env.example

# OpenCode sandbox version overrides
# This file is sourced by the Makefile. Values here override defaults.
# Copy this file to .env and adjust as needed: cp env.example .env
# OPENCODE_VERSION is derived from package.json by default;
# set it here only to override for testing or custom builds.

# Engram MCP version — used to download the engram binary in the Dockerfile
ENGRAM_VERSION=1.20.0
# buildx plugin version — enables BuildKit inside rootless DinD
BUILDX_VERSION=0.36.1
# SHA256 checksums for the artifacts above (build FAILS on mismatch or when
# empty). Refresh together with the versions:
#   curl -fsSL <artifact-url> | sha256sum
ENGRAM_SHA256=7dc3003318e303bee269a4772144f3ce01c8ec700bfd524aaec76770acd389ca
BUILDX_SHA256_AMD64=48af8a397ebd60178778bf63611dbcebe5f5e7a9be90eb9147b24b9587455778
BUILDX_SHA256_ARM64=5d0cafd9d16afe1a0f0d9529885344ace2cc99efdd531b6c783c5455a6001569

# Lemonade server hostname (used for --add-host mapping in docker run)
# Override to use a different hostname for the --add-host mapping
LEMONADE_HOST=lemonade.example.com
# IP address to map LEMONADE_HOST to (leave empty to skip --add-host)
HOST_LEMONADE=

# Test target hostname (used by test.sh for screenshot tests)
TARGET=example.com

# OpenCode server credentials (used by the 'server' target)
# Weak values (username-as-password or 'changeme') are refused unless
# ALLOW_WEAK_SERVER_CREDENTIALS=1 is set.
OPENCODE_SERVER_USERNAME=opencode
OPENCODE_SERVER_PASSWORD=changeme

# Bind address for the published server port ('make server')
# Use 0.0.0.0 to expose the server beyond localhost
SERVER_BIND=127.0.0.1

# Node.js TLS certificate verification inside the sandbox
# 1 (default) = verification ENABLED; custom CAs installed at build time are
#     honored via NODE_EXTRA_CA_CERTS
# 0 = INSECURE escape hatch: verification disabled, connections inside the
#     sandbox can be intercepted. Only use when explicitly needed.
STRICT_TLS=1

# Set to 1 to allow weak server credentials for 'make server'
ALLOW_WEAK_SERVER_CREDENTIALS=0

# Rootless Docker-in-Docker ('make run-dind'):
# the sandbox gets a private, user-namespaced Docker daemon (no host socket).
# Override device flags if your platform lacks /dev/fuse: DIND_DEVICE_FLAGS=
# Extra docker run flags can be passed via DIND_EXTRA_FLAGS=

# Detach key sequence for interactive containers. Docker's default
# (ctrl-p,ctrl-q) collides with the OpenCode TUI command palette (ctrl-p).
# Press ctrl-@ (NUL) twice in quick succession to detach. Set to an empty
# value to disable detaching entirely on recent Docker engines.
DETACH_KEYS=ctrl-@,ctrl-@