MAP/.env.example at main · Yad4o/MAP · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
# ─────────────────────────────────────────────────────────────
#  MAP — .env.example
#  Copy this to .env and fill in real values.
#  NEVER commit .env to version control.
#
#  Three environments:
#    development  → SQLite locally, Celery eager, wildcard CORS
#    production   → Neon (asyncpg), real Celery worker, strict CORS
# ─────────────────────────────────────────────────────────────

# ── APPLICATION ───────────────────────────────────────────────
APP_ENV=development          # development | production
DEBUG=true
LOG_LEVEL=INFO

# ── DATABASE ──────────────────────────────────────────────────
# Local dev (SQLite — no server needed):
DATABASE_URL=sqlite+aiosqlite:///./map_dev.db
# Production (Neon / any asyncpg-compatible Postgres):
# DATABASE_URL=postgresql+asyncpg://user:pass@host/dbname?ssl=require
DB_POOL_SIZE=20
DB_MAX_OVERFLOW=10

# ── REDIS ─────────────────────────────────────────────────────
# Local dev (plain Redis):
REDIS_URL=redis://localhost:6379/0
CELERY_BROKER_URL=redis://localhost:6379/1
CELERY_RESULT_BACKEND=redis://localhost:6379/2
# Production (Upstash / TLS Redis — replace redis:// with rediss://):
# REDIS_URL=rediss://default:PASSWORD@host:6379
# CELERY_BROKER_URL=rediss://default:PASSWORD@host:6379/1
# CELERY_RESULT_BACKEND=rediss://default:PASSWORD@host:6379/2

# ── AUTHENTICATION ────────────────────────────────────────────
# Generate with:
#   openssl genrsa -out private.pem 2048
#   openssl rsa -in private.pem -pubout -out public.pem
#   awk 'NF {sub(/\r/, ""); printf "%s\\n", $0}' private.pem   ← paste output below
JWT_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nPASTE_KEY_HERE\n-----END PRIVATE KEY-----\n"
JWT_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----\nPASTE_KEY_HERE\n-----END PUBLIC KEY-----\n"
JWT_ALGORITHM=RS256
JWT_ACCESS_TOKEN_EXPIRE_MINUTES=15
JWT_REFRESH_TOKEN_EXPIRE_DAYS=30

# ── AI PROVIDERS ──────────────────────────────────────────────
# In development, config.py forces Groq regardless of these values.
# In production (APP_ENV=production), these env vars are used as-is.
GROQ_API_KEY=gsk_...                      # primary — required in production
GROQ_API_KEY_SECONDARY=gsk_...            # optional rate-limit fallback
GROQ_BASE_URL=https://api.groq.com/openai/v1
OPENAI_API_KEY=sk-...                     # optional fallback
GEMINI_API_KEY=AIza...                    # optional fallback
PRIMARY_AI_PROVIDER=groq                  # groq | openai | gemini
DEFAULT_MODEL=llama-3.3-70b-versatile
FALLBACK_MODEL=llama-3.1-8b-instant

# ── AGENT CONFIGURATION ───────────────────────────────────────
PLANNER_TEMPERATURE=0.7
EXECUTOR_TEMPERATURE=0.2
ANALYZER_TEMPERATURE=0.1
EXECUTOR_MAX_ITERATIONS=10
ANALYZER_CONFIDENCE_THRESHOLD=0.70
MAX_TASK_RETRY_COUNT=3
TASK_TIMEOUT_SECONDS=3600
MAX_TOKENS=4000

# ── RATE LIMITING ─────────────────────────────────────────────
RATE_LIMIT_FREE_RPM=100
RATE_LIMIT_PRO_RPM=500
RATE_LIMIT_ENTERPRISE_RPM=2000

# ── SECURITY ──────────────────────────────────────────────────
# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
ENCRYPTION_KEY=replace_with_32_byte_hex_string
# Local dev — add your Vite dev server ports:
CORS_ALLOWED_ORIGINS=http://localhost:5173,http://localhost:5174
# Production — your Vercel URL (comma-separated if multiple):
# CORS_ALLOWED_ORIGINS=https://your-app.vercel.app

# ── EMAIL (Resend) ────────────────────────────────────────────
# Free tier: 3,000/month, 100/day. Requires a verified sending domain
# (multiagents.me) — raw SMTP is blocked on Render/Railway free tiers,
# so we use Resend's HTTPS API instead.
RESEND_API_KEY=re_...
RESEND_FROM_EMAIL=noreply@multiagents.me
FRONTEND_URL=http://localhost:5173     # used to build password-reset + OAuth redirect links; set to your Vercel URL in production

# ── OAUTH (Google / GitHub sign-in) ───────────────────────────
# BACKEND_URL must exactly match what's registered as the redirect URI
# in each provider's app console (redirect path is /api/v1/auth/oauth/<provider>/callback).
BACKEND_URL=http://localhost:8000
# Google Cloud Console → APIs & Services → Credentials → OAuth client ID (Web application)
#   Authorized redirect URI: {BACKEND_URL}/api/v1/auth/oauth/google/callback
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
# GitHub → Settings → Developer settings → OAuth Apps → New OAuth App
#   Authorization callback URL: {BACKEND_URL}/api/v1/auth/oauth/github/callback
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

# ── EXTERNAL TOOLS (optional) ─────────────────────────────────
SERPAPI_KEY=                 # for web search tool