.env.example

# Domain & email used by certbot to issue/renew Let's Encrypt certificates.
DOMAIN=example.com
EMAIL=you@example.com

# Proxy credentials (leave empty to disable Basic auth).
PROXY_USERNAME=
PROXY_PASSWORD=

# Optional: chain through an upstream proxy.
# PROXY_UPSTREAM_PROXY=https://user:pass@upstream-proxy:8080
# Set PROXY_UPSTREAM_PROXY=direct to ignore HTTP_PROXY, HTTPS_PROXY, and NO_PROXY.

# Outbound address family: auto, tcp4, or tcp6.
PROXY_NETWORK=auto

# DANGEROUS: temporarily log full URLs, upstream errors, and rejected credentials.
PROXY_LOG_SENSITIVE_DATA=false

# Resource limits.
PROXY_MAX_CONNECTIONS=1024
PROXY_MAX_CONNECTIONS_PER_IP=64
PROXY_MAX_TUNNELS=256
PROXY_MAX_TUNNELS_PER_IP=16
PROXY_MAX_IDLE_CONNS=100
PROXY_MAX_IDLE_CONNS_PER_HOST=10
PROXY_MAX_HEADER_BYTES=65536
PROXY_TUNNEL_IDLE_TIMEOUT=10m

# Failed Basic Auth attempts are counted per client IP.
PROXY_AUTH_MAX_FAILURES=10
PROXY_AUTH_FAILURE_WINDOW=1m
PROXY_AUTH_BLOCK_DURATION=5m

# Destination policy. Set true only when access to local/private networks is required.
PROXY_ALLOW_PRIVATE_DESTINATIONS=false
# Set to "none" to allow every destination port.
# PROXY_BLOCKED_DESTINATION_PORTS=21,22,23,25,110,111,135,137,138,139,445,1433,2049,2375,2376,3306,3389,5432,5900,6379,9200,11211,27017

# Optional timeout overrides (Go duration syntax: 500ms, 10s, 2m).
# PROXY_DIAL_TIMEOUT=10s
# PROXY_TLS_HANDSHAKE_TIMEOUT=10s
# PROXY_TLS_RELOAD_INTERVAL=1m
# PROXY_RESPONSE_HEADER_TIMEOUT=30s
# PROXY_IDLE_CONN_TIMEOUT=90s
# PROXY_READ_HEADER_TIMEOUT=15s
# PROXY_IDLE_TIMEOUT=2m
# PROXY_SHUTDOWN_TIMEOUT=15s