-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.docker.example
More file actions
199 lines (190 loc) · 8.77 KB
/
Copy path.env.docker.example
File metadata and controls
199 lines (190 loc) · 8.77 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
# -----------------------------------------------------------------------------
# Runtime & networking
# -----------------------------------------------------------------------------
# TCP port exposed by the API process inside the container.
PORT=3000
# Host port published by Docker Compose.
API_PORT=3000
# Node runtime environment label. The dev compose overlay overrides this to development.
NODE_ENV=production
# Public domain served by nginx and certbot during deployments.
APP_DOMAIN=localhost
# Contact email used when requesting Let's Encrypt certificates.
SSL_EMAIL=hello@hexabot.ai
# External URL exposed by the API container (used for links in emails, etc.).
API_ORIGIN=http://localhost:3000/api
# Public origin for the web UI that nginx should proxy.
FRONTEND_BASE_URL=http://localhost:8080
# Comma-separated list of origins allowed by CORS and Socket.IO.
FRONTEND_ORIGIN=http://localhost:8080,http://localhost:3000,http://localhost:5173
# Enables optional single-sign-on integrations.
SSO_ENABLED=false
# Set to true when TLS is terminated before the API (affects trust proxy and cookies).
HTTPS_ENABLED=false
# Only the primary API node should run auto-migrations in a clustered setup.
API_IS_PRIMARY_NODE=true
# Translation file name (without extension) loaded by the i18n subsystem.
I18N_TRANSLATION_FILENAME=messages
# Enables Nest Commander CLI execution when set to true.
HEXABOT_CLI=false
# Default admin user seeded on first startup in non-production environments.
SEED_ADMIN_FIRST_NAME=admin
# Default admin user last name used during initial seeding.
SEED_ADMIN_LAST_NAME=admin
# Default admin user email used during initial seeding.
SEED_ADMIN_EMAIL=admin@admin.admin
# Default admin user password used during initial seeding.
SEED_ADMIN_PASSWORD=adminadmin
# -----------------------------------------------------------------------------
# Sessions & security
# -----------------------------------------------------------------------------
# Secret used to sign and encrypt Sails sessions; always change in production.
SESSION_SECRET=f661ff500fff6b0c8f91310b6fff6b0c
# Name of the session cookie shared across the stack.
SESSION_NAME=s.id
# Session cookie lifetime in milliseconds (default 24h).
SESSION_MAX_AGE=86400000
# Number of sessions cleaned per sweep (0 disables the limit).
SESSION_CLEANUP_LIMIT=0
# Allows using SQL subqueries during session cleanup (disable for SQLite).
SESSION_LIMIT_SUBQUERY=true
# TTL (in seconds) enforced by the session store; uncomment to override cookie lifetime.
# SESSION_TTL_SECONDS=86400
# Cost factor for hashing secrets (used by JWTs and signed URLs).
SALT_LENGTH=12
# Secret used to sign user authentication JWTs.
JWT_SECRET=dev_only
# Expiration for auth JWTs (supports ms or duration strings, e.g., 24h).
JWT_EXPIRES_IN=60
# Secret used to sign password reset tokens.
PASSWORD_RESET_SECRET=dev_only
# Expiration for password reset tokens.
PASSWORD_RESET_EXPIRES_IN=1h
# Secret used to sign confirm-account tokens.
CONFIRM_ACCOUNT_SECRET=dev_only
# Expiration for confirm-account tokens.
CONFIRM_ACCOUNT_EXPIRES_IN=1h
# Secret used to sign public download URLs.
SIGNED_URL_SECRET=dev_only
# Expiration applied to signed download URLs.
SIGNED_URL_EXPIRES_IN=1h
# -----------------------------------------------------------------------------
# MCP server
# -----------------------------------------------------------------------------
# Enables the secured Streamable HTTP MCP endpoint at /api/mcp.
MCP_ENABLED=true
# Metadata reported to MCP clients.
MCP_SERVER_NAME=hexabot-api
MCP_SERVER_TITLE=Hexabot API MCP Server
MCP_SERVER_VERSION=1.0.0
MCP_SERVER_DESCRIPTION=Manage Hexabot workflows, runs, memory, credentials, actions, and CMS content.
MCP_SERVER_INSTRUCTIONS=Use these tools to inspect and manage Hexabot API resources. Credential values are never exposed.
# -----------------------------------------------------------------------------
# File uploads
# -----------------------------------------------------------------------------
# Directory (inside the container) where uploaded files are stored.
UPLOAD_DIR=/uploads
# Maximum allowed upload size in bytes (default 50 MB).
UPLOAD_MAX_SIZE_IN_BYTES=52428800
# Storage driver used by Multer (disk or memory).
STORAGE_MODE=disk
# -----------------------------------------------------------------------------
# Database
# -----------------------------------------------------------------------------
# Allows the API to auto-run pending migrations on startup.
DB_AUTO_MIGRATE=true
# Database backend to use (postgres or sqlite; sqlite uses better-sqlite3). The Postgres compose overlay sets this to postgres.
DB_TYPE=sqlite
# Hostname of the Postgres instance.
DB_HOST=postgres
# Port exposed by the Postgres instance.
DB_PORT=5432
# Username for the application database. The Postgres compose overlay maps this to POSTGRES_USER.
DB_USERNAME=dev_only
# Password for the application database. The Postgres compose overlay maps this to POSTGRES_PASSWORD.
DB_PASSWORD=dev_only
# Name of the application database. The Postgres compose overlay maps this to POSTGRES_DB.
DB_NAME=hexabot
# Path to the SQLite file, resolved from /app inside the container.
DB_SQLITE_PATH=./data/hexabot.sqlite
# Optional connection string that overrides the discrete DB_* values when provided.
# DB_URL=postgresql://dev_only:dev_only@postgres:5432/hexabot
# Lets TypeORM auto-sync entities with the database schema (use only for dev).
DB_SYNCHRONIZE=true
# Enables verbose SQL logging from TypeORM.
DB_LOGGING=false
# Schema name used for Postgres connections.
DB_SCHEMA=public
# Default credentials for the optional pgAdmin container.
PGADMIN_DEFAULT_EMAIL=dev@hexabot.ai
# Default password for the optional pgAdmin container.
PGADMIN_DEFAULT_PASSWORD=dev_only
# Runs pgAdmin in local desktop mode when the dev overlay is enabled.
PGADMIN_CONFIG_SERVER_MODE=False
# Host port published by the optional pgAdmin compose overlay.
PGADMIN_PORT=9000
# -----------------------------------------------------------------------------
# Audit log
# -----------------------------------------------------------------------------
# Enables audit logging for controller decorators and TypeORM write subscribers.
AUDIT_LOG_ENABLED=true
# Single audit backend: database, opentelemetry-http, opentelemetry-grpc, or clickhouse.
AUDIT_LOG_BACKEND=database
# When true, audit backend failures fail the business operation.
AUDIT_LOG_FAIL_CLOSED=false
# Service metadata attached to exported audit records.
AUDIT_LOG_SERVICE_NAME=hexabot-api
AUDIT_LOG_SERVICE_NAMESPACE=@hexabot-ai/api
AUDIT_LOG_SERVICE_ENVIRONMENT=development
# Comma-separated field names masked in before/after/diff payloads.
AUDIT_LOG_MASK_FIELDS=password,resetToken,reset_token,token,secret,authorization,apiKey,privateKey,value
# Optional OpenTelemetry exporter configuration.
# AUDIT_LOG_OTEL_URL=http://localhost:4318/v1/logs
# AUDIT_LOG_OTEL_HOSTNAME=localhost:4318
# AUDIT_LOG_OTEL_HEADERS={"authorization":"Bearer dev_only"}
# AUDIT_LOG_OTEL_TIMEOUT_MILLIS=10000
# AUDIT_LOG_OTEL_CONCURRENCY_LIMIT=10
# Optional ClickHouse exporter configuration.
# AUDIT_LOG_CLICKHOUSE_URL=http://localhost:8123
AUDIT_LOG_CLICKHOUSE_DATABASE=hexabot_auditlog
# AUDIT_LOG_CLICKHOUSE_LOG_EXPIRED_DAYS=180
# -----------------------------------------------------------------------------
# Cache / Redis
# -----------------------------------------------------------------------------
# Default TTL (milliseconds) for the in-memory cache.
CACHE_TTL=300000
# Switches the cache driver to Redis when set to true. The Redis compose overlay sets this to true.
REDIS_ENABLED=false
# Hostname of the Redis instance (used when REDIS_ENABLED=true).
REDIS_HOST=redis
# Port exposed by the Redis instance.
REDIS_PORT=6379
# Set to true when connecting to Redis over TLS (rediss://).
REDIS_SECURE=false
# Optional Redis username when ACLs are enabled.
REDIS_USER=
# Optional Redis password or access key.
REDIS_PASSWORD=
# -----------------------------------------------------------------------------
# Email / SMTP
# -----------------------------------------------------------------------------
# Enables transactional emails (keep false locally unless smtp4dev is running).
EMAIL_SMTP_ENABLED=false
# SMTP host used to send transactional emails.
EMAIL_SMTP_HOST=smtp4dev
# SMTP port exposed by the server above.
EMAIL_SMTP_PORT=25
# Enforces TLS for SMTP connections when set to true.
EMAIL_SMTP_SECURE=false
# Username for the SMTP server.
EMAIL_SMTP_USER=dev_only
# Password for the SMTP server.
EMAIL_SMTP_PASS=dev_only
# Default from address for outgoing emails.
EMAIL_SMTP_FROM=noreply@example.com
# -----------------------------------------------------------------------------
# Frontend build inputs
# -----------------------------------------------------------------------------
# API origin injected into the Vite dev server when the frontend is run outside Docker.
VITE_API_ORIGIN=http://localhost:3000/api
AWS_REGION=us-east-1