183 lines
7.8 KiB
Text
183 lines
7.8 KiB
Text
# =====================================================================
|
|
# ECHODO — Environment Variables
|
|
# =====================================================================
|
|
# Local dev: copy this file to .env and adjust values.
|
|
# Production (CT 116 standalone LXC): paste into /opt/submatter/.env on the host.
|
|
# See docs/deployment-production.md and proxmox/ct116/README.md.
|
|
# See AGENT-DEPLOY.md for shared CT 102 service credentials and Traefik routing.
|
|
# =====================================================================
|
|
|
|
# ----- Database (CT 102 shared Postgres) -----
|
|
# The database name is `echodo` everywhere — local dev, Coolify, and the
|
|
# drizzle migration ledger all assume it. Do NOT use `tasks` (an early
|
|
# pre-rename name); see commit 93565cd and the 2026-06 drift incident for
|
|
# why a parallel `tasks` DB caused production OAuth to look broken when
|
|
# it was really just connected to an empty schema.
|
|
#
|
|
# Local dev (Docker compose): postgresql://postgres:postgres@localhost:5432/echodo
|
|
# Production (Coolify, CT 102): dedicated `echodo` user/db on shared Postgres
|
|
DATABASE_URL="postgresql://echodo:CHANGE_ME@192.168.68.102:5432/echodo"
|
|
|
|
# UUID of the workspace that owns imported `plans/` rows (slug or UUID from Settings).
|
|
# For dogfooding this repo, use the `convoys-tasks` workspace id.
|
|
# Required by `pnpm --filter @tasks/database import:markdown-backlog` and
|
|
# `watch:markdown-backlog` (not loaded automatically — set in `.env`).
|
|
MARKDOWN_BACKLOG_WORKSPACE_ID="00000000-0000-0000-0000-000000000000"
|
|
|
|
# ----- Redis (CT 102 shared Redis) -----
|
|
# Use a dedicated DB index per AGENT-DEPLOY.md (ECHODO uses /11)
|
|
# Local dev: redis://localhost:6379
|
|
REDIS_URL="redis://:CHANGE_ME@192.168.68.102:6379/11"
|
|
|
|
# ----- Orchestrator (apps/orchestrator) -----
|
|
# ORCHESTRATOR_DRY_RUN=1 logs dispatch/transition without Redis enqueue
|
|
# ORCHESTRATOR_POLL_MS=5000
|
|
# ORCHESTRATOR_STALL_MINUTES=120
|
|
# ORCHESTRATOR_MAX_IMPLEMENTERS=2
|
|
|
|
# ----- Worker (apps/worker) -----
|
|
# WORKER_DRY_RUN=1 skips Redis dequeue loop
|
|
# WORKER_BLPOP_TIMEOUT_S=5
|
|
# WORKER_MAX_TOOL_STEPS=12
|
|
# WORKER_CHECKPOINT_EVERY_N_STEPS=1
|
|
# WORKER_REPO_ROOT= # defaults to monorepo root (pnpm-workspace.yaml walk-up)
|
|
# WORKER_WORKTREE_BASE=/tmp/echodo-worker-worktrees
|
|
#
|
|
# Phase B — coding harness (optional)
|
|
# Preferred: OpenCode (COMPOSE_PROFILES=opencode)
|
|
# WORKER_SESSION_TYPE=minimal # set to `opencode` when opencode profile is running
|
|
# OPENCODE_SERVER_URL=http://opencode:4096
|
|
# OPENCODE_SERVER_PASSWORD= # openssl rand -hex 24; must match container
|
|
# OPENCODE_SERVER_USERNAME=opencode
|
|
# OPENCODE_PROVIDER_ID=omniroute
|
|
# WORKER_OPENCODE_WORKSPACE=/workspace/repo
|
|
# OMNIROUTE_BASE_URL=https://omniroute.stillwell.cloud/v1
|
|
# OMNIROUTE_API_KEY=
|
|
# OMNIROUTE_MODEL=auto/coding
|
|
#
|
|
# Legacy: OpenHands agent-server (COMPOSE_PROFILES=agent-server)
|
|
# WORKER_SESSION_TYPE=openhands
|
|
# AGENT_SERVER_URL=http://agent-server:8001
|
|
# WORKER_OPENHANDS_WORKSPACE=/workspace/repo
|
|
# SESSION_API_KEY= # must match LOCAL_BACKEND_API_KEY on agent-server
|
|
# LOCAL_BACKEND_API_KEY= # generate: openssl rand -hex 32
|
|
|
|
# ----- Auth (NextAuth v5) -----
|
|
# Local: http://localhost:3000 • Prod: https://echodo.stillwell.cloud
|
|
NEXTAUTH_URL="http://localhost:3000"
|
|
# Generate with: openssl rand -base64 32
|
|
NEXTAUTH_SECRET="CHANGE_ME_RUN_openssl_rand_base64_32"
|
|
AUTH_SECRET="CHANGE_ME_RUN_openssl_rand_base64_32"
|
|
|
|
# Optional dev-only credentials provider (looks up users by email,
|
|
# accepts this single password for everyone). Leave blank in prod.
|
|
AUTH_DEV_PASSWORD=""
|
|
|
|
# ----- OAuth Providers (all optional) -----
|
|
AUTH_GITHUB_ID=""
|
|
AUTH_GITHUB_SECRET=""
|
|
AUTH_GOOGLE_ID=""
|
|
AUTH_GOOGLE_SECRET=""
|
|
|
|
# Authentik SSO (CT 100 — auth.stillwell.cloud)
|
|
# In Authentik admin → Applications → Create OAuth2/OpenID Provider.
|
|
# Slug "echodo", redirect URI: <NEXTAUTH_URL>/api/auth/callback/authentik
|
|
AUTH_AUTHENTIK_ID=""
|
|
AUTH_AUTHENTIK_SECRET=""
|
|
AUTH_AUTHENTIK_ISSUER="https://auth.stillwell.cloud/application/o/echodo/"
|
|
|
|
# ----- Realtime collab server (Hocuspocus / Yjs) -----
|
|
# Server-side reference (used by Next.js server actions, if any)
|
|
COLLAB_SERVER_URL="ws://localhost:1234"
|
|
# Browser-facing — must be wss:// in production because the page is https.
|
|
# Baked into the web image at BUILD time (docker build args) — change requires rebuild.
|
|
NEXT_PUBLIC_COLLAB_SERVER_URL="ws://localhost:1234"
|
|
|
|
# ----- Umami Analytics (CT 112 — analytics.stillwell.cloud) -----
|
|
# In Umami: Settings → Websites → Add website. Copy the website UUID.
|
|
NEXT_PUBLIC_UMAMI_SCRIPT="https://analytics.stillwell.cloud/script.js"
|
|
NEXT_PUBLIC_UMAMI_WEBSITE_ID=""
|
|
|
|
# ----- Libredesk Support Widget (CT 105 — support.stillwell.cloud) -----
|
|
NEXT_PUBLIC_LIBREDESK_URL="https://support.stillwell.cloud"
|
|
NEXT_PUBLIC_LIBREDESK_WIDGET_ID=""
|
|
|
|
# ----- Directus Feedback (archived — was CT 107) -----
|
|
# Static token scoped write-only on the `feedback` collection
|
|
NEXT_PUBLIC_DIRECTUS_URL="https://directus.stillwell.cloud"
|
|
DIRECTUS_FEEDBACK_TOKEN=""
|
|
|
|
# ----- AI Providers -----
|
|
# Registry aliases (Epic 1) read these env var NAMES from the DB — values
|
|
# live here on the server/worker host, never in Postgres.
|
|
#
|
|
# Local Ollama on Mac:
|
|
# OPENAI_BASE_URL=http://<mac-lan-ip>:11434/v1
|
|
# OPENAI_API_KEY=ollama
|
|
# OPENAI_MODEL=qwen2.5-coder:32b
|
|
#
|
|
# Local MLX (mlx-openai-server on Mac — preferred for parallel implementers):
|
|
# MLX_SERVER_URL=http://<mac-lan-ip>:8000/v1
|
|
# MLX_API_KEY=local
|
|
# (Register as openai_compatible alias qwen-coder-mlx in Settings when Epic 1 ships)
|
|
#
|
|
# Cloud / free-tier (see docs/adr-model-routing.md):
|
|
OPENAI_API_KEY=""
|
|
OPENAI_BASE_URL=""
|
|
ANTHROPIC_API_KEY=""
|
|
GOOGLE_GENERATIVE_AI_API_KEY=""
|
|
NVIDIA_API_KEY=""
|
|
|
|
# ----- OmniRoute (CT 108 — omniroute.stillwell.cloud) -----
|
|
# Used by worker + web (Settings → AI provider tests) + Phase B agent-server.
|
|
OMNIROUTE_BASE_URL="https://omniroute.stillwell.cloud/v1"
|
|
OMNIROUTE_API_KEY=""
|
|
OMNIROUTE_MODEL=auto/coding
|
|
|
|
# ----- Connected repos (Settings → Connected repos) -----
|
|
# Token values live here; Settings stores only the env var NAME (e.g. FORGEJO_TOKEN).
|
|
# Forgejo self-hosted:
|
|
# Remote URL: https://forgejo.stillwell.cloud/rstillwell/Submatter.git
|
|
# Token env var name in UI: FORGEJO_TOKEN
|
|
FORGEJO_TOKEN=""
|
|
# GitHub.com:
|
|
# Remote URL: https://github.com/org/repo.git
|
|
# Token env var name in UI: GITHUB_TOKEN
|
|
GITHUB_TOKEN=""
|
|
|
|
# ----- Forge webhooks (PR merged → convoy transition) -----
|
|
FORGE_WEBHOOK_SECRET=""
|
|
|
|
# ----- MCP Server -----
|
|
MCP_SERVER_PORT=3001
|
|
|
|
# =====================================================================
|
|
# Production Docker Compose build (8 GB hosts)
|
|
# =====================================================================
|
|
# Serialize image builds to avoid kernel OOM (exit 255) during export.
|
|
# Dokploy / standalone: set Custom Build Command to `bash scripts/build-prod.sh`
|
|
# Local verify: pnpm docker:build:prod
|
|
# Legacy alias: pnpm docker:build:coolify
|
|
|
|
# =====================================================================
|
|
# Local Docker Compose only (docker/docker-compose.yml)
|
|
# Not needed for production (uses CT 102 shared Postgres/Redis).
|
|
# =====================================================================
|
|
POSTGRES_USER=postgres
|
|
POSTGRES_PASSWORD=postgres
|
|
# Keep this aligned with the database name in DATABASE_URL above. The
|
|
# docker-compose files default to `tasks` (the old name) — override here.
|
|
POSTGRES_DB=echodo
|
|
POSTGRES_PORT=5432
|
|
REDIS_PORT=6379
|
|
WEB_PORT=3000
|
|
# ----- Chat (durable channel messaging) -----
|
|
# Shared secret for signing short-lived subscription tickets. Must match on web and collab.
|
|
# Generate at least 32 random bytes, for example: openssl rand -hex 32
|
|
CHAT_TICKET_SECRET="CHANGE_ME_USE_A_RANDOM_32_BYTE_SECRET"
|
|
# Internal collab chat listener port (distinct from Hocuspocus/Yjs on 1234)
|
|
CHAT_PORT=1235
|
|
# Public WSS endpoint, baked into the web bundle at build time. Rebuild web after changing.
|
|
NEXT_PUBLIC_CHAT_SERVER_URL="wss://echodo-chat.stillwell.cloud"
|
|
|
|
COLLAB_PORT=1234
|