# PeerTube production config — occupymedia.cc (used as env_file by docker-compose.yml)
# Image: chocobozzz/peertube:production-bookworm. Pin to a version tag at first deploy.

PEERTUBE_WEBSERVER_HOSTNAME=tube.occupymedia.cc
PEERTUBE_WEBSERVER_PORT=443
PEERTUBE_WEBSERVER_HTTPS=true
PEERTUBE_TRUST_PROXY=true

# First boot: the entrypoint generates the admin user with a random password,
# printed once in the logs: `docker compose logs peertube | grep -A2 'user root'`.
# Change it immediately, then enable the Tactical Media Broadcast Hub connector bridge.

# --- database (dedicated peertube-postgres service) ---
PEERTUBE_DB_HOSTNAME=peertube-postgres
PEERTUBE_DB_USERNAME=peertube
PEERTUBE_DB_PASSWORD=<set-same-as-below>
POSTGRES_USER=peertube
POSTGRES_PASSWORD=<set-same-as-above>
POSTGRES_DB=peertube

# --- object storage on R2 (zero egress) ---
PEERTUBE_OBJECT_STORAGE_ENABLED=true
PEERTUBE_OBJECT_STORAGE_ENDPOINT=https://e50adafec3c6aee02a328f28b967f699.r2.cloudflarestorage.com
PEERTUBE_OBJECT_STORAGE_REGION=auto
PEERTUBE_OBJECT_STORAGE_UPLOAD_ACL_PUBLIC_BUCKET=occupymedia-peertube-videos
PEERTUBE_OBJECT_STORAGE_UPLOAD_ACL_PRIVATE_BUCKET=occupymedia-peertube-playlists
PEERTUBE_OBJECT_STORAGE_CREDENTIALS_ACCESS_KEY=<R2_ACCESS_KEY>
PEERTUBE_OBJECT_STORAGE_CREDENTIALS_SECRET_KEY=<R2_SECRET_KEY>
# Videos are served through tube.occupymedia.cc (Cloudflare caches HLS segments);
# keep proxied URL mode so playback keys stay server-controlled.
PEERTUBE_OBJECT_STORAGE_PROXY=PRIVACY

# --- email via the postfix relay ---
PEERTUBE_SMTP_HOSTNAME=postfix
PEERTUBE_SMTP_PORT=25
PEERTUBE_SMTP_FROM=noreply@tube.occupymedia.cc
PEERTUBE_SMTP_TLS=false

# --- live (RTMP ingest from media-worker over the internal docker network) ---
PEERTUBE_RTMP_PORT=1935
PEERTUBE_LIVE_ENABLED=true
PEERTUBE_LIVE_TRANSCODING_ENABLED=true