#Server Configuration

These configuration parameters control monetr's actual HTTP server as well as some configuration around cookies.

server:
  listenPort: 4000
  listenAddress: 0.0.0.0
  externalUrl: <http://localhost:4000>
  statsPort: 9000
  uiCacheHours: 336 # 14 days in hours, determines cache headers for UI assets.
  tlsCertificate: </etc/monetr/tls.crt>
  tlsKey: </etc/monetr/tls.key>
  tlsClientCertificateAuthority: </etc/monetr/ca.crt>
  trustedProxies:
    - <10.0.0.0/8>
  clientIpHeader: X-Forwarded-For
  cookies:
    sameSiteStrict: <true|false>
    secure: <true|false>
    name: M-Token

The following environment variables map to the following configuration file fields. Each field is documented below.

MONETR_SERVER_TRUSTED_PROXIES takes a comma separated list, like 10.0.0.0/8,192.168.1.0/24.

#Client IP Address

If monetr is behind a reverse proxy like Nginx, HAProxy, or Traefik, every connection monetr sees comes from the proxy and not from the actual person using monetr. Proxies usually pass the real address along in a header, but a client can put anything it wants in that same header. So by default monetr ignores those headers completely and just uses the address of the connection.

To have monetr read the header, set trustedProxies to the ranges your proxy connects to monetr from. Only list ranges you actually control. If you list something too broad, like a whole public range, then anyone in it can pretend to be any IP address they want.

By default monetr reads X-Forwarded-For. That header can have several addresses in it, one for each hop, so monetr starts from the hop closest to it and works back, skipping any address in trustedProxies. The first address that isn't one of your proxies is the client.

If your proxy uses a different header, like X-Real-IP, set clientIpHeader to that header. Any header other than X-Forwarded-For is expected to hold just one address that your proxy set, and monetr only uses it when the connection actually came from one of your trustedProxies. If the header shows up more than once, monetr uses the last value, since that's the one your proxy added. It is best to have your proxy replace the header rather than add to it, for example with Nginx:

proxy_set_header X-Real-IP $remote_addr;

Or with HAProxy:

http-request set-header X-Real-IP %[src]

#Client Certificates

If all traffic to monetr comes from something you control, like an Nginx reverse proxy on an internal network, you can require clients to present a certificate by setting tlsClientCertificateAuthority. monetr will then reject any connection that does not present a certificate signed by that certificate authority. This requires tlsCertificate and tlsKey to be set as well.

This is not the chain for your server's certificate. If you are using certificates from a public certificate authority like Let's Encrypt then leave this blank, otherwise browsers connecting directly to monetr will be rejected.

Client certificates must include the clientAuth extended key usage. For Nginx the client certificate is provided using proxy_ssl_certificate and proxy_ssl_certificate_key.

#Cookies

monetr uses cookies for authentication, cookies can be configured depending on whether or not you are using HTTPS for your self hosted instance. But all cookies monetr issues are HTTP only such that they are never visible to client side code.

Note: None of these can be configured via environment variables at this time.