.env.example (5252B)
1 # transtation server configuration.
2 #
3 # NEVER COMMIT THIS FILE. Copy it to /opt/transtation/.env (container) or to
4 # /etc/transtation/server.env (native) and edit. Every value here is optional --
5 # with no config file at all the server provisions itself and works.
6 #
7 # These are CONFIG, not identity. They are read fresh on every boot, so changing
8 # one and restarting takes effect immediately: `docker compose up -d`, or
9 # `systemctl restart transtation`. Your Reality keypair and user UUIDs live in
10 # the data directory, not here, and nothing in this file touches them.
11
12 # ---------------------------------------------------------------- networking
13
14 # Public port clients connect to. 443 blends in best; change it only if
15 # something else on the host already owns 443.
16 #PORT=443
17
18 # Public address clients dial. Auto-detected from cloudflare.com/cdn-cgi/trace
19 # on first boot. Set it if the host is behind NAT, has several public IPs, or
20 # you point a domain at it.
21 #HOST=203.0.113.10
22
23 # ---------------------------------------------------------------- camouflage
24
25 # The real site your server impersonates.
26 #
27 # LEAVE THIS UNSET. On first boot transtation picks one, the way a commercial
28 # VPN picks your nearest exit rather than handing you a server list.
29 #
30 # What it optimises for, in order:
31 #
32 # 1. Can the name carry your traffic without looking wrong? Your clients' ISP
33 # sees their traffic labelled with this name and judges the VOLUME AND
34 # SHAPE of it against what the name implies. Hours of sustained multi-
35 # gigabyte download addressed to a corporate brochure page is not a
36 # plausible thing for a human to be doing, and DPI drops it. The same bytes
37 # pulled from a video service are what everyone does all evening. So
38 # candidates are classed bulk / mixed / light, and this dominates the score.
39 # 2. Does REALITY actually work with it? TLS 1.3 and a certificate chain with
40 # headroom under the size where the handshake silently dies.
41 # 3. How far away is it? Measured TLS handshake time, because your server
42 # re-dials this site on every client connection.
43 # 4. Is it in the same region as the traffic? Worth 150ms of latency.
44 #
45 # The choice is STICKY. It is stored with your identity and never re-picked on
46 # its own, because every share link carries `sni=` and silently changing it
47 # would break every client you have already configured.
48 #
49 # transtation sni what was chosen, and why
50 # transtation sni auto probe again and re-pick (invalidates links)
51 # transtation sni <domain> set by hand (invalidates links)
52 #
53 # Set this only to override permanently, and follow it with `transtation
54 # verify`. Two hard requirements: TLS 1.3, and a chain under about 5200 bytes.
55 # `www.microsoft.com` (5879) fails the second one silently -- healthy server,
56 # and every client gets the real website instead. Apple and iCloud domains are
57 # rejected outright: Xray warns they get your IP blocked by the GFW.
58 #SNI=dl.google.com
59
60 # The address the Reality handshake is actually forwarded to. Defaults to
61 # $SNI:443 and you almost never need to set this separately.
62 #DEST=dl.google.com:443
63
64 # Where your clients connect FROM, as a two-letter country code. The DPI that
65 # judges your traffic belongs to their ISP, not to your server's datacentre, so
66 # this is the region the dest should look native to. Defaults to the server's
67 # own country, which is right when your server is near or relevant to your
68 # users. Set it when it is not -- clients in Korea using a server in Brazil,
69 # say.
70 #CLIENT_REGION=KR
71
72 # ------------------------------------------------------------------- egress
73
74 # Cloudflare WARP egress. On by default: your traffic leaves from a Cloudflare
75 # IP instead of your VPS's, so the destination never sees your server's address
76 # and cloud-IP blocklists do not apply.
77 #
78 # Set WARP=0 to egress directly from the VPS IP instead. That is simpler and
79 # faster, but exposes the address that is tied to your name and payment method.
80 # It also means outbound port 25 is not blocked for you by Cloudflare — which
81 # is why transtation blocks it itself.
82 #WARP=1
83
84 # WARP endpoint. Pinned to a literal IP on purpose: resolving
85 # engage.cloudflareclient.com can return an IPv6 address on a host with no IPv6
86 # route, and Xray picks between the A and AAAA records at random. Override only
87 # if this anycast address does not handshake from your provider.
88 #WARP_ENDPOINT=162.159.192.1:2408
89
90 # ------------------------------------------------------------------- clients
91
92 # Name of the user created on first boot.
93 #USER_NAME=main
94
95 # Minimum client version the Reality server accepts. transtation pins this to
96 # 0.0.0 so no client is ever silently rejected. Newer Xray versions default it
97 # to a real floor, and the failure mode is nasty: the server starts fine, the
98 # port listens, and rejected clients see the real target website instead of an
99 # error. Raise it only if you know every client you own is newer.
100 #MIN_CLIENT_VER=0.0.0
101
102 # ------------------------------------------------------------------ advanced
103
104 # Skip the startup TLS probe against $SNI. The probe only warns; it never
105 # blocks startup. Set to 1 on hosts with slow or filtered outbound HTTPS.
106 #SKIP_DEST_CHECK=0