.env.dev.example

# When adding additional environment variables, the schema in "/src/env.mjs"
# should be updated accordingly.

# ============================================================================
# DOCKER CONFIGURATION
# ============================================================================
# These variables configure docker-compose port mappings and container names
# To run multiple instances, copy this file to .env and customize these values

# Host Ports
# POSTGRES_HOST_PORT=5432
# REDIS_HOST_PORT=6379
# CLICKHOUSE_HTTP_PORT=8123
# CLICKHOUSE_NATIVE_PORT=9000
# MINIO_API_PORT=9090
# MINIO_CONSOLE_PORT=9091
# WEB_HOST_PORT=3000
# WORKER_HOST_PORT=3030

# Container Names
# POSTGRES_CONTAINER_NAME=langfuse-postgres
# CLICKHOUSE_CONTAINER_NAME=langfuse-clickhouse
# REDIS_CONTAINER_NAME=langfuse-redis
# MINIO_CONTAINER_NAME=langfuse-minio
# WEB_CONTAINER_NAME=langfuse-web
# WORKER_CONTAINER_NAME=langfuse-worker

# Volumes
# POSTGRES_VOLUME_NAME=langfuse_postgres_data
# CLICKHOUSE_DATA_VOLUME_NAME=langfuse_clickhouse_data
# CLICKHOUSE_LOGS_VOLUME_NAME=langfuse_clickhouse_logs
# MINIO_VOLUME_NAME=langfuse_minio_data

# Network
# DOCKER_NETWORK_NAME=langfuse-network

# ============================================================================
# APPLICATION CONFIGURATION
# ============================================================================

# Prisma
# https://www.prisma.io/docs/reference/database-reference/connection-urls#env
DIRECT_URL="postgresql://postgres:postgres@localhost:5432/postgres"
DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres"

# Clickhouse
CLICKHOUSE_MIGRATION_URL="clickhouse://localhost:9000"
CLICKHOUSE_URL="http://localhost:8123"
# CLICKHOUSE_READ_ONLY_URL="http://localhost:8123"  # Optional: read replica for legacy tables
# CLICKHOUSE_EVENTS_READ_ONLY_URL="http://localhost:8123"  # Optional: read replica for events table queries
CLICKHOUSE_USER="clickhouse"
CLICKHOUSE_PASSWORD="clickhouse"
CLICKHOUSE_CLUSTER_ENABLED="false"

# Next Auth
# You can generate a new secret on the command line with:
# openssl rand -base64 32
# https://next-auth.js.org/configuration/options#secret
# NEXTAUTH_SECRET=""
NEXTAUTH_URL="http://localhost:3000"
NEXTAUTH_SECRET="secret"

# Langfuse Cloud Environment
NEXT_PUBLIC_LANGFUSE_CLOUD_REGION="DEV"
# Dev-only: override the legacy blob-export cutoff date for local testing.
# Set to a past date (e.g. 2020-01-01T00:00:00.000Z) to make every project
# post-cutoff, or a future date (e.g. 2099-01-01T00:00:00.000Z) to grandfather
# all projects. Must be a valid ISO 8601 datetime string. Leave unset in prod.
# NEXT_PUBLIC_LANGFUSE_BLOB_EXPORT_CUTOFF=
# Same, for the integration-level cutoff applied to the blob storage
# integration row's creation date instead of the project's.
# NEXT_PUBLIC_LANGFUSE_BLOB_EXPORTER_CUTOFF=
# Integration-level cutoff for PostHog/Mixpanel export sources.
# NEXT_PUBLIC_LANGFUSE_ANALYTICS_EXPORTER_CUTOFF=

# Langfuse experimental features
LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES="false"

# Salt for API key hashing
SALT="salt"

# Email
EMAIL_FROM_ADDRESS=""  # Defines the email address to use as the from address.
SMTP_CONNECTION_URL=""  # Defines the connection url for smtp server.
CLOUD_CRM_EMAIL=""  # Optional BCC address for usage threshold emails (e.g., for CRM integration like HubSpot)

# S3 Batch Exports
LANGFUSE_S3_BATCH_EXPORT_ENABLED=true
LANGFUSE_S3_BATCH_EXPORT_BUCKET=langfuse
LANGFUSE_S3_BATCH_EXPORT_ACCESS_KEY_ID=minio
LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY=miniosecret
LANGFUSE_S3_BATCH_EXPORT_REGION=us-east-1
LANGFUSE_S3_BATCH_EXPORT_ENDPOINT=http://localhost:9090
## Necessary for minio compatibility
LANGFUSE_S3_BATCH_EXPORT_FORCE_PATH_STYLE=true
LANGFUSE_S3_BATCH_EXPORT_PREFIX=exports/

# S3 Media Upload LOCAL
LANGFUSE_S3_MEDIA_UPLOAD_BUCKET=langfuse
LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID=minio
LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY=miniosecret
LANGFUSE_S3_MEDIA_UPLOAD_REGION=us-east-1
LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT=http://localhost:9090
## Necessary for minio compatibility
LANGFUSE_S3_MEDIA_UPLOAD_FORCE_PATH_STYLE=true
LANGFUSE_S3_MEDIA_UPLOAD_PREFIX=media/
# Opt in to extracting and uploading media embedded in OTEL span attributes.
LANGFUSE_OTEL_MEDIA_UPLOAD_ENABLED=false

# S3 Event Bucket Upload
## Set to true to test uploading all events to S3
LANGFUSE_S3_EVENT_UPLOAD_BUCKET=langfuse
LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID=minio
LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY=miniosecret
LANGFUSE_S3_EVENT_UPLOAD_REGION=us-east-1
LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT=http://localhost:9090
## Necessary for minio compatibility
LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE=true
LANGFUSE_S3_EVENT_UPLOAD_PREFIX=events/
## Per-segment byte budget for S3 event keys built from entity IDs.
## Default 2048 is above idSchema's 800-byte cap,
## so length-driven hashing is disabled out of the box.
# LANGFUSE_S3_EVENT_KEY_MAX_SEGMENT_BYTES=2048

# Set during docker build of application
# Used to disable environment verification at build time
# DOCKER_BUILD=1

REDIS_HOST="127.0.0.1"
REDIS_PORT=6379
REDIS_AUTH="myredissecret"
# REDIS_KEY_PREFIX=""  # Optional: Prefix for Redis keys (useful for multi-tenant Redis instances)
                       # BullMQ queues will use this via BullMQ's native prefix option
                       # Cache operations will use this via ioredis keyPrefix
# LANGFUSE_BULLMQ_SKIP_REDIS_VERSION_CHECK="false"  # Set to true for Redis-compatible services that report a non-Redis version
# REDIS_SOCKET_TIMEOUT_MS=30000  # Optional: Socket watchdog for all Redis connections; 0 disables, otherwise >= 10000
# REDIS_SENTINEL_ENABLED="false"
# REDIS_SENTINEL_TLS_ENABLED="false" # Requires REDIS_TLS_ENABLED="true"; otherwise ignored.
# REDIS_SENTINEL_NODES="sentinel1:26379,sentinel2:26379"
# REDIS_SENTINEL_MASTER_NAME="mymaster"
# REDIS_SENTINEL_USERNAME=""
# REDIS_SENTINEL_PASSWORD=""

# openssl rand -hex 32 used only here
ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000

# speeds up local development by not executing init scripts on server startup
NEXT_PUBLIC_LANGFUSE_RUN_NEXT_INIT="false"

# For SDK integration tests to pass, decrease the ingestion queue delay by uncommenting the env vars:
# LANGFUSE_INGESTION_QUEUE_DELAY_MS=10
# LANGFUSE_INGESTION_CLICKHOUSE_WRITE_INTERVAL_MS=10
# LANGFUSE_EVAL_EXECUTION_WORKER_CONCURRENCY=5
# LANGFUSE_LLM_AS_JUDGE_EXECUTION_WORKER_CONCURRENCY=5

# Code-based eval dispatchers. Local dev defaults to the insecure in-process dispatcher.
# To explicitly use the local dispatcher, set:
# LANGFUSE_CODE_EVAL_DISPATCHER=insecure-local
# To test the AWS Lambda dispatcher against Floci, set:
# LANGFUSE_CODE_EVAL_DISPATCHER=aws-lambda
# LANGFUSE_CODE_EVAL_AWS_LAMBDA_ENDPOINT=http://localhost:4566
# Override Lambda function names if your deployment uses non-default names:
# LANGFUSE_CODE_EVAL_AWS_LAMBDA_NODE_FUNCTION_NAME=code-based-eval-executor-node
# LANGFUSE_CODE_EVAL_AWS_LAMBDA_PYTHON_FUNCTION_NAME=code-based-eval-executor-python
# Override the local dispatcher execution timeout (default: 2000ms):
# LANGFUSE_CODE_EVAL_LOCAL_TIMEOUT_MS=2000

# Slack credentials for development
SLACK_CLIENT_ID=your_slack_client_id
SLACK_CLIENT_SECRET=your_slack_client_secret
SLACK_STATE_SECRET=your_slack_state_secret
# Optional internal feedback sink for feedback intake endpoints
# LANGFUSE_FEEDBACK_INTAKE_SLACK_WEBHOOK=

# Langfuse AI instance for tracing, prompts
LANGFUSE_AI_FEATURES_PUBLIC_KEY="pk-lf-1234567890"
LANGFUSE_AI_FEATURES_SECRET_KEY="sk-lf-1234567890"
LANGFUSE_AI_FEATURES_HOST="http://localhost:3000"
LANGFUSE_AI_FEATURES_PROJECT_ID=7a88fb47-b4e2-43b8-a06c-a5ce950dc53a

# Self-hosted only: allow internal LLM proxy hosts/IPs for LLM connection base URLs.
# LANGFUSE_LLM_CONNECTION_WHITELISTED_HOST=localhost
# LANGFUSE_LLM_CONNECTION_WHITELISTED_IPS=127.0.0.1,::1
# LANGFUSE_LLM_CONNECTION_WHITELISTED_IP_SEGMENTS=127.0.0.0/8
# Self-hosted only: allow internal hosts/IPs for user-configured blob storage endpoints.
# LANGFUSE_BLOB_STORAGE_ENDPOINT_WHITELISTED_HOST=localhost
# LANGFUSE_BLOB_STORAGE_ENDPOINT_WHITELISTED_IPS=127.0.0.1,::1
# LANGFUSE_BLOB_STORAGE_ENDPOINT_WHITELISTED_IP_SEGMENTS=127.0.0.0/8
# Allow internal IdP hosts/IPs for SSO OIDC discovery validation.
# LANGFUSE_SSO_DISCOVERY_WHITELISTED_HOST=localhost
# LANGFUSE_SSO_DISCOVERY_WHITELISTED_IPS=127.0.0.1,::1
# LANGFUSE_SSO_DISCOVERY_WHITELISTED_IP_SEGMENTS=127.0.0.0/8

# Langfuse AI Bedrock credentials
AWS_ACCESS_KEY_ID="A123456789"
AWS_SECRET_ACCESS_KEY="SAK123456789"
LANGFUSE_LLM_CONNECTION_BEDROCK_API_KEY="1234567890abcdef"
LANGFUSE_AWS_BEDROCK_REGION="eu-west-1"
# Default model for AI features. Search-bar filter generation prefers the small
# model below and falls back to this model when the small model is not configured.
LANGFUSE_AWS_BEDROCK_MODEL="eu.anthropic.claude-opus-4-8"
LANGFUSE_AWS_BEDROCK_SMALL_MODEL="eu.anthropic.claude-haiku-4-5-20251001-v1:0"
LANGFUSE_IN_APP_AGENT_AWS_PROFILE="playground"
# Self-hosted Assistant instance switch. Unset or "false" hides Assistant.
# Cloud is on unless this is "false".
# LANGFUSE_IN_APP_AGENT_ENABLED="true"

# In-app agent sandbox. Local development defaults to the dangerous docker provider.
# Set to enable sandboxing locally. Leave unset to disable sandbox tools entirely.
# LANGFUSE_IN_APP_AGENT_SANDBOX_PROVIDER="dangerous-docker"
# To test the Lambda MicroVM provider instead:
# Set to enable the Lambda microvm sandbox. Leave unset to disable sandboxing entirely.
# LANGFUSE_IN_APP_AGENT_SANDBOX_PROVIDER="lambda-microvm"
# Required:
# LANGFUSE_IN_APP_AGENT_SANDBOX_AWS_LAMBDA_MICROVM_IMAGE_IDENTIFIER="arn:aws:lambda:us-east-1:123456789012:microvm-image:langfuse-in-app-agent-sandbox"
# LANGFUSE_IN_APP_AGENT_SANDBOX_AWS_LAMBDA_MICROVM_EXECUTION_ROLE_ARN="arn:aws:iam::123456789012:role/langfuse-in-app-agent-sandbox"
# LANGFUSE_IN_APP_AGENT_SANDBOX_AWS_LAMBDA_MICROVM_REGION="us-east-1"
# Optional: overrides Lambda's default INTERNET_EGRESS connector.
# LANGFUSE_IN_APP_AGENT_SANDBOX_AWS_LAMBDA_MICROVM_EGRESS_NETWORK_CONNECTOR_ARN="arn:aws:lambda:us-east-1:123456789012:network-connector:langfuse-in-app-agent-sandbox-egress"

# Turns run in background by default; without the consumer they die at queue_timeout.
QUEUE_CONSUMER_IN_APP_AGENT_RUN_QUEUE_IS_ENABLED="true"
# LANGFUSE_IN_APP_AGENT_RUN_QUEUE_PROCESSING_CONCURRENCY=5

# Reconciles stale runs that nobody reopened, then reports remainders.
# LANGFUSE_IN_APP_AGENT_INTEGRITY_RUNNER_ENABLED="false"
# LANGFUSE_IN_APP_AGENT_INTEGRITY_RUNNER_INTERVAL_MS=900000

# Web-only admission ceilings.
# LANGFUSE_IN_APP_AGENT_MAX_ACTIVE_RUNS_PER_USER=5
# LANGFUSE_IN_APP_AGENT_MAX_ACTIVE_RUNS_PER_ORG=20

# V4 migration flags. Pinned to dual write mode to ensure we cover the tests;
# bare deployments get the flipped v4 code defaults (events_only / direct).
# Write target: `legacy` | `dual` | `events_only`.
LANGFUSE_MIGRATION_V4_WRITE_MODE=dual
# Gate the V4 events_full read paths (UI, tRPC, v2 APIs, observations API).
# Self-hosted `dual` deployments must set this to `true` to offer users the V4
# preview toggle; with `dual` + `false` the preview stays unavailable to users.
LANGFUSE_MIGRATION_V4_ALLOW_PREVIEW_OPT_IN=true
# OTel ingestion behaviour: `dual_write` (SDK-version dispatch) or `direct`.
LANGFUSE_MIGRATION_V4_NATIVE_OTEL_BEHAVIOUR=dual_write
# Cloud-only rollout boundary (ISO date) for automatic direct OTel writes:
# organizations created on/after this date direct-write plain-OTel traffic.
# Unset disables it; see worker/src/env.ts for the full semantics.
# LANGFUSE_MIGRATION_V4_OTEL_DIRECT_WRITE_ORG_CREATED_CUTOFF=
# Keep the WIP historic backfill dormant for local dev / CI. The v4 code default
# is `true`, but the general test suite should not run the backfill underneath it
# (it has a dedicated e2e spec). Set to `true` to exercise the backfill locally.
LANGFUSE_BACKGROUND_MIGRATION_V4_ENABLE_HISTORIC_BACKFILL=false

# Legacy tracing UI controls
LANGFUSE_DISABLE_LEGACY_TRACING_IO_SEARCH=false

CLICKHOUSE_USE_LIGHTWEIGHT_UPDATE="true"
# Each `auto` detects its affected ClickHouse versions on startup. Set `true`
# to force a workaround or `false` to force-disable it.
CLICKHOUSE_DISABLE_LAZY_MATERIALIZATION=auto
CLICKHOUSE_DISABLE_TOP_K_THROUGH_JOIN=auto

# ClickHouse Billing (CHB) integration (Langfuse Cloud only). First-time
# upgrades on/after this UTC date (YYYY-MM-DD) route to CHB; unset = off.
# LANGFUSE_CLOUD_BILLING_CHB_CUTOFF_DATE=
# Bearer secret for GET /api/billing/metrics; unset = endpoint disabled.
# CLICKHOUSE_BILLING_METRICS_API_KEY=
# CHB's EventBridge bus for project lifecycle events, authenticated by IAM from
# the task role; unset = no events emitted.
# CLICKHOUSE_BILLING_EVENT_BUS_ARN=