.env.example

# Git Code Review.  Copy to .env and edit, or let ./install.sh write it.
#
# This file holds what the container needs before anybody can sign in.  Nothing
# about what to scan lives here.  Organizations, the GitHub token, exclusions
# and the rest are set on the Settings page and stored in the database, where
# the token is encrypted.

# ---- where it listens -------------------------------------------------------
# Loopback by default.  Put a reverse proxy or load balancer in front for TLS.
# If the balancer is on another host, this has to be an address it can reach.
GCR_BIND_ADDRESS=127.0.0.1
GCR_PORT=8080

# ---- the database -----------------------------------------------------------
# The bundled MariaDB.  Leave this profile line alone and compose runs one for
# you.  Take it out and set GCR_DB_HOST to use a server you already have.
COMPOSE_PROFILES=bundled-db

GCR_DB_HOST=mariadb
GCR_DB_PORT=3306
GCR_DB_NAME=gcr
GCR_DB_USER=gcr

# install.sh generates these.  Both are required.
GCR_DB_PASSWORD=
GCR_DB_ROOT_PASSWORD=

# The database is encrypted at rest.  This is that key, 64 hex characters.
# install.sh generates it and writes secrets/mariadb-keyfile from it.  Keep a
# copy somewhere safe: without it the data files are unreadable, and that is
# the whole point of them being encrypted.
GCR_DB_ENCRYPTION_KEY=
GCR_DB_KEYFILE=./secrets/mariadb-keyfile

# Memory the bundled MariaDB keeps table data in.  2G suits most installs.
# Raise it when the database grows past that, lower it on a small host.
GCR_DB_BUFFER_POOL=2G

# Or replace all of the above with one URL, for a managed database:
#   GCR_DATABASE_URL=mysql+pymysql://user:pass@db.example.com:3306/gcr?charset=utf8mb4
GCR_DATABASE_URL=

# ---- where the reports land -------------------------------------------------
# vulnerabilities.json and vulnerabilities.csv go here, and whatever ingests
# the findings reads them from here.  Relative paths are relative to this file.
GCR_OUT_PATH=./out

# Where repositories are cloned while a scan is running.  Wants real disk, not
# a RAM disk: a full history scan of a large estate is tens of gigabytes in
# flight.  Nothing is kept here between runs.
GCR_WORK_PATH=./work

# ---- sessions and encryption ------------------------------------------------
# Signs sessions.  Set the same value on every instance behind a load balancer.
GCR_SECRET_KEY=

# Encrypts the GitHub token, the GitHub App private key and the OIDC client
# secret in the database, on top of the database being encrypted at rest.
# Lose it and those three have to be pasted in again.
GCR_ENCRYPTION_KEY=

# ---- the first boot ---------------------------------------------------------
# Everything else is on the Settings page and lives in the database: how people
# sign in, the OIDC details, session length, the load balancer addresses, what
# to scan, the GitHub token, exclusions.  The token and the client secret are
# encrypted there with the key above.
#
# These two are only a fallback for the very first boot, before anybody has
# signed in.  Leave them alone unless you need OIDC working before that.
GCR_AUTH_MODE=local
GCR_TRUSTED_PROXIES=

# Leave this on when TLS stops at a balancer.  It marks session cookies secure
# and sends HSTS.  The balancer needs to send X-Forwarded-Proto: https.
GCR_FORCE_HTTPS=true

TZ=UTC

# How much memory a scan may use before it is stopped.
#
# gitleaks reads a file whole, so one enormous file in one repository can ask
# for tens of gigabytes.  Without a ceiling the kernel picks a victim across
# the whole machine, and that can be the database rather than the scan.  With
# one, the scan fails, the repository is recorded as failed, and nothing else
# is disturbed.  Leave room for the rest of the host.
GCR_MEM_LIMIT=8g

# Scratch space for a scan, kept in memory instead of on a disk.  Credentials
# sit in the clear in those files for the moment between an engine finding one
# and the triage replacing it with a mask, and memory does not leave a copy
# behind afterwards.  Docker gives a container 64MB unless told otherwise,
# which a large repository will not fit in, and the scanner falls back to disk
# and says so when it does not fit.  Raise this rather than let it fall back.
GCR_SHM_SIZE=1g