homeio

1import "server-only";
2
3import { z } from "zod";
4
5const envSchema = z.object({
6  NODE_ENV: z
7    .enum(["development", "test", "production"])
8    .default("development"),
9  DATABASE_URL: z
10    .string()
11    .url()
12    .default("postgresql://postgres:postgres@127.0.0.1:5432/home_server"),
13  PG_MAX_CONNECTIONS: z.coerce.number().int().min(1).max(20).default(10),
14  METRICS_CACHE_TTL_MS: z.coerce.number().int().min(250).default(2_000),
15  METRICS_PUBLISH_INTERVAL_MS: z.coerce.number().int().min(500).default(2_000),
16  SSE_HEARTBEAT_MS: z.coerce.number().int().min(1_000).default(15_000),
17  WEBSOCKET_ENABLED: z
18    .string()
19    .optional()
20    .transform((value) => value !== "false"),
21  AUTH_SESSION_SECRET: z
22    .string()
23    .min(16)
24    .default("dev-session-secret-change-me"),
25  AUTH_SESSION_HOURS: z.coerce
26    .number()
27    .int()
28    .min(1)
29    .max(24 * 30)
30    .default(168),
31  AUTH_PRIMARY_USERNAME: z.string().min(3).default("admin"),
32  AUTH_PRIMARY_PASSWORD: z.string().optional(),
33  AUTH_TOTP_ENCRYPTION_KEY: z.string().optional(),
34  LOG_LEVEL: z.enum(["debug", "info", "warn", "error"]).default("info"),
35  LOG_FILE_PATH: z.string().default("logs/home-server.log"),
36  LOG_TO_FILE: z
37    .string()
38    .optional()
39    .transform((value) => value !== "false"),
40  STORE_CATALOG_TTL_MS: z.coerce
41    .number()
42    .int()
43    .min(5_000)
44    .default(6 * 60 * 60_000), // 6 hours
45  STORE_MAX_CONCURRENT_OPERATIONS: z.coerce.number().int().min(1).max(20).default(3),
46  STORE_STACKS_ROOT: z.string().optional(),
47  STORE_APP_DATA_ROOT: z.string().optional(),
48  FILES_ROOT: z.string().optional(),
49  FILES_ALLOW_HIDDEN: z
50    .string()
51    .optional()
52    .transform((value) => value === "true"),
53  TERMINAL_WS_REQUIRE_AUTH: z
54    .string()
55    .optional()
56    .transform((value) => value !== "false"),
57  TERMINAL_MAX_SESSIONS_PER_USER: z.coerce
58    .number()
59    .int()
60    .min(1)
61    .max(10)
62    .default(2),
63  TERMINAL_IDLE_TIMEOUT_MS: z.coerce
64    .number()
65    .int()
66    .min(10_000)
67    .default(900_000),
68  TERMINAL_MAX_SESSION_MS: z.coerce
69    .number()
70    .int()
71    .min(60_000)
72    .default(3_600_000),
73  APP_GRID_REAL_ACTIONS: z
74    .string()
75    .optional()
76    .transform((value) => value !== "false"),
77  STORE_PRESERVE_INSTALLED_COMPOSE: z
78    .string()
79    .optional()
80    .transform((value) => value !== "false"),
81  FILES_ENHANCED_OPS: z
82    .string()
83    .optional()
84    .transform((value) => value !== "false"),
85  FILES_NETWORK_MOUNT_UID: z.coerce.number().int().min(0).optional(),
86  FILES_NETWORK_MOUNT_GID: z.coerce.number().int().min(0).optional(),
87  DOCKER_SOCKET_PATH: z.string().default("/var/run/docker.sock"),
88  DOCKER_COMPOSE_TIMEOUT_MS: z.coerce
89    .number()
90    .int()
91    .min(30_000)
92    .default(300_000),
93  FILES_SEARCH_TIMEOUT_MS: z.coerce
94    .number()
95    .int()
96    .min(1_000)
97    .default(10_000),
98  DBUS_HELPER_SOCKET_PATH: z
99    .string()
100    .default("/run/home-server/dbus-helper.sock"),
101  DEMO_MODE: z
102    .string()
103    .optional()
104    .transform((value) => value === "true"),
105  HOMEIO_TELEMETRY: z
106    .string()
107    .optional()
108    .transform((value) => value !== "false"),
109  HOMEIO_TELEMETRY_URL: z
110    .string()
111    .url()
112    .default("https://homeio.app/api/stats"),
113});
114
115const parsedEnv = envSchema.safeParse(process.env);
116
117if (!parsedEnv.success) {
118  const issues = parsedEnv.error.issues
119    .map((issue) => `${issue.path.join(".")}: ${issue.message}`)
120    .join("; ");
121  throw new Error(`Invalid server environment: ${issues}`);
122}
123
124const unsafeProductionSessionSecrets = new Set([
125  "dev-session-secret-change-me",
126  "change-me-to-a-random-32-char-secret",
127]);
128
129const isNextProductionBuild =
130  process.env.NEXT_PHASE === "phase-production-build" ||
131  process.env.npm_lifecycle_event === "build";
132
133if (parsedEnv.data.NODE_ENV === "production" && !isNextProductionBuild) {
134  if (
135    parsedEnv.data.AUTH_SESSION_SECRET.length < 32 ||
136    unsafeProductionSessionSecrets.has(parsedEnv.data.AUTH_SESSION_SECRET)
137  ) {
138    throw new Error(
139      "Invalid server environment: AUTH_SESSION_SECRET must be a non-default value with at least 32 characters in production",
140    );
141  }
142}
143
144const defaultStacksRoot =
145  parsedEnv.data.NODE_ENV === "production" ? "/DATA/AppData" : "DATA/AppData";
146const defaultAppDataRoot =
147  parsedEnv.data.NODE_ENV === "production" ? "/DATA/AppData" : "DATA/AppData";
148const defaultFilesRoot =
149  parsedEnv.data.NODE_ENV === "production" ? "/DATA" : "DATA";
150
151export const serverEnv = {
152  ...parsedEnv.data,
153  STORE_STACKS_ROOT: parsedEnv.data.STORE_STACKS_ROOT ?? defaultStacksRoot,
154  STORE_APP_DATA_ROOT: parsedEnv.data.STORE_APP_DATA_ROOT ?? defaultAppDataRoot,
155  FILES_ROOT: parsedEnv.data.FILES_ROOT ?? defaultFilesRoot,
156  FILES_ALLOW_HIDDEN: parsedEnv.data.FILES_ALLOW_HIDDEN ?? false,
157};
158