METHOD=client_secret_post
# OIDC_REDIRECT_URI=
# OIDC_SCOPES=
# OIDC_LOGOUT_URL=
# OIDC_DISABLE_REQUEST_OBJECT=false
# OIDC_DISABLE_PUSHED_AUTHORIZATION_REQUEST=false
# OIDC_SKIP_PROXY=true
# OIDC_ALLOW_EMAIL_LINKING=false
# OIDC_REQUIRE_EMAIL_VERIFIED=true

##
# LDAP Authentication (ApacheSecureAuth)
# Ref: https://github.com/MISP/MISP/issues/6189
##

# APACHESECUREAUTH_LDAP_ENABLE=false
# APACHESECUREAUTH_LDAP_APACHE_ENV=REMOTE_USER
# APACHESECUREAUTH_LDAP_SERVER=
# APACHESECUREAUTH_LDAP_STARTTLS=true
# APACHESECUREAUTH_LDAP_READER_USER=
# APACHESECUREAUTH_LDAP_READER_PASSWORD=
# APACHESECUREAUTH_LDAP_DN=
# APACHESECUREAUTH_LDAP_SEARCH_FILTER=
# APACHESECUREAUTH_LDAP_SEARCH_ATTRIBUTE=uid
# APACHESECUREAUTH_LDAP_FILTER=
# APACHESECUREAUTH_LDAP_DEFAULT_ROLE_ID=3
# APACHESECUREAUTH_LDAP_DEFAULT_ORG=1
# APACHESECUREAUTH_LDAP_EMAIL_FIELD=
# APACHESECUREAUTH_LDAP_OPT_PROTOCOL_VERSION=3
# APACHESECUREAUTH_LDAP_OPT_NETWORK_TIMEOUT=-1
# APACHESECUREAUTH_LDAP_OPT_REFERRALS=false

##
# LDAP Authentication (native MISP plugin)
# Ref: https://github.com/MISP/MISP/tree/2.5/app/Plugin/LdapAuth
##

# LDAPAUTH_ENABLE=false
# LDAPAUTH_LDAPSERVER=
# LDAPAUTH_LDAPDN=
# LDAPAUTH_LDAPREADERUSER=
# LDAPAUTH_LDAPREADERPASSWORD=
# LDAPAUTH_LDAPSEARCHFILTER=
# LDAPAUTH_LDAPSEARCHATTRIBUTE=mail
# LDAPAUTH_LDAPEMAILFIELD=mail
# LDAPAUTH_LDAPNETWORKTIMEOUT=-1
# LDAPAUTH_LDAPPROTOCOL=3
# LDAPAUTH_LDAPALLOWREFERRALS=true
# LDAPAUTH_STARTTLS=false
# LDAPAUTH_MIXEDAUTH=true
# LDAPAUTH_LDAPDEFAULTORGID=1
# LDAPAUTH_LDAPDEFAULTROLEID=3
# LDAPAUTH_UPDATEUSER=true
# LDAPAUTH_DEBUG=false

##
# Azure AD (Entra) Authentication
# Ref: https://github.com/MISP/MISP/blob/2.4/app/Plugin/AadAuth/README.md
##

# AAD_ENABLE=false
# AAD_CLIENT_ID=
# AAD_TENANT_ID=
# AAD_CLIENT_SECRET=
# AAD_REDIRECT_URI=
# AAD_PROVIDER=https://login.microsoftonline.com/
# AAD_PROVIDER_USER=https://graph.microsoft.com/
# AAD_MISP_USER=
# AAD_MISP_ORGADMIN=
# AAD_MISP_SITEADMIN=
# AAD_CHECK_GROUPS=false

##
# Custom Auth Plugin
##

# CUSTOM_AUTH_ENABLE=false
# CUSTOM_AUTH_HEADER=X_CUSTOM_AUTH
# CUSTOM_AUTH_USE_HEADER_NAMESPACE=true
# CUSTOM_AUTH_REQUIRED=false
# CUSTOM_AUTH_HEADER_NAMESPACE=HTTP_
# CUSTOM_AUTH_ONLY_ALLOW_SOURCE=
# CUSTOM_AUTH_NAME=External Authentication
# CUSTOM_AUTH_DISABLE_LOGOUT=false
# CUSTOM_AUTH_CUSTOM_PASSWORD_RESET=
# CUSTOM_AUTH_CUSTOM_LOGOUT=

##
# Supervisor (external)
##

# SUPERVISOR_HOST=
# SUPERVISOR_USERNAME=
# SUPERVISOR_PASSWORD=

##
# Stunnel
##

# STUNNEL=false
# STUNNEL_CONFIG=

##
# Debugging
# ALWAYS SET TO 0 IN PRODUCTION
# 0 = off (default), 1 = on, 2 = on + SQL dump
##

# DEBUG=0
