cloudkey.env.example

# Example /etc/cloudkey.env for the cloudkey systemd service.
# Copy the flags you want, uncomment, and adjust the values below.
# See README.md#configuration for the full flag/env-var reference.

# Stealth mode — start with the front panel dark: no LEDs, no screens. A brief
# reset-button tap (roughly a tenth to half a second) toggles it while running;
# engaging shows a "Stealth Mode / ENGAGED" banner for 5 seconds first. A longer
# hold lands in a different press band and does nothing. The runtime flip is not
# persisted, so a restart returns to the value set here. The web dashboard and
# its /events stream keep running while the panel is dark.
# CLOUDKEY_STEALTH_MODE=true

# autossh — shows one row per configured tunnel (tunnel2 is optional).
# The service is the systemd unit that runs that tunnel; cloudkey checks
# `systemctl is-active <unit>`. CAVEAT: this only proves the autossh/ssh
# process is still running, not that the tunnel is passing traffic — a -R
# (remote) forward binds no local port cloudkey could probe instead, and
# without a -M monitor port there's no better local signal available.
# Set ServerAliveInterval/ServerAliveCountMax in the tunnel's ssh config so
# a genuinely dead connection makes the process exit (and the unit go
# inactive) instead of hanging open and showing as falsely "up".
# CLOUDKEY_AUTOSSH_TUNNEL1_NAME=primary
# CLOUDKEY_AUTOSSH_TUNNEL1_SERVICE=autossh-tunnel1
# CLOUDKEY_AUTOSSH_TUNNEL2_NAME=backup
# CLOUDKEY_AUTOSSH_TUNNEL2_SERVICE=autossh-tunnel2

# WireGuard — requires the `wg` CLI (wireguard-tools) on PATH, or set
# CLOUDKEY_WG_CMD below to point at it directly. cloudkey checks this at
# startup and exits with an error if the binary can't be found while
# CLOUDKEY_WIREGUARD_IFACE is set — a missing dependency is a config error,
# not something to silently show as "disconnected".
# CLOUDKEY_WIREGUARD_NAME=WireGuard
# CLOUDKEY_WIREGUARD_IFACE=wg0
# CLOUDKEY_WG_CMD=/usr/bin/wg

# Tailscale — requires the `tailscale` CLI on PATH, or set
# CLOUDKEY_TAILSCALE_CMD below to point at it directly. Same startup check
# as WireGuard above applies when CLOUDKEY_TAILSCALE is enabled.
# CLOUDKEY_TAILSCALE=true
# CLOUDKEY_TAILSCALE_NAME=TailScale
# CLOUDKEY_TAILSCALE_CMD=/usr/bin/tailscale

# Web dashboard + SSE API — off by default. Set CLOUDKEY_HTTP_PORT to a port to
# serve the dashboard (website/ files) and its live /events stream. The same
# collector timers that drive the OLED also push updates to the browser.
# Binding port 80 needs root or `setcap cap_net_bind_service=+ep` on the binary;
# any high port (e.g. 8080) works without extra privileges.
# CLOUDKEY_HTTP_PORT=80
# CLOUDKEY_WEB_ROOT=/usr/share/cloudkey/website

# Applications — any number of local entries, comma-separated. Each is
# "name:port". An app is reported up when something on this box is LISTENing on
# that port, read from the kernel's TCP tables. Every network namespace is
# scanned, not just the root one, so apps confined to a VPN split-tunnel netns
# (e.g. mullvad) or a container are seen rather than reported permanently down.
# Dashboard links use the dashboard's current scheme/hostname with only the port
# changed — so an app in a namespace that does not expose the port to the LAN
# shows up but will not be reachable through the link. Names may not contain
# ':' or ','.
# CLOUDKEY_APPS=Grafana:3000,Sonarr:8989,Radarr:7878