From 966efb5b20cf4b2f3b94e0c6c56dc3342cf55ed0 Mon Sep 17 00:00:00 2001
From: nathan <nathan@castaldifamily.com>
Date: Wed, 29 Apr 2026 10:21:07 -0400
Subject: [PATCH] feat: enhance SnapOtter service configuration with additional
 environment variables and middleware

Co-authored-by: Copilot <copilot@github.com>
---
 nodes/heimdall/snapotter/compose.yaml | 52 +++++++++++++++++++++++----
 1 file changed, 46 insertions(+), 6 deletions(-)

diff --git a/nodes/heimdall/snapotter/compose.yaml b/nodes/heimdall/snapotter/compose.yaml
index 48b3c23..cca1488 100644
--- a/nodes/heimdall/snapotter/compose.yaml
+++ b/nodes/heimdall/snapotter/compose.yaml
@@ -6,12 +6,51 @@ services:
     networks:
       - proxy-net
     environment:
-      # - AUTH_ENABLED=${AUTH_ENABLED}
-      # - DEFAULT_USERNAME=${DEFAULT_USERNAME}
-      # - DEFAULT_PASSWORD=${DEFAULT_PASSWORD}
-      - MAX_USERS=${MAX_USERS}
-      - SESSION_DURATION_HOURS=${SESSION_DURATION_HOURS}
-      - TRUST_PROXY=${TRUST_PROXY}
+      # Server
+      - PORT=${PORT:-1349}
+      - AUTH_ENABLED=${AUTH_ENABLED:-false}
+      #DEFAULT_USERNAME=admin
+      #DEFAULT_PASSWORD=admin
+      - STORAGE_MODE=${STORAGE_MODE:-local}
+      - TRUST_PROXY=${TRUST_PROXY:-true}
+
+      # Cleanup
+      - FILE_MAX_AGE_HOURS=${FILE_MAX_AGE_HOURS:-72}
+      - CLEANUP_INTERVAL_MINUTES=${CLEANUP_INTERVAL_MINUTES:-60}
+
+      # Upload & Batch (0 = unlimited)
+      - MAX_UPLOAD_SIZE_MB=${MAX_UPLOAD_SIZE_MB:-0}
+      - MAX_BATCH_SIZE=${MAX_BATCH_SIZE:-0}
+      - CONCURRENT_JOBS=${CONCURRENT_JOBS:-10}
+      - MAX_MEGAPIXELS=${MAX_MEGAPIXELS:-0}
+
+      # Rate limiting (0 = disabled)
+      - RATE_LIMIT_PER_MIN=${RATE_LIMIT_PER_MIN:-0}
+
+      # Users (0 = unlimited)
+      - MAX_USERS=${MAX_USERS:-0}
+
+      # Processing (0 = auto/unlimited)
+      - MAX_WORKER_THREADS=${MAX_WORKER_THREADS:-0}
+      - PROCESSING_TIMEOUT_S=${PROCESSING_TIMEOUT_S:-0}
+      - MAX_PIPELINE_STEPS=${MAX_PIPELINE_STEPS:-0}
+      - MAX_CANVAS_PIXELS=${MAX_CANVAS_PIXELS:-0}
+      - MAX_SVG_SIZE_MB=${MAX_SVG_SIZE_MB:-0}
+      - MAX_LOGO_SIZE_KB=${MAX_LOGO_SIZE_KB:-2048}
+      - MAX_SPLIT_GRID=${MAX_SPLIT_GRID:-100}
+      - MAX_PDF_PAGES=${MAX_PDF_PAGES:-0}
+      - SESSION_DURATION_HOURS=${SESSION_DURATION_HOURS:-168}
+      - LOGIN_ATTEMPT_LIMIT=${LOGIN_ATTEMPT_LIMIT:-10}
+
+      # Set to true in CI/dev to skip the forced password-change on the default admin
+      # SKIP_MUST_CHANGE_PASSWORD=false
+      - SKIP_MUST_CHANGE_PASSWORD=${SKIP_MUST_CHANGE_PASSWORD:-false}
+      - DB_PATH=${DB_PATH:-./data/snapotter.db}
+      - WORKSPACE_PATH=${WORKSPACE_PATH:-./tmp/workspace}
+      - FILES_STORAGE_PATH=${FILES_STORAGE_PATH:-./data/files}
+      - DEFAULT_THEME=${DEFAULT_THEME}
+      - DEFAULT_LOCALE=${DEFAULT_LOCALE:-en}
+      - APP_NAME=${APP_NAME:-snapotter}
     restart: unless-stopped
     labels:
       - "traefik.enable=true"
@@ -21,6 +60,7 @@ services:
       - "traefik.http.routers.snapotter.tls.certresolver=cloudflare"
       - "traefik.http.routers.snapotter.service=snapotter"
       - "traefik.http.services.snapotter.loadbalancer.server.port=1349"
+      - "traefik.http.routers.snapotter.middlewares=authentik-auth@file"
 
 networks:
   proxy-net: