env.template

ROMM_BASE_PATH=/path/to/romm_mock
ROMM_TMP_PATH=
KIOSK_MODE=false

# Netplay SFU (reverse-proxied by the RomM container)
# Preferred: SFU_HOST / SFU_PORT
# Backwards-compatible: EMULATORJS_SFU_HOST / EMULATORJS_SFU_PORT
SFU_HOST=localhost
SFU_PORT=3001

# EmulatorJS bundle: EJS_SFU_NETPLAY_ENABLED=false → OG EmulatorJS (cdn.emulatorjs.org, supports P2P netplay when config emulatorjs.netplay.enabled=true);
# EJS_SFU_NETPLAY_ENABLED=true → EmulatorJS-SFU (jsDelivr, SFU-based netplay). Overrides config.yml emulatorjs.netplay.ejs_sfu_enabled.
# EJS_SFU_NETPLAY_ENABLED=

# IGDB credentials
IGDB_CLIENT_ID=
IGDB_CLIENT_SECRET=

# Mobygames
MOBYGAMES_API_KEY=

# Screenscraper
SCREENSCRAPER_USER=
SCREENSCRAPER_PASSWORD=

# SteamGridDB
STEAMGRIDDB_API_KEY=

# RetroAchievements
RETROACHIEVEMENTS_API_KEY=

# Playmatch
PLAYMATCH_API_ENABLED=

# LaunchBox
LAUNCHBOX_API_ENABLED=

# Hasheous
HASHEOUS_API_ENABLED=

# Flashpoint Project
FLASHPOINT_API_ENABLED=

# HowLongToBeat
HLTB_API_ENABLED=

# TheGamesDB
TGDB_API_ENABLED=

# Database config
ROMM_DB_DRIVER=mariadb
DB_HOST=127.0.0.1
DB_PORT=3306
DB_NAME=romm
DB_USER=romm
DB_PASSWD=
DB_ROOT_PASSWD=

# Redis / Valkey config (used by RomM backend + workers)
#
# Netplay/SFU deployments no longer require SFU nodes to connect to Redis/Valkey.
# SFU nodes call RomM internal HTTP APIs for token verification and room metadata.
#
# If REDIS_HOST is empty and you're running the all-in-one container image, RomM
# starts an internal Valkey bound to 127.0.0.1 in protected mode and sets
# REDIS_PASSWORD to ROMM_AUTH_SECRET_KEY automatically.
REDIS_HOST=127.0.0.1
REDIS_PORT=6379
REDIS_USERNAME=
REDIS_PASSWORD=
REDIS_DB=0
REDIS_SSL=false

# Internal Valkey (only when running the all-in-one RomM container)
#
# By default, if REDIS_HOST is empty, the container starts an internal Valkey
# bound to 127.0.0.1 (loopback-only) in protected mode.
#
# To allow other containers (like EmulatorJS-SFU) to connect to RomM's internal
# Valkey over the Docker network, opt-in to exposing it AND enable ACL.
ROMM_INTERNAL_VALKEY_EXPOSE=false
ROMM_INTERNAL_VALKEY_ENABLE_ACL=
# Optional overrides
ROMM_INTERNAL_VALKEY_BIND=
ROMM_INTERNAL_VALKEY_PROTECTED_MODE=
ROMM_INTERNAL_VALKEY_DATA_DIR=/redis-data
ROMM_INTERNAL_VALKEY_ACL_FILE=

# ACL passwords (recommended for Netplay/SFU)
# - VALKEY_SFU_PASSWORD is the password for the SFU Redis user (usually `sfu`) and must be set.
# - VALKEY_ROMM_PASSWORD is optional. If omitted, RomM's internal Valkey ACL generation will
#   fall back to `ROMM_AUTH_SECRET_KEY` as the `romm` user's password.
#
# Security note: using the same value for JWT signing and Redis auth couples trust domains.
# For best security, use a dedicated Redis password and set it via REDIS_PASSWORD/VALKEY_ROMM_PASSWORD.
VALKEY_ROMM_PASSWORD=
VALKEY_SFU_PASSWORD=

# Authentik
POSTGRES_DB=authentik
POSTGRES_USER=authentik
POSTGRES_PASSWORD=authentik
AUTHENTIK_SECRET_KEY=
AUTHENTIK_BOOTSTRAP_PASSWORD=

# Authentication
ROMM_AUTH_SECRET_KEY=

# SFU internal API auth (recommended)
# Dedicated shared secret used by SFU nodes to call RomM internal SFU endpoints.
ROMM_SFU_INTERNAL_SECRET=
# Disable auth on download endpoint for 3rd party support
DISABLE_DOWNLOAD_ENDPOINT_AUTH=
# Disable CSRF protection for development and testing purposes
DISABLE_CSRF_PROTECTION=
# Disable username + passsword login when using OIDC login
DISABLE_USERPASS_LOGIN=
DISABLE_SETUP_WIZARD=
INVITE_TOKEN_EXPIRY_SECONDS=600

# OpenID Connect (Authentik, Authelia, etc.)
OIDC_ENABLED=
OIDC_AUTOLOGIN=
OIDC_PROVIDER=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_REDIRECT_URI=
OIDC_SERVER_APPLICATION_URL=
OIDC_SERVER_METADATA_URL=
OIDC_CLAIM_ROLES=
OIDC_ROLE_VIEWER=
OIDC_ROLE_EDITOR=
OIDC_ROLE_ADMIN=
OIDC_TLS_CACERTFILE=
OIDC_USERNAME_ATTRIBUTE=preferred_username
OIDC_RP_INITIATED_LOGOUT=
OIDC_END_SESSION_ENDPOINT=

# Filesystem watcher (optional)
ENABLE_RESCAN_ON_FILESYSTEM_CHANGE=true
RESCAN_ON_FILESYSTEM_CHANGE_DELAY=5

# Tasks (optional)
TASK_TIMEOUT=300
TASK_RESULT_TTL=86400
SEVEN_ZIP_TIMEOUT=60
ENABLE_SCHEDULED_RESCAN=true
SCHEDULED_RESCAN_CRON=0 3 * * *
ENABLE_SCHEDULED_UPDATE_SWITCH_TITLEDB=true
SCHEDULED_UPDATE_SWITCH_TITLEDB_CRON=0 4 * * *
ENABLE_SCHEDULED_UPDATE_LAUNCHBOX_METADATA=true
SCHEDULED_UPDATE_LAUNCHBOX_METADATA_CRON=0 4 * * *
ENABLE_SCHEDULED_CONVERT_IMAGES_TO_WEBP=true
SCHEDULED_CONVERT_IMAGES_TO_WEBP_CRON=0 4 * * *
ENABLE_SCHEDULED_RETROACHIEVEMENTS_PROGRESS_SYNC=true
SCHEDULED_RETROACHIEVEMENTS_PROGRESS_SYNC_CRON=0 4 * * *
REFRESH_RETROACHIEVEMENTS_CACHE_DAYS=30

# In-browser emulation
DISABLE_EMULATOR_JS=false
DISABLE_RUFFLE_RS=false

# YouTube alternatives (Piped, Invidious, etc.)
YOUTUBE_BASE_URL=https://www.youtube.com

# Switch Tinfoil
TINFOIL_WELCOME_MESSAGE="RomM Switch Library"

# Logging
LOGLEVEL=DEBUG
FORCE_COLOR=
NO_COLOR=

# Web server (optional)
# Workers -> (2 × CPU cores) + 1
WEB_SERVER_CONCURRENCY=2
WEB_SERVER_TIMEOUT=300
WEB_SERVER_KEEPALIVE=2
WEB_SERVER_MAX_REQUESTS=1000
WEB_SERVER_MAX_REQUESTS_JITTER=100
WEB_SERVER_WORKER_CONNECTIONS=1000
WEB_SERVER_GUNICORN_WAIT_SECONDS=30
IPV4_ONLY=false

# Redis Workers
SCAN_TIMEOUT=
SCAN_WORKERS=

# Development only
DEV_MODE=true
DEV_HOST=127.0.0.1
DEV_PORT=5000
DEV_HTTPS=false
DEV_SQL_ECHO=false
SENTRY_DSN=