.env.example

# Qtiler environment configuration (standalone QGIS at C:\QGIS)

# === Lantmäteriet (Qtiler2Origo) ===
LANTMATERI_API_URL=https://api.lantmateriet.se

# -----------------------------------------------------------------------------
# OAUTH2 CLIENT CREDENTIALS (RECOMENDADOS PARA API MANAGER)
# -----------------------------------------------------------------------------
# En el Developer Portal de Lantmäteriet, ve a tu Application -> Production Keys
# Copia la Consumer Key y Consumer Secret aquí. El servidor obtendrá el token
# de acceso automáticamente y lo renovará al expirar.
# Estas credenciales aplican a servicios del API Manager (ej: Höjd, Markhöjd)
# LANTMATERI_CLIENT_ID=tú_consumer_key_aquí
# LANTMATERI_CLIENT_SECRET=tú_consumer_secret_aquí
LANTMATERI_TOKEN_URL=https://apimanager.lantmateriet.se/oauth2/token

# (Opcional) Sobrescribir scopes por API. "default" suele funcionar para Höjd.
# LANTMATERI_MARKHOJD_SCOPE=markhojd_direkt_v1_read
# LANTMATERI_HOJD_SCOPE=default

# -----------------------------------------------------------------------------
# GEOTORGET (HTTP BASIC) - PARA OGC FEATURES
# -----------------------------------------------------------------------------
# Algunos APIs modernos (como Marktäcke OGC Features) NO usan el API Manager de
# los portales antiguos, sino suscripciones de Geotorget. Para estos necesitas el
# usuario y contraseña de la prenumeración específica de Geotorget.
# LANTMATERI_MARKTACKE_USER=tú_usuario_geotorget_aquí
# LANTMATERI_MARKTACKE_PASS=tú_contraseña_geotorget_aquí


# WFS
# NOTE: Many clients (QGIS/Origo) request tiles concurrently; huge defaults can cause timeouts.
WFS_DEFAULT_MAX_FEATURES=1000000
WFS_MAX_FEATURES_LIMIT=8000000
QTILER_WMS_MAX_PIXELS=4000000
QTILER_WMS_MAX_LAYERS=20

# Public URL / reverse proxy --------------------------------------------------
# Local HTTP port used by server.js. Keep all other code reading from this
# value instead of hardcoding a port elsewhere.
PORT=3000

# Written by install.bat. Local/test installs use test + localhost. Production
# IIS/HTTPS installs use production + PUBLIC_BASE_URL=https://your.domain.
QTILER_INSTALL_MODE=test
QTILER_BEHIND_IIS=0
QTILER_PUBLIC_HTTPS=0

# Leave PUBLIC_BASE_URL empty for local use (http://localhost:<PORT>). Set it
# when Qtiler is published behind IIS URL Rewrite/ARR so generated WMTS/WMS/WFS,
# plugin, login and viewer URLs use the external HTTPS address instead of the
# internal Node URL.
# Examples:
#   PUBLIC_BASE_URL=https://maps.example.com
#   PUBLIC_BASE_URL=https://maps.example.com/qtiler
PUBLIC_BASE_URL=

# Which reverse proxies Express should trust for X-Forwarded-* headers.
# Default "loopback" is safe for localhost and for IIS running on the same
# Windows host and proxying to http://127.0.0.1:<PORT>. If IIS/ARR is on another
# host, set this to that proxy IP/subnet instead. Avoid "true" unless Qtiler is
# only reachable from trusted proxies.
# Examples: loopback | 127.0.0.1 | 10.0.0.10 | 10.0.0.0/8 | false
QTILER_TRUST_PROXY=loopback

# Initial QtilerAuth admin bootstrap password. Leave empty in the template:
# install.bat asks for this value and writes it to .env for each server.
# After first login, change or rotate the admin password in QtilerAuth.
QTILER_DEFAULT_ADMIN_PASSWORD=

# ---------------------------------------------------------------------------
# RAM budget
#   Approx total RAM = WORKER_COUNT * PY_WORKER_POOL_SIZE * ~600 MB (QGIS)
#                    + WORKER_COUNT * (NODE_OPTIONS heap cap)
#   Defaults below target ~9-10 GB. Raise only if your host has the RAM;
#   oversizing these values WILL crash the machine when many tiles are requested.
# ---------------------------------------------------------------------------

# Number of Node worker processes (0 = auto = cpu count). 2-3 is plenty.
WORKER_COUNT=2
# Cap Node heap. 4 GB is enough for the JS layer; 20 GB will starve QGIS.
NODE_OPTIONS=--max-old-space-size=4096

# Number of persistent Python/QGIS worker processes per Node worker.
# Main knob to prevent tiled WFS holes (queueing -> client timeouts).
# Each pool member loads QGIS (~400-800 MB resident).
PY_WORKER_POOL_SIZE=4

# Per-job timeout (seconds)
WORKER_JOB_TIMEOUT_S=300
JOB_MAX_PER_WORKER=100
WORKER_RESTART_DELAY_S=5
WORKER_MAX_RESTARTS=6
WORKER_RESTART_WINDOW_S=60
# Per-worker memory ceiling in MB. Keep low so a runaway worker is recycled
# before it exhausts the host RAM.
WORKER_MAX_MEMORY_MB=4096


# Python + QGIS (standalone)
# Adjusted for local installation at C:\QGIS
PYTHON_EXE=C:\QGIS_344\bin\python.exe
OSGEO4W_BIN=C:\QGIS_344\bin
# For standalone QGIS installers the actual QGIS prefix is under apps\qgis
# Update to the apps path so the Python package and DLLs are found
QGIS_PREFIX=C:\QGIS_344\apps\qgis
# Include qt5 and qt6 plugin folders if present in your install.
QT_PLUGIN_PATH=C:\QGIS_344\apps\qgis\qtplugins;C:\QGIS_344\apps\qt5\plugins;C:\QGIS_344\apps\qt6\plugins
# Add PYTHONPATH so the QGIS and GDAL Python modules are discovered correctly.
PYTHONPATH=C:\QGIS_344\apps\qgis\python

# Keep QGIS loaded in persistent workers.
QTILER_PERSISTENT_WORKER=1

# Vector Tiles on-demand concurrency (default 3; increase for faster generation)
VECTOR_TILES_MAX_ONDEMAND_WORKERS=6

NODE_EXE=C:\Program Files\nodejs\node.exe
QTILER_HOME=C:\Qtiler
# Port where QWC2 (web frontend) is exposed. Change if it conflicts with another
# service or if you serve QWC2 behind a reverse proxy.
QTWC_QWC2_PORT=3089
QTWC_QWC2_AUTOSTART=1
QUANTIZED_MESH_BUILD_CMD=C:\QGIS_344\bin\python.exe C:\Qtiler\tools\mesh_build.py
# Optional: override terrain engine command used by tools/mesh_build.py
# Example if not in PATH: QUANTIZED_MESH_ENGINE_CMD=C:\Tools\mesh-dem-to-terrain\mesh-dem-to-terrain.cmd
QUANTIZED_MESH_ENGINE_CMD=C:\Program Files\nodejs\node.exe C:\Qtiler\tools\mesh_dem_to_terrain_runner.mjs
QUANTIZED_MESH_ENGINE_KIND=mesh-dem-to-terrain
QUANTIZED_MESH_TARGET_CRS=EPSG:4326
# Leave unset to derive contour interval from raster pixel size.
# QUANTIZED_MESH_DXF_CONTOUR_INTERVAL=1
QUANTIZED_MESH_ENGINE_MODULE=C:\Qtiler\ThirdParty\mesh-dem-to-terrain\dist\index.js
# License signing secret (set to a long random value)
QUANTIZED_MESH_JOB_TIMEOUT_MS=600000
# Skip caching fully white tiles (helps avoid persistent blank tiles on timeouts)
SKIP_WHITE_TILES=1

# === QtilerAuth: brute-force protection & captcha (optional) ===
# Sliding window for failed-login counting (default 900s = 15 min).
AUTH_LOGIN_WINDOW_SECONDS=900
# Failed attempts (per IP or username) within the window before lock-out.
AUTH_LOGIN_MAX_ATTEMPTS=8
# Cool-down once locked (default 900s = 15 min).
AUTH_LOGIN_LOCKOUT_SECONDS=900
# Show a captcha after this many failed attempts (only if a provider is set below).
AUTH_LOGIN_CAPTCHA_AFTER=3
# Optional captcha provider:
#   pow       - Built-in proof-of-work challenge (no external service, GDPR ready,
#               no tracking, no API keys to register). Recommended default.
#   turnstile - Cloudflare Turnstile (requires SITE_KEY + SECRET_KEY).
#   hcaptcha  - hCaptcha (requires SITE_KEY + SECRET_KEY).
#   recaptcha - Google reCAPTCHA v2 (requires SITE_KEY + SECRET_KEY).
# Leave blank to disable the captcha entirely (the lock-out above still applies).
AUTH_CAPTCHA_PROVIDER=
AUTH_CAPTCHA_SITE_KEY=
AUTH_CAPTCHA_SECRET_KEY=
# Difficulty for the built-in PoW captcha (only when AUTH_CAPTCHA_PROVIDER=pow).
# Number of leading zero bits the client must find in sha256(challenge|nonce).
# 18 ~ 1-2s on a modern laptop; 20 ~ 4-8s; 22 ~ 16-30s. Default: 18.
AUTH_CAPTCHA_POW_DIFFICULTY=18
AUTH_CAPTCHA_POW_TTL_SECONDS=300

# Per-API-key requests/minute limit (0 = unlimited). When tripped the server
# answers 429 with Retry-After: 60. Recommended for production: 600-2000.
AUTH_API_RATE_LIMIT_PER_MINUTE=0
# API key storage mode:
# 1 = store plaintext + hash (admins can copy a user's key later; easier ops)
# 0 = store hash only (more secure; key is only visible right after create/rotate)
AUTH_STORE_PLAINTEXT_API_KEYS=1

# --- Transport / hardening ----------------------------------------------------
# Localhost profile:
#   - keep PUBLIC_BASE_URL empty
#   - keep QTILER_ENABLE_HSTS empty
#   - keep QTILER_TRUST_PROXY=loopback
# IIS URL Rewrite / ARR HTTPS profile:
#   - install/enable IIS URL Rewrite and Application Request Routing (proxy)
#   - terminate TLS in IIS with a valid certificate and redirect HTTP to HTTPS
#   - proxy to the PORT configured above (for example http://127.0.0.1:3007)
#     and preserve/pass the original Host
#   - send X-Forwarded-Proto=https, X-Forwarded-Host={HTTP_HOST}, and
#     X-Forwarded-For={REMOTE_ADDR}
#   - set PUBLIC_BASE_URL to the external HTTPS URL
#   - keep QTILER_TRUST_PROXY=loopback when IIS and Qtiler share the host;
#     otherwise set it to the IIS/ARR proxy IP or subnet
#   - set QTILER_ENABLE_HSTS=1 only after HTTPS works for the public domain
#   - disable/remove WebDAV or explicitly allow PATCH/PUT/DELETE if IIS filters them
#   - set QTILER_CORS_ALLOWED_ORIGINS to the public visor/portal origins; only
#     set QTILER_CORS_ALLOW_CREDENTIALS=1 when a different origin needs cookies
# Disable helmet entirely (NOT recommended). Default leaves helmet on.
QTILER_DISABLE_HELMET=
# Enable strict Content-Security-Policy. Off by default because the embedded
# QWC2/Origo viewers fetch assets from many origins; only enable after
# whitelisting them in helmet config.
QTILER_ENABLE_CSP=
# Enable HSTS (only set behind HTTPS / a TLS-terminating reverse proxy).
QTILER_ENABLE_HSTS=
# Allow this site to be embedded in any frame (default: sameorigin only).
QTILER_ALLOW_FRAMING=
# Comma-separated CORS allowlist. Leave empty to keep legacy "allow any origin"
# behavior. Production: set to your visor/portal origins.
# Example: https://map.example.com,https://portal.example.com
QTILER_CORS_ALLOWED_ORIGINS=
# Send credentials (cookies) with cross-origin requests. Required if your
# Origo/QWC2 visor lives on a different origin and uses cookie sessions.
QTILER_CORS_ALLOW_CREDENTIALS=0

# ---------------------------------------------------------------------------
# Lantmäteriet (Qtiler2Origo "lantmaterisearch" control)
# ENDAST FÖR DEN SVENSKA MARKNADEN — kräver giltigt avtal med Lantmäteriet.
# ONLY FOR THE SWEDISH MARKET — requires a valid agreement with Lantmäteriet.
# Register at: https://www.lantmateriet.se/sv/Kartor-och-geografisk-information/oppna-data/API-oppna-data/
# ---------------------------------------------------------------------------
LANTMATERI_API_URL=https://api.lantmateriet.se
LANTMATERI_API_KEY=
# Optional product-specific keys (override LANTMATERI_API_KEY per product)
LANTMATERI_FASTIGHET_API_KEY=
LANTMATERI_BEFOLKNING_API_KEY=
LANTMATERI_ADRESS_API_KEY=
LANTMATERI_TAXERING_API_KEY=
# Point-info products (one button per product in the LMV control)
LANTMATERI_MARKHOJD_API_KEY=
LANTMATERI_MARKTACKE_API_KEY=
LANTMATERI_HOJD_API_KEY=
# OAuth2 client credentials (used if API offers OAuth2 instead of static key)
LANTMATERI_CLIENT_ID=
LANTMATERI_CLIENT_SECRET=
LANTMATERI_TOKEN_URL=https://api.lantmateriet.se/token

# Refuse anonymous WMTS GetCapabilities discovery (only logged-in users get
# the global capability list). Per-project capabilities still respect ACLs.
QTILER_WMTS_REQUIRE_AUTH=0

# Leave LICENSE_SECRET empty on customer installs. It is only consulted when
# LICENSE_ALLOW_HMAC_LEGACY=1 to verify legacy HMAC license keys (dev only).
# Never publish this value -- if you set it, treat it as a private secret.
LICENSE_SECRET=

# === LICENSING ===
# LICENSE_SECRET is OPTIONAL on customer installs. It is only used as an HMAC
# fallback for legacy commercial license keys when LICENSE_ALLOW_HMAC_LEGACY=1.
# Modern (RSA-signed) commercial licenses are verified against the embedded
# DEVELOPER_PUBLIC_KEY in routes/plugins.js -- no shared secret required.
# Leave LICENSE_ALLOW_HMAC_LEGACY UNSET on customer servers. Setting it to 1
# would let anyone with the .env forge their own licenses.
# LICENSE_ALLOW_HMAC_LEGACY=0
# Optional override (developer machines only):
# LICENSE_PUBLIC_KEY_PATH=tools/licenses/public_key.pem
# LICENSE_PRIVATE_KEY_PATH=tools/licenses/private_key.pem  (license-server only)