covel/.env.example at main · ackness/covel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
# ── Data Store ───────────────────────────────────────────────────
# Storage backend: sqlite (default), memory (ephemeral dev/test), pg (production).
# Browser-capable callers can use idb through @covel/store createStore();
# server deployments should use memory/sqlite/pg.
STORE_BACKEND=sqlite
# SQLITE_PATH defaults to <COVEL_DATA_ROOT>/covel.db when COVEL_DATA_ROOT is set,
# otherwise ./data/covel.db.
SQLITE_PATH=./data/covel.db

# ── PostgreSQL / Docker Database ─────────────────────────────────
# Used by: PostgreSQL container, Drizzle ORM, server DB connection
# ⚠️ Change POSTGRES_PASSWORD for any non-local deployment!
POSTGRES_USER=covel
POSTGRES_PASSWORD=covel_dev
POSTGRES_DB=covel
POSTGRES_PORT=5432

# DATABASE_URL is the full connection string used by the server.
# In Docker Compose, this is overridden automatically to use the
# internal service hostname (postgres:5432) instead of localhost.
DATABASE_URL=postgresql://covel:covel_dev@localhost:5432/covel

# ── Media Store ──────────────────────────────────────────────────
# mirror follows STORE_BACKEND. Explicit server values: memory, sqlite, pg, none.
# Browser deployments use IDB through an explicit factory call instead of
# server env wiring.
MEDIA_BACKEND=mirror
# MEDIA_ROOT=./data/media

# Required for production signed media URLs. Generate with:
#   openssl rand -hex 32
# COVEL_MEDIA_TOKEN_SECRET=

# ── Vector / Embeddings ──────────────────────────────────────────
# embedded uses the active DataStore vector capability when available.
# none disables vector search. external is reserved for an injected adapter.
VECTOR_BACKEND=embedded

# ── Desktop / Paths ──────────────────────────────────────────────
# COVEL_HOME=~/.covel
# COVEL_DATA_ROOT=~/.covel/data
# COVEL_USER_WORLDS_DIR=~/.covel/data/worlds
# COVEL_USER_PLUGINS_DIR=~/.covel/plugins
# COVEL_USER_CONFIG_DIR=~/.covel
# COVEL_LOGS_DIR=~/.covel/data/logs
# COVEL_MODEL_DB_PATH=~/.covel/model-db.json
# COVEL_PROMPTS_DIR=./prompts

# ── Server Runtime ───────────────────────────────────────────────
SERVER_PORT=3001

# Listen host. Defaults to loopback (127.0.0.1) so local/desktop deployments
# are never reachable from the network (audit S-02). Containers and hosted
# deployments must opt in explicitly (docker-compose sets 0.0.0.0).
# COVEL_BIND_HOST=127.0.0.1

# NODE_ENV controls:
#   development — verbose logging, dotenv file loading from disk,
#                 world-package-loader shows debug output
#   production  — minimal logging, env vars expected from the environment
#                 (not from .env files on disk), Docker image default
#   test        — used by vitest; enables test-only debug output
NODE_ENV=development

# ── Deployment Tier ──────────────────────────────────────────────
# Controls access control and security posture:
#   self  (default) — single-user self-hosted; no auth required;
#                     dev-keys endpoint enabled; rate limiting relaxed
#   demo            — public demo host; HTTPS required; CORS_ORIGIN must
#                     be set; rate limiting enforced; session owner tokens
#                     hard-enforced on session-scoped routes; session
#                     creation is operator-gated (COVEL_DESKTOP_REST_TOKEN
#                     required — boot fails without it)
#   commercial      — multi-tenant; auth required (session owner tokens +
#                     COVEL_DESKTOP_REST_TOKEN operator token); strictest
#                     policies; boot fails without them (security posture)
# DEPLOYMENT_TIER=self

# Operator bearer token. Required when DEPLOYMENT_TIER=demo|commercial:
# session creation/listing and config endpoints only accept this token, and
# it passes any session's owner check (master key for admin tooling).
# COVEL_DESKTOP_REST_TOKEN=

# ── CORS ─────────────────────────────────────────────────────────
# Required when DEPLOYMENT_TIER != "self".
# Comma-separated list of allowed origins. Leave unset for self-deploy.
# CORS_ORIGIN=https://yourdomain.com

# ── Static File Serving ──────────────────────────────────────────
# Set to "true" to serve the built web frontend from STATIC_DIR.
# Enabled automatically in the Docker production image.
# In local dev, the Vite dev server handles the frontend instead.
# SERVE_STATIC=false
# STATIC_DIR=./web-dist

# ── Rate Limiting ────────────────────────────────────────────────
# Requests per minute per IP. Defaults differ by DEPLOYMENT_TIER.
# RATE_LIMIT_RPM=60

# POST /api/install/plugin and POST /api/install/world write uploaded packages
# to disk. Production deployments can opt in here when protected by an
# upstream admin/auth boundary.
# COVEL_INSTALL_API_ENABLED=1

# Comma-separated list of trusted proxy IPs (e.g. your load balancer).
# Only set this if running behind a reverse proxy — otherwise spoofed
# X-Forwarded-For headers can bypass rate limiting.
# TRUSTED_PROXY_IPS=127.0.0.1

# ── Runtime Options ──────────────────────────────────────────────
# COVEL_COMPACTOR_CONTEXT_WINDOW=32768
# COVEL_LLM_RETRY_DISABLED=1

# ── Docker Compose ───────────────────────────────────────────────
# Host port for the app container (default: 3001)
# APP_PORT=3001

# ── Local Dev Helpers ────────────────────────────────────────────
# Vite dev proxy target. Usually inherited from the shell; Docker uses service env.
# RUNTIME_HOST=127.0.0.1
# RUNTIME_PORT=3001
#
# TanStack Router devtools floating button (dev only). Defaults on; set to
# "false" to hide the button.
# VITE_ROUTER_DEVTOOLS=false
#
# Postgres preflight target for `pnpm dev:pg`.
# COVEL_PG_PREFLIGHT_HOST=127.0.0.1
# COVEL_PG_PREFLIGHT_PORT=5432
# COVEL_PG_PREFLIGHT_SKIP=1

# ── Langfuse (NOT WIRED UP — backlog) ────────────────────────────
# No code reads these yet; setting them has no effect. Kept as a marker for
# the planned trace-export integration. Turn tracing today lives in the
# `trace_events` table (see /debug or GET /api/traces/:sessionId).
# LANGFUSE_PUBLIC_KEY=pk-xxx
# LANGFUSE_SECRET_KEY=sk-xxx
# LANGFUSE_BASE_URL=https://cloud.langfuse.com

# ── Dev-Mode LLM Replay Cache (NOT IMPLEMENTED — planned) ────────
# Registered as `documented` in docs/guide/env-registry.md: no source reads
# COVEL_LLM_REPLAY yet, so the behaviour below describes the intended design,
# not current behaviour. For cost-controlled reruns today, use llmock's own
# record/replay proxy (see docs/guide/e2e-plugin-verify.md).
# Records LLM provider requests on disk so identical (provider + params)
# calls replay deterministically, making it easy to reproduce issues
# without burning real API quota. No-op when unset — production safe.
#
#   auto    — replay on hit, otherwise call upstream and record (dev default)
#   record  — always call upstream and overwrite cache
#   replay  — read-only; throw on miss (debugger-friendly)
#
# Cache key = sha256(method + url + canonicalized request body); auth
# headers and api_key/token fields are redacted before hashing.
# COVEL_LLM_REPLAY=auto
# COVEL_LLM_REPLAY_DIR=debugs/llm-cache