-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.example
More file actions
101 lines (83 loc) · 5.22 KB
/
Copy path.env.example
File metadata and controls
101 lines (83 loc) · 5.22 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
# ─── Tool API Keys ────────────────────────────────────────────────────────────
# Required for web_search tool. Without this, web_search falls back to DuckDuckGo.
# SERPAPI_KEY=your-key-here
# ─── Provider API Keys ────────────────────────────────────────────────────────
# Set the keys for the providers you want to use. Providers without keys are
# skipped during startup — no error, just not loaded.
# Anthropic (Claude)
# ANTHROPIC_API_KEY=sk-ant-...
# OpenAI
# OPENAI_API_KEY=sk-...
# OPENAI_BASE_URL=https://api.openai.com/v1
# Google (Gemini)
# GOOGLE_API_KEY=AIza...
# Groq
# GROQ_API_KEY=gsk_...
# Mistral
# MISTRAL_API_KEY=...
# DeepSeek
# DEEPSEEK_API_KEY=sk-...
# DEEPSEEK_BASE_URL=https://api.deepseek.com
# Kimi (Moonshot AI)
# KIMI_API_KEY=sk-...
# KIMI_BASE_URL=https://api.moonshot.ai/v1
# ─── Local Providers ─────────────────────────────────────────────────────────
# Ollama (auto-detected if running on default port)
# OLLAMA_HOST=http://localhost:11434
# OLLAMA_DEFAULT_MODEL=llama3.2
# ─── Auth / JWT ──────────────────────────────────────────────────────────────
# The gateway signs and verifies ALL bearer tokens — human sessions and machine
# service tokens alike — with this one secret.
#
# JWT_SECRET is the canonical name and the one to use.
# - DOJO_JWT_SECRET is a DEPRECATED alias, honoured only so hosts provisioned
# from older docs are not left unconfigured. JWT_SECRET wins when both are
# set. Rename it.
# - A `jwt_secret:` key in a config YAML is NOT wired to any Go code and has
# been removed from deploy/gateway-config.yaml. Do not re-add it.
#
# If neither variable is set the gateway falls back to a development secret that
# is committed to this repository, so every token becomes forgeable by anyone who
# has read the source. With ENVIRONMENT=production that is a hard startup
# failure — the gateway refuses to run rather than come up forgeable. Local
# development keeps working with no configuration at all.
#
# Generate with: openssl rand -hex 32
# JWT_SECRET=
# ─── Service tokens (machine credentials) ────────────────────────────────────
# Mint one with: make service-token SERVICE=pdi
# A service token is a normal JWT with sub="service:<name>", role="service" and
# a jti. role="service" can never satisfy admin auth.
#
# Revocation, without rotating JWT_SECRET (which would log out every human).
# Both accept a comma-separated list, and both take effect on restart.
#
# Revoke individual tokens by their jti (printed at mint time):
# SERVICE_TOKEN_REVOKED_IDS=
#
# Revoke every token ever issued to a service — use when the jti is unknown:
# SERVICE_TOKEN_REVOKED_SUBJECTS=service:pdi
# ─── CORS ────────────────────────────────────────────────────────────────────
# Comma-separated list of allowed origins. Each origin MUST include the scheme
# (http:// or https://). Use * to allow all origins (dev only).
# ALLOWED_ORIGINS=http://localhost:3000,http://localhost:3003
# ALLOWED_ORIGINS=https://app.example.com,https://api.example.com
# ─── MCP Apps (v1.1.0 - beta) ───────────────────────────────────────────────
# MCP_APPS_ENABLED=false
# ─── Langfuse Configuration ──────────────────────────────────────────────────
# Required for NextAuth.js session management
LANGFUSE_NEXTAUTH_SECRET=changeme-random-secret-key-minimum-32-characters-required
# Required for encryption at rest
LANGFUSE_SALT=changeme-random-salt-minimum-32-characters-required
# ─── PostgreSQL Configuration ────────────────────────────────────────────────
POSTGRES_PASSWORD=changeme
# ─── GitHub OAuth ────────────────────────────────────────────────────────────
# Create an OAuth App at github.com/settings/applications
# Callback URL must be: https://pdi.trespies.dev/auth/github/callback
# GITHUB_OAUTH_ENABLED=true
# GITHUB_OAUTH_CLIENT_ID=your-client-id
# GITHUB_OAUTH_CLIENT_SECRET=your-client-secret
# GITHUB_OAUTH_REDIRECT_URI=https://pdi.trespies.dev/auth/github/callback
# ─── Optional: Langfuse API Keys ─────────────────────────────────────────────
# LANGFUSE_SECRET_KEY=sk-lf-...
# LANGFUSE_PUBLIC_KEY=pk-lf-...