sample.env

# Booleans should all be lowercase: true/false

# SERVER - node || apache(deprecated)
SERVER=node

# PORT
# In development mode only, PORT+1 will also be used for the main site
PORT=8888

# SITE_ACCESS - public || optional || required  (required; there is no default)
# public: Anyone can view. No end-user login on the main site; only admins log in at /configure.
# optional: Anyone can view. Users may sign up and log in (e.g. to save Draw files).
# required: Visitors must log in to see anything.
#   (with local login this does not work in dev env/build first and npm run start:prod)
# The old AUTH variable has been removed; MMGIS refuses to start while it is set.
#   AUTH=off -> SITE_ACCESS=public    AUTH=none -> SITE_ACCESS=optional
#   AUTH=local -> SITE_ACCESS=required + AUTH_PROVIDERS=["local"]
#   AUTH=csso  -> SITE_ACCESS=required + AUTH_PROVIDERS=["proxy","local"] + PROXY_TRUST=network (local keeps admin logins)
SITE_ACCESS=optional

# AUTH_PROVIDERS - JSON array (or comma list) of login methods: "local", "proxy", "ldap"
# local: MMGIS username/password accounts. Keep it listed so /configure admins can always log in.
# proxy: an authenticating reverse proxy (e.g. Cloud Single Sign On) in front of MMGIS sends identity headers (see PROXY_TRUST)
# ldap: username/password checked against an LDAP directory (see LDAP_*)
# With several username/password providers (local, ldap), the login form shows a switch; the first listed is the default.
AUTH_PROVIDERS=["local"]

# Lets visitors create local accounts: with SITE_ACCESS=required, or SITE_ACCESS=optional plus another
#  provider (ldap, proxy). SITE_ACCESS=optional with only local always allows sign-up.
AUTH_LOCAL_ALLOW_SIGNUP=false
# AUTH_LOCAL_LOGIN - all || admins  (default all). admins: only accounts with an admin role may log in
#   with a local account (e.g. AUTH_PROVIDERS=["proxy","local"] where local is only for admins). Disables self sign-up.
AUTH_LOCAL_LOGIN=all
# AUTH_TOKENS - all || admins  (default all). Who may create API (long-term) tokens. admins: only accounts with an
#   admin role; other accounts' existing tokens stop working (they aren't deleted) until the setting allows them again;
#   they can still see and revoke them from the account menu.
#   Accounts without an admin role may hold one token lasting at most 90 days.
AUTH_TOKENS=all
# AUTH_MAX_FAILED_LOGINS - failed logins allowed per account per 15 minutes (default 5); from any address on
#   provider forms (LDAP), per address on the local form with a 10x ceiling across addresses.
#   Counted per server process: keep it times the number of processes below your directory's account
#   lockout threshold so MMGIS stops first.
AUTH_MAX_FAILED_LOGINS=5
# AUTH_RECHECK_MINUTES - how often existing sessions and API tokens of provider accounts (LDAP) are rechecked
#   against the directory, so removed people and groups lose access (default 15; 0 turns it off).
AUTH_RECHECK_MINUTES=15
# AUTH_PROVIDER_NEW_ACCOUNTS - false: provider sign-ins (LDAP, proxy) only reach existing or relinked accounts and never
#   create new ones (default true). Set it during a directory migration, so renamed people don't get empty accounts.
AUTH_PROVIDER_NEW_ACCOUNTS=true

# SETUP_CODE - optional. While the site has no SuperAdmin, creating the first SuperAdmin account
#  requires a one-time setup code. By default a random code is printed in the server log
#  on start; set this to choose the code yourself (scripted installs, multiple replicas).
SETUP_CODE=

# NODE_ENV - development || production
NODE_ENV=development

# HTTPS - true || false
# If true, MMGIS will use an https server with the, now required, HTTPS_KEY and HTTPS_CERT envs.
# If false, use a wrapping https proxy server instead and block PORT from being public
HTTPS=false

# Relative path to key. If using docker, make sure the key is mounted.Everything under './ssl/' is gitignored and './ssl/' is mounted into docker.
HTTPS_KEY='ssl/sample.key'

# Relative path to cert. If using docker, make sure the cert is mounted. Everything under './ssl/' is gitignored and './ssl/' is mounted into docker.
HTTPS_CERT='ssl/sample.cert'


# TRUST_PROXY - how many proxies in front of MMGIS to trust for the client IP (X-Forwarded-For).
# 1 (default), false when browsers reach MMGIS directly, or an Express "trust proxy" value.
TRUST_PROXY=1

# SECRET - REQUIRED. Set to a strong random string (min 24 chars) for session cookie signing.
# Do NOT use this sample value in production. Generate one with: openssl rand -hex 64
SECRET=

# Connections - let tools use an outside service with each person's own account there.
# They never sign anyone in to MMGIS. See docs/pages/Contributing/Connections.
# CONNECTIONS_CALLBACK_BASE_URL - public URL of this site (incl. ROOT_PATH) for service callbacks,
#   when MMGIS sits behind a proxy that changes the host. Default: from the request.
CONNECTIONS_CALLBACK_BASE_URL=

#LOGGING
VERBOSE_LOGGING=false


# STAC Catalogs - https://github.com/stac-utils/stac-fastapi-pgstac
WITH_STAC=true
STAC_PORT=8881
# TiTiler PG Vectors - https://github.com/developmentseed/tipg
WITH_TIPG=true
TIPG_PORT=8882
# TiTiler - https://developmentseed.org/titiler
WITH_TITILER=true
TITILER_PORT=8883
# TiTiler URL Validation (SSRF Prevention)
# JSON array of regex patterns for allowed URLs. URLs must match at least one pattern to be proxied.
# Empty array [] or unset = allow all URLs (backward compatible, not recommended for production)
# Default below: HTTPS URLs + local /Missions files (relative paths, with path traversal protection)
TITILER_ALLOWED_URL_PATTERNS='["^https://(?!.*\\.\\.)(?!.*\\x00).*$", "^/Missions/(?!.*\\.\\.).*$"]'
# To allow all URLs (disable validation):
# TITILER_ALLOWED_URL_PATTERNS=
# Domain whitelist example:
# TITILER_ALLOWED_URL_PATTERNS='["^https://tiles\\.example\\.com/.*", "^https://.*\\.s3\\.amazonaws\\.com/.*", "^file:///Missions/.*"]'
# TiTiler Mosaicking - https://github.com/stac-utils/titiler-pgstac
WITH_TITILER_PGSTAC=true
TITILER_PGSTAC_PORT=8884
# Veloserver - Velocity and Wind Data Visualization Server - https://github.com/NASA-AMMOS/Veloserver
WITH_VELOSERVER=true
VELOSERVER_PORT=8104

# Custom Adjacent Servers (Docker only) - Configure your own adjacent servers without modifying core MMGIS code
# Format: ADJACENT_SERVER_CUSTOM_X=["isEnabled", "routeName", "serviceName", "port"]
# Where:
#   - isEnabled: "true" or "false" - whether to enable this server
#   - routeName: URL path name (will be accessible at /routeName)
#   - serviceName: Docker service name or localhost for non-Docker deployments
#   - port: Port number the service runs on
#
# Examples:
# ADJACENT_SERVER_CUSTOM_0=["true", "my_service", "my_service_container", "8105"]
# ADJACENT_SERVER_CUSTOM_1=["false", "disabled_service", "disabled_service", "8106"]
#
# You can configure up to multiple custom servers by incrementing the number (0, 1, 2, 3, etc.)

# Sets the Content-Security-Policy: frame-ancestors header to allow the embedding in external sites. default null, ex: FRAME_ANCESTORS='["https://*.jpl.nasa.gov"]'
FRAME_ANCESTORS=
# Sets "SameSite=None; Secure" on the login cookie. Useful when using SITE_ACCESS=required as an iframe within a cross-origin page.
THIRD_PARTY_COOKIES=false
# Comma-separated origins allowed for cross-origin HTTP requests and websockets. Empty means same-origin only.
CORS_ORIGINS=
# Explicitly control the session cookie Secure flag. Unset defaults to HTTPS=true or THIRD_PARTY_COOKIES=true.
SESSION_COOKIE_SECURE=
# Sets the Content-Security-Policy: frame-src header to allow the embedding external sites with mmgis. default null, ex: FRAME_ANCESTORS='["https://*.jpl.nasa.gov"]'.
# Setting this will almost always have no effect
FRAME_SRC=

# Set MMGIS to be deployed under a subpath. For example if serving at the subpath 'https://{domain}/path/where/I/serve/mmgis' is desired, set `ROOT_PATH=/path/where/I/serve/mmgis`. Should always begin with a `/`. If no subpath, leave blank.
ROOT_PATH=

# Tell MMGIS that it's already deployed under a subpath. For example if already proxying to the subpath 'https://{domain}/path/where/I/serve/mmgis' is desired, set `ROOT_PATH=/path/where/I/serve/mmgis`. Should always begin with a `/`. If `ROOT_PATH` is also set, requests will use `EXTERNAL_ROOT_PATH` + `ROOT_PATH`. If no external subpath, leave blank. This differs from ROOT_PATH in that MMGIS will not place any of it's endpoints under this path but will still query as if it did.
EXTERNAL_ROOT_PATH=

# Overrides ROOT_PATH's use when the client connects via websocket. Websocket url: `${ws_protocol}://${window.location.host}${WEBSOCKET_ROOT_PATH || ROOT_PATH || ''}/`
WEBSOCKET_ROOT_PATH=

# Sets a clearance number for the website
CLEARANCE_NUMBER=

# A string of text for contact information on the bottom right corner of the login pages
CONTACT_INFO=

# Initial HTML page title. When sharing a link to MMGIS in an application that supports link previews, the title to be used | string | default `MMGIS`
LINK_PREVIEW_TITLE=
# Initial HTML page description. When sharing a link to MMGIS in an application that supports link previews, the description to be used | string | default `A web-based mapping and localization solution for science operation on planetary missions.`
LINK_PREVIEW_DESCRIPTION=

# If true, users that use the 'Copy Link' feature will receive a full-length deep link.
# Writing new short links will be disabled but expanding existing ones will still work. default false
DISABLE_LINK_SHORTENER=false

#DB
# If using docker, DB_HOST is the database service name (db)
DB_HOST=localhost
# Postgres' default port is 5432
DB_PORT=5432
DB_NAME=name
DB_USER=user
DB_PASS=password
# Test database credentials for least-privilege separation.
# Required by both tests/global-setup.js and tests/test-db-clean.js (no fallback).
# DB_USER_TEST=
# DB_PASS_TEST=
# Max number connections in the database's pool. CPUs * 4 is a good number. Default is 10
DB_POOL_MAX=
# How many milliseconds until a DB connection times out. Default is 30000 (30 sec)
DB_POOL_TIMEOUT=
# How many milliseconds for an incoming connection to wait for a DB connection before getting kicked away. Default is 10000 (10 sec)
DB_POOL_IDLE=
# If the Postgres DB instance is enforcing SSL, set to true to have MMGIS connect to it via SSL | boolean | default false
DB_SSL=false
# If DB_SSL=true and if needed, the path to a certificate for ssl | string
DB_SSL_CERT=
# Alternatively, if DB_SSL=true and if needed, a base64 encoded certificate for ssl. DB_SSL_CERT_BASE64 will take priority over DB_SSL_CERT | string
DB_SSL_CERT_BASE64=

#CONFIG
# Disable the configure page
HIDE_CONFIG=false
# Force one mission only and this is its config
FORCE_CONFIG_PATH=''

# With the proxy login provider: users must belong to at least one of these groups to access MMGIS
PROXY_GROUPS=["A", "B"]
# With the proxy login provider: the group with elevated "Lead" permissions
PROXY_LEAD_GROUP=A
# How MMGIS knows identity headers came from the proxy: secret (default) || ips || network
#   secret: the proxy sends PROXY_SECRET in PROXY_SECRET_HEADER. ips: requests come from PROXY_TRUSTED_IPS.
#   network: trust the headers on any request (as AUTH=csso did); MMGIS must only be reachable through the proxy.
PROXY_TRUST=secret
PROXY_SECRET=
# pragma: allowlist nextline secret
PROXY_SECRET_HEADER=X-MMGIS-Proxy-Secret
# JSON array or comma list of the proxy's addresses or CIDR ranges, for PROXY_TRUST=ips
PROXY_TRUSTED_IPS=
# Identity header names. PROXY_GROUPS_FORMAT: base64-json (CSSO) || json || list
PROXY_USER_HEADER=X-Sub
PROXY_GROUPS_HEADER=X-Groups
PROXY_GROUPS_FORMAT=base64-json
PROXY_SESSION_HEADER=X-Session
# The proxy's session check (POST, or off), sign-out, sign-in and session-extend URLs
PROXY_STATUS_URL=/ssostatus
PROXY_LOGOUT_URL=/ssologoutredirect
PROXY_LOGIN_URL=/ssologinredirect
PROXY_REFRESH_URL=/ssorefreshtimeout

# LDAP login provider (AUTH_PROVIDERS includes "ldap"). See docs/pages/Setup/ENVs/ENVs.md
# LDAP_URL - ldaps://host:636, or ldap://host:389 with LDAP_STARTTLS=true
LDAP_URL=
LDAP_STARTTLS=false
# PEM file of the CA that signed the directory's certificate (internal CAs)
LDAP_TLS_CA=
# Local testing only: allow ldap:// without StartTLS (passwords unencrypted)
LDAP_ALLOW_INSECURE=false
# Finding people: search LDAP_USER_SEARCH_BASE with LDAP_USER_SEARCH_FILTER, as LDAP_BIND_DN (a read-only
#  service account) or anonymously when it is empty. Or sign in as LDAP_USER_DN_TEMPLATE directly.
LDAP_BIND_DN=
LDAP_BIND_PASSWORD=
LDAP_USER_SEARCH_BASE=
LDAP_USER_SEARCH_FILTER=(uid={{username}})
LDAP_USER_DN_TEMPLATE=
# Active Directory NetBIOS domain, e.g. CORP, so people can type CORP\alice
LDAP_USERNAME_DOMAIN=
# Attributes: a stable id (entryUUID; objectGUID on Active Directory), the username, email and groups
LDAP_SUBJECT_ATTRIBUTE=entryUUID
LDAP_USERNAME_ATTRIBUTE=uid
LDAP_EMAIL_ATTRIBUTE=mail
LDAP_GROUPS_ATTRIBUTE=memberOf
# Or find groups by searching LDAP_GROUP_SEARCH_BASE ({{dn}} / {{username}} are the person's)
LDAP_GROUP_SEARCH_BASE=
LDAP_GROUP_SEARCH_FILTER=(member={{dn}})
# Report found groups by this attribute (e.g. cn) instead of their DN
LDAP_GROUP_NAME_ATTRIBUTE=
LDAP_TIMEOUT_MS=5000
# Login form wording
LDAP_DISPLAY_NAME=LDAP
LDAP_USERNAME_LABEL=Username
LDAP_LOGIN_HINT=

# When not using the proxy, a string array of internal usernames with elevated "Lead" permissions
LEADS=["user1"]

# If true, enables the backend MMGIS websockets to tell clients to update layers
ENABLE_MMGIS_WEBSOCKETS=false
# If true, notifications are sent to /configure users whenever the configuration objects changes out from under them and puts (overridable) limits on saving.
ENABLE_CONFIG_WEBSOCKETS=false
# For use when ENABLE_CONFIG_WEBSOCKETS=true (if ENABLE_CONFIG_WEBSOCKETS=false, all saves will freely overwrite already). If true, gives /configure users the ability to override changes made to the configuration while they were working on it with their own.
ENABLE_CONFIG_OVERRIDE=false

# If the new MAIN_MISSION ENV is set to a valid mission, skip the landing page and go straight to that mission.
# Other missions will still be accessible by either forcing the landing page (clicking the top-left M logo) or by going to a link directly.
MAIN_MISSION=

# If true, MMGIS will not auto-login returning users. This can be useful when login is managed someplace else.
# The initial login process can be manually triggered with mmgisAPI.initialLogin()
SKIP_CLIENT_INITIAL_LOGIN=

# If true at build-time, JavaScript source maps will also be built 
GENERATE_SOURCEMAP=false


# If true, then at every other midnight, MMGIS will read /Missions/spice-kernels-conf.json and re/download all the specified kernels.
SPICE_SCHEDULED_KERNEL_DOWNLOAD=false
# If true, then also triggers the kernel download when MMGIS starts
SPICE_SCHEDULED_KERNEL_DOWNLOAD_ON_START=false
# A cron schedule expression for use in the node-schedule npm library. Defaults to "0 0 */2 * *" which is every other day.
SPICE_SCHEDULED_KERNEL_CRON_EXPR=

# Comma-separated list of remote GDAL dataset prefixes that /api/utils/getprofile, getbands and getminmax
# may open (e.g. "/vsis3/my-bucket/,https://my-cdn.example.gov/dems/"). Empty means local /Missions rasters only.
# Each entry must name a host or bucket; scheme-only entries like "https://" are ignored.
# The server fetches these itself and returns their bytes as pixel values, so only list trusted locations.
GDAL_ALLOWED_REMOTE_PREFIXES=

# When using composited time tiles, MMGIS queries the tileset's folder for existing time folders.
# It caches the results of the these folder listings every COMPOSITE_TILE_DIR_STORE_MAX_AGE_MS milliseconds
# defaults to requerying every 30 minutes. If 0, no caching. If null or NaN, uses default.
COMPOSITE_TILE_DIR_STORE_MAX_AGE_MS=