87 lines
3.0 KiB
Bash
87 lines
3.0 KiB
Bash
# Required
|
|
DATABASE_URL=""
|
|
REDIS_URL=""
|
|
PUBLIC_SERVER_URL=""
|
|
|
|
TRUSTED_ORIGINS=""
|
|
BETTER_AUTH_SECRET=""
|
|
|
|
AUTH_BEARER_TOKEN=""
|
|
AUTH_COOKIE_DOMAIN=""
|
|
|
|
# Email provider — used by the API only for auth-flow emails (forgot
|
|
# password, password-reset confirmation, email verification, email-change
|
|
# verification). Every other email is sent by @cio/jobs-worker; see
|
|
# apps/jobs/.env.example. Both processes can point at the same SMTP server.
|
|
SMTP_HOST=""
|
|
SMTP_PORT=""
|
|
SMTP_USER=""
|
|
SMTP_SENDER=""
|
|
SMTP_PASSWORD=""
|
|
|
|
# Optional Zoho ZeptoMail token. When set, @cio/email uses Zoho instead of
|
|
# nodemailer/SMTP. Same dual-process note as SMTP above.
|
|
# ZOHO_TOKEN=""
|
|
|
|
# Optional - MinIO (S3-compatible, for Docker / on-premise self-hosting)
|
|
# When API runs in Docker: use http://minio:9000. For local API: use http://localhost:9000
|
|
MINIO_ROOT_USER=""
|
|
MINIO_ROOT_PASSWORD=""
|
|
OBJECT_STORAGE_ENDPOINT=""
|
|
OBJECT_STORAGE_PUBLIC_ENDPOINT=""
|
|
OBJECT_STORAGE_ACCESS_KEY_ID=""
|
|
OBJECT_STORAGE_SECRET_ACCESS_KEY=""
|
|
OBJECT_STORAGE_FORCE_PATH_STYLE=""
|
|
OBJECT_STORAGE_MEDIA_PUBLIC_BASE_URL=""
|
|
|
|
# Optional - Cloudflare R2 (for hosted deployments)
|
|
CLOUDFLARE_BUCKET_ID=""
|
|
CLOUDFLARE_ACCESS_KEY=""
|
|
CLOUDFLARE_ACCOUNT_ID=""
|
|
CLOUDFLARE_BUCKET_DOMAIN=""
|
|
CLOUDFLARE_SECRET_ACCESS_KEY=""
|
|
|
|
# Sentry (server-side error tracking). Leave SENTRY_DSN unset to disable.
|
|
# Skipped automatically in dev (NODE_ENV !== 'production') and self-hosted (PUBLIC_IS_SELFHOSTED=true).
|
|
SENTRY_DSN=""
|
|
SENTRY_ENVIRONMENT="production"
|
|
SENTRY_TRACES_SAMPLE_RATE="0"
|
|
|
|
# BullMQ dashboard (/admin/queues) ───────────────────────────────────────────
|
|
# In dev the dashboard is open. In production it's hidden unless ONE of the
|
|
# following is set; failing requests get 404 (not 401) so the route stays
|
|
# invisible to scanners.
|
|
#
|
|
# Comma-separated allowlist of Better Auth user emails — log in normally,
|
|
# visit /admin/queues, the middleware checks your session.
|
|
# QUEUE_DASHBOARD_ADMIN_EMAILS="you@yourdomain.com,partner@yourdomain.com"
|
|
#
|
|
# Bearer-token escape hatch for curl / scripts. Pass via
|
|
# `Authorization: Bearer <token>` or `?token=<token>`.
|
|
# QUEUE_DASHBOARD_TOKEN=""
|
|
|
|
# Enterprise (Optional)
|
|
# Required only when using Enterprise-only features (SSO, token-auth, no-tracking)
|
|
LICENSE_KEY=""
|
|
|
|
# SSO (Optional)
|
|
# For enterprise SSO with SAML (future support)
|
|
# SSO_ENCRYPTION_KEY="your-32-character-secret-key"
|
|
|
|
# AI Assistant (Optional)
|
|
# Per-provider API keys. The dashboard model picker exposes Gemini 3 Flash
|
|
# (Google) and GPT-4o (OpenAI). Anthropic is supported in code but not in the
|
|
# picker UI. Set at least one key to enable the assistant.
|
|
OPENAI_API_KEY=""
|
|
GOOGLE_API_KEY=""
|
|
ANTHROPIC_API_KEY=""
|
|
MOONSHOT_API_KEY=""
|
|
|
|
# Jina Reader — optional Bearer for higher rate limits when using fetch_documentation_url
|
|
# JINA_API_KEY=""
|
|
# AGENT_MAX_FETCHES_PER_CONVERSATION=15
|
|
# AGENT_MAX_FETCHES_PER_ORG_PER_DAY=500
|
|
|
|
# Tinybird event tracking for AI observability (optional — silently skipped when not set)
|
|
# TINYBIRD_TOKEN=""
|
|
# TINYBIRD_BASE_URL="https://api.tinybird.co" |