newznab-tmux/.env.example

DB_CONNECTION=mariadb
DB_HOST=127.0.0.1
DB_PORT=3306
DB_ROOTPASSWORD=  #only needed for install.sh for docker based installation
DB_SOCKET=
DB_USERNAME=
DB_PASSWORD=
DB_DATABASE=nntmux

COMPOSER_AUTH='{"github-oauth": {"github.com": "YOUR GITHUB TOKEN"}}'

SEARCH_DRIVER=manticore
# Increment after rebuilding search indexes to invalidate API v2 cursors.
SEARCH_INDEX_GENERATION=1
# Lifetime of signed API v2 search cursors.
SEARCH_CURSOR_TTL_MINUTES=15

# ManticoreSearch Configuration
MANTICORESEARCH_HOST=localhost
MANTICORESEARCH_PORT=9308
# Use http by default. Set https when Manticore HTTP(S) is served over TLS.
MANTICORESEARCH_SCHEME=http
# Optional for Manticore 27.x built-in auth/authz. Leave blank for anonymous local Docker.
MANTICORESEARCH_USERNAME=
MANTICORESEARCH_PASSWORD=
# Optional bearer token auth. If set, this takes precedence over username/password for HTTP clients.
MANTICORESEARCH_TOKEN=
# fuzzy search settings
MANTICORESEARCH_FUZZY_ENABLED=false
# For high availability, set multiple hosts (comma-separated): "host1:9308,host2:9308"
MANTICORESEARCH_HOSTS=
MANTICORESEARCH_RETRIES=2
MANTICORESEARCH_RETRY_ATTEMPTS=2
MANTICORESEARCH_RETRY_DELAY_MS=100
# Autocomplete settings
MANTICORESEARCH_AUTOCOMPLETE_ENABLED=true
MANTICORESEARCH_AUTOCOMPLETE_MIN_LENGTH=2
MANTICORESEARCH_AUTOCOMPLETE_MAX_RESULTS=10
MANTICORESEARCH_AUTOCOMPLETE_FUZZINESS=1
MANTICORESEARCH_AUTOCOMPLETE_CACHE=10
# Suggest/spell correction settings
MANTICORESEARCH_SUGGEST_ENABLED=true
MANTICORESEARCH_SUGGEST_MAX_EDITS=4

ELASTICSEARCH_HOST=localhost
ELASTICSEARCH_PORT=9200
ELASTICSEARCH_SCHEME=http
ELASTICSEARCH_USER=
ELASTICSEARCH_PASS=
ELASTICSEARCH_LOGGING=false
#fuzzy search settings
ELASTICSEARCH_FUZZY_ENABLED=false
# Elasticsearch autocomplete settings
ELASTICSEARCH_AUTOCOMPLETE_ENABLED=true
ELASTICSEARCH_AUTOCOMPLETE_MIN_LENGTH=2
ELASTICSEARCH_AUTOCOMPLETE_MAX_RESULTS=10
ELASTICSEARCH_AUTOCOMPLETE_CACHE=10
# Elasticsearch suggest/spell correction settings
ELASTICSEARCH_SUGGEST_ENABLED=true

NNTP_COMPRESSED_HEADERS=false
USE_ALTERNATE_NNTP_SERVER=false

NNTP_USERNAME=
NNTP_PASSWORD=
NNTP_SERVER=
NNTP_PORT=
NNTP_CONNECTIONS=
NNTP_SSLENABLED=false
NNTP_SOCKET_TIMEOUT=120

NNTP_USERNAME_A=
NNTP_PASSWORD_A=
NNTP_SERVER_A=
NNTP_PORT_A=
NNTP_CONNECTIONS_A=
NNTP_SSLENABLED_A=false
NNTP_SOCKET_TIMEOUT_A=120

NN_MULTIPROCESSING_MAX_CHILD_TIME=1800
NN_CONCURRENCY_TIMEOUT=
ADMIN_USER=
ADMIN_PASS=
ADMIN_EMAIL=

APP_NAME=NNTmux
APP_ENV=production
APP_DEBUG=false
APP_TIMEZONE=UTC
APP_URL=
# Passkey RP ID (domain only, no scheme/path)
PASSKEY_RELYING_PARTY_ID=
# Passkey authenticator selection (controls which authenticators the browser offers).
# Leave PASSKEY_AUTHENTICATOR_ATTACHMENT empty for "no preference" so Windows Hello,
# platform biometrics, phones (hybrid/QR) AND FIDO2 security keys all appear in the
# browser picker. Set to "platform" or "cross-platform" to restrict.
PASSKEY_AUTHENTICATOR_ATTACHMENT=
# residentKey: preferred|required|discouraged. "preferred" is required for Windows
# domain-joined / managed machines where "required" can suppress Windows Hello.
PASSKEY_RESIDENT_KEY=preferred
# userVerification: preferred|required|discouraged
PASSKEY_USER_VERIFICATION=preferred

# Trusted proxies / Cloudflare
# Comma-separated list of additional proxies to trust alongside Cloudflare.
TRUSTED_PROXIES=
TRUST_CLOUDFLARE=true
CLOUDFLARE_IPS_V4_URL=https://www.cloudflare.com/ips-v4
CLOUDFLARE_IPS_V6_URL=https://www.cloudflare.com/ips-v6
CLOUDFLARE_IPS_TIMEOUT=10
CLOUDFLARE_IPS_CONNECT_TIMEOUT=5
CLOUDFLARE_IPS_RETRY_TIMES=2
CLOUDFLARE_IPS_RETRY_SLEEP_MS=250
CLOUDFLARE_IPS_STORAGE_PATH=storage/app/cloudflare/trusted-proxies.json
CLOUDFLARE_TRUST_REMOTE_ADDR_FALLBACK=true

# Block configured indexer apps only when they proxy NZB downloads instead of redirecting to the downloader.
BLOCK_PROXY_INDEXER_APPS=false
BLOCK_PROXY_INDEXER_APP_USER_AGENTS=Prowlarr/,NZBHydra2

# Behavioural detection of direct proxy fetches that spoof a downloader UA (combines Referer, UA-pair,
# download/search ratio, and IP-correlation signals into a score gated by the threshold).
PROXY_DETECTION_ENABLED=false
PROXY_DETECTION_THRESHOLD=50
PROXY_DETECTION_WINDOW_SECONDS=3600
PROXY_DETECTION_RATIO_MIN=0.8
PROXY_DETECTION_MIN_SEARCHES=20
# Only apps that fetch NZBs directly from the indexer (NZBHydra2/Prowlarr). The *arr suite (Sonarr,
# Radarr, Lidarr, Readarr, Bazarr) only searches, and Jackett is torrent-only (Torznab) so it never
# queries a Usenet/newznab indexer — none of them download NZBs from here.
PROXY_DETECTION_INDEXER_REFERER_PATTERNS=hydra,prowlarr

APP_LOCALE=en
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=en_US

APP_MAINTENANCE_DRIVER=file
APP_MAINTENANCE_STORE=database

BCRYPT_ROUNDS=12
APP_KEY=
LOG_CHANNEL=stack
LOG_STACK=single
PASSWORD_HASH=argon2id

BROADCAST_CONNECTION=log
# Use failover_redis_file so Cache falls back to disk when Redis is unreachable (set CACHE_STORE=redis for strict Redis-only)
CACHE_STORE=failover_redis_file
# Production deployments should set this to `redis` (or `database`) and run Horizon.
# `sync` is for local development only and will deliver email synchronously.
QUEUE_CONNECTION=sync

REDIS_HOST=127.0.0.1
REDIS_USERNAME=default
REDIS_PASSWORD=null
REDIS_PORT=6379
REDIS_CLIENT=phpredis
REDIS_CONNECT_TIMEOUT=2
REDIS_READ_TIMEOUT=2

# Status probes: skip Redis check when cache/session/queue do not use Redis (set false to always probe)
STATUS_PROBE_REDIS=true
STATUS_PROBE_REDIS_ONLY_WHEN_USED=true

# Horizon (Redis queue dashboard and workers)
HORIZON_PREFIX=horizon:
# Priority-ordered queues consumed by Horizon.
HORIZON_QUEUES=api-audit,default

SESSION_DRIVER=redis
# Fast TCP probe before other middleware; switch cache+session to file when Redis host is unreachable (set false to disable)
REDIS_FAST_DEGRADE=true
REDIS_TCP_CHECK_SECONDS=0.2
SESSION_DOMAIN=null
SESSION_SECURE_COOKIE=false
SESSION_ENCRYPT=false
SESSION_COOKIE=nntmux
SESSION_PATH=/

# `MAIL_MAILER` is the canonical key in Laravel 13. The legacy `MAIL_DRIVER`
# variable is no longer read by `config/mail.php` and can be removed.
MAIL_MAILER=smtp
MAIL_HOST=smtp.mailtrap.io
MAIL_PORT=2525
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS=
MAIL_FROM_NAME=

# Branded email defaults (see config/mail.php -> brand). Subject prefix is
# applied to every transactional email sent through `App\Mail\Concerns\HasBrandedSubject`.
# MAIL_SUBJECT_PREFIX="[NNTmux] "
# MAIL_BRAND_LOGO_URL=
# MAIL_QUEUE=emails
# MAIL_INCIDENT_QUEUE=incidents

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=

PUSHER_APP_ID=
PUSHER_APP_KEY=
PUSHER_APP_SECRET=
PUSHER_APP_CLUSTER=mt1

MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"

CAPTCHA_PROVIDER=recaptcha
NOCAPTCHA_ENABLED=false
NOCAPTCHA_SITEKEY=
NOCAPTCHA_SECRET=

TURNSTILE_SECRET=
TURNSTILE_SITEKEY=
TURNSTILE_ENABLED=false

ITEMS_PER_PAGE=50
ITEMS_PER_COVER_PAGE=25
# Image processing driver. Use gd when the Imagick PHP extension is unavailable.
IMAGE_DRIVER=imagick
# Format used for newly processed covers and samples. Supported: webp, jpg.
IMAGE_OUTPUT_FORMAT=webp
# Encoder quality for newly processed covers and samples (1-100).
IMAGE_OUTPUT_QUALITY=82
# Maximum compressed source size accepted by image processing (20 MiB).
IMAGE_MAX_SOURCE_BYTES=20971520
# Maximum decoded source area accepted by image processing (40 megapixels).
IMAGE_MAX_SOURCE_PIXELS=40000000
# Remote image connection and total request timeouts, in seconds.
IMAGE_FETCH_CONNECT_TIMEOUT=5
IMAGE_FETCH_TIMEOUT=30
# Maximum number of redirects followed while downloading a remote image.
IMAGE_FETCH_MAX_REDIRECTS=5
MAX_PAGER_RESULTS=125000
ECHOCLI=true

# Collections/binaries/parts processing limits. Lower values reduce peak memory
# and lock duration; higher values may improve throughput on larger DB servers.
CBP_HEADER_CHUNK_SIZE=500
CBP_SQL_CHUNK_SIZE=500
CBP_RECONCILE_BATCH_SIZE=500
CBP_NZB_STREAM_ROWS=5000
# Permit php artisan migrate to run the resumable CBP hash/key rewrite. Enable only during maintenance.
CBP_STORAGE_MIGRATION_EXECUTE=false
RENAME_PAR2=false
ADD_PAR2=false
RENAME_MUSIC_MEDIAINFO=true
FETCH_LAST_FILE=true
CACHE_EXPIRY_SHORT=5
CACHE_EXPIRY_MEDIUM=10
CACHE_EXPIRY_LONG=15

SSL_CAFILE=
SSL_CAPATH=
SSL_VERIFY_PEER=false
SSL_VERIFY_HOST=false
SSL_ALLOW_SELF_SIGNED=true

SCRAPE_IRC_USERNAME=
SCRAPE_IRC_SERVER=
SCRAPE_IRC_PORT=
SCRAPE_IRC_TLS=
SCRAPE_IRC_PASSWORD=

TWITCH_CLIENT_ID=
TWITCH_CLIENT_SECRET=
IGDB_CACHE_LIFETIME=
TMDB_APIKEY=9a4e16adddcd1e86da19bcaf5ff3c2a3
TMDB_CACHE=false
TMDB_LOG=false
TVDB_APIKEY=ef6fb572-bcee-4d99-9b52-90549ad7553a
TVDB_PIN=
ANIDB_APIKEY=
FANARTTV_APIKEY=
GOOGLE_BOOKS_API_KEY=
ISBNDB_API_KEY=
OMDB_APIKEY=
# Trakt public metadata API client ID. OAuth tokens are not needed for TV/movie metadata lookups.
TRAKTTV_APIKEY=
TRAKTTV_TIMEOUT=30
TRAKTTV_RETRY_TIMES=3
TRAKTTV_RETRY_DELAY=100

# Temp paths for extraction
TEMP_UNRAR_PATH='/var/www/nntmux/resources/tmp/unrar/'
TEMP_UNZIP_PATH='/var/www/nntmux/resources/tmp/unzip/'

# Binary paths - adjust these to match your system
UNRAR_PATH=/usr/bin/unrar
UNZIP_PATH=/usr/bin/unzip
FFMPEG_PATH=/usr/bin/ffmpeg
LAME_PATH=/usr/bin/lame
MEDIAINFO_PATH=/usr/bin/mediainfo
TIMEOUT_PATH=/usr/bin/timeout
MAGIC_FILE_PATH=/usr/share/misc/magic.mgc

# Storage paths
PATH_TO_NZBS=/var/www/nntmux/storage/nzb/
COVERS_PATH=/var/www/nntmux/public/covers/

ASSET_URL=

POSTMARK_TOKEN=

PURGE_INACTIVE_USERS=false
PURGE_INACTIVE_USERS_DAYS=180

OTP_ENABLED=false

FLARE_KEY=

# Sentry Error Monitoring
SENTRY_LARAVEL_DSN=
SENTRY_RELEASE=
SENTRY_ENVIRONMENT=
SENTRY_SAMPLE_RATE=1.0
SENTRY_TRACES_SAMPLE_RATE=
SENTRY_PROFILES_SAMPLE_RATE=
SENTRY_ENABLE_LOGS=false
SENTRY_SEND_DEFAULT_PII=false

CHECK_PASSWORDED_RARS=false
DELETE_PASSWORDED_RELEASES=false
DELETE_POSSIBLE_PASSWORDED_RELEASES=false
EXTRACT_USING_RARINFO=false
PRIVATE_PROFILES=true
STORE_USER_IP=false

FORUM_FRONTEND_ENABLED=false

STREAM_FORK_OUTPUT=false

# One-off releases table normalization migration (2026_08_13_001652).
# Skip the in-migration preflight only after `php artisan releases:optimize-preflight` passes,
# since it repeats four full scans of the largest table.
RELEASES_OPTIMIZE_SKIP_PREFLIGHT=false
# Bypass the free-space guard that aborts when the data volume cannot hold the rebuilt copy.
RELEASES_OPTIMIZE_SKIP_FREE_SPACE_CHECK=false
# Row batch size for the migration's comment recount and rollback backfills.
RELEASES_OPTIMIZE_CHUNK_SIZE=5000

# API hot-path caching, asynchronous access metadata, and instrumentation.
API_RELEASE_CACHE_TTL=600
API_RELEASE_CACHE_JITTER=60
API_RELEASE_CACHE_STALE_TTL=900
API_RELEASE_CACHE_LOCK_TTL=15
API_ASYNC_AUDIT=true
API_AUDIT_QUEUE=api-audit
API_ACCESS_UPDATE_INTERVAL=60
API_METRICS_SAMPLE_RATE=0.01

TINYMCE_API_KEY=

TMUX_USE_POWERLINE=true
TMUX_USE_NERD_FONTS=true
TMUX_TERMINAL=tmux-256color
# Main monitor loop delay and slow-statistics refresh interval, in seconds.
TMUX_MONITOR_DELAY=10
TMUX_REFRESH_INTERVAL=60

# ──────────────────────────────────────────────────────────────
# Laravel Boost (AI guidelines)
# ──────────────────────────────────────────────────────────────
# Defaults force host binaries in generated guidelines so agents are not
# steered into Sail for every Artisan/Composer/npm command. Leave blank /
# unset to keep the config/boost.php host defaults. Set to Sail wrappers
# only if you intentionally want Sail-prefixed Boost guidance again.
# BOOST_PHP_EXECUTABLE_PATH=php
# BOOST_COMPOSER_EXECUTABLE_PATH=composer
# BOOST_NPM_EXECUTABLE_PATH=npm
# BOOST_VENDOR_BIN_EXECUTABLE_PATH=vendor/bin/

# ──────────────────────────────────────────────────────────────
# Docker / Sail
# ──────────────────────────────────────────────────────────────
# These are only used when running via Docker (./sail or make).
# For native installs, leave them commented out.

# Which Compose profiles to activate (comma-separated).
# Use "manticore" or "elasticsearch" to match SEARCH_DRIVER above.
COMPOSE_PROFILES=manticore

# Sail service name (should match docker-compose.yml)
APP_SERVICE=laravel.test

# Port mapping: host → container
APP_PORT=80
VITE_PORT=5173
# Browser-reachable host for Docker Vite hot reload URLs and HMR.
VITE_DEV_SERVER_HOST=localhost
FORWARD_DB_PORT=3306
FORWARD_REDIS_PORT=6379
FORWARD_MAILPIT_PORT=1025
FORWARD_MAILPIT_DASHBOARD_PORT=8025

# Host UID/GID — avoids file-permission issues with bind mounts.
# On Linux/WSL run: id -u  and  id -g
WWWUSER=1000
WWWGROUP=1000

# Xdebug (off | debug | develop | coverage | profile)
SAIL_XDEBUG_MODE=off

# ── Docker service hostnames ─────────────────────────────────
# Uncomment these when running inside Docker so the app resolves
# to the correct container names instead of localhost / 127.0.0.1.
#DB_HOST=mariadb
#REDIS_HOST=redis
#MANTICORESEARCH_HOST=manticore
#ELASTICSEARCH_HOST=elasticsearch
#MAIL_HOST=mailpit
#MAIL_PORT=1025