.env.example

APP_NAME=Bilis
APP_ENV=local
APP_KEY=
APP_DEBUG=true
APP_URL=http://localhost:8000

APP_LOCALE=en
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=en_US

APP_MAINTENANCE_DRIVER=file
# APP_MAINTENANCE_STORE=database

# PHP_CLI_SERVER_WORKERS=4

BCRYPT_ROUNDS=12

LOG_CHANNEL=stack,bilis
LOG_STACK=single
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

DB_CONNECTION=sqlite
# DB_HOST=127.0.0.1
# DB_PORT=3306
# DB_DATABASE=laravel
# DB_USERNAME=root
# DB_PASSWORD=

SESSION_DRIVER=database
SESSION_LIFETIME=120
SESSION_ENCRYPT=false
SESSION_PATH=/
SESSION_DOMAIN=null
# In production, pin the session cookie to HTTPS rather than leaving it to
# per-request detection, and set the domain so the cookie is not sent wider
# than it has to be.
# SESSION_SECURE_COOKIE=true
# SESSION_DOMAIN=bilis.app
# SESSION_ENCRYPT=true

BROADCAST_CONNECTION=log
FILESYSTEM_DISK=local
QUEUE_CONNECTION=database

# Horizon runs Redis-backed queues. Any install running Horizon — production
# included — must set both QUEUE_CONNECTION=redis and CACHE_STORE=redis; the
# database defaults below are only there so a fresh clone boots without Redis.
# QUEUE_CONNECTION=redis
# HORIZON_ALLOWED_EMAILS=admin@example.com
# HORIZON_MAX_PROCESSES=10

# Which of the image's three long-running roles this container is: web (the
# default), horizon (the queue workers) or scheduler (schedule:work). One image
# deployed three times, distinguished only by this variable — for platforms
# whose per-resource knob is the environment rather than the command. Deploy
# exactly ONE horizon and ONE scheduler; scale the queues with
# HORIZON_MAX_PROCESSES, never with replicas. A value that is not a known role
# refuses to start rather than quietly serving web.
# BILIS_ROLE=web

CACHE_STORE=database
# CACHE_PREFIX=

# The ingest rate limiter counts on the cache store, so with CACHE_STORE=database
# every ingest POST is a write to SQLite. Redis is strongly recommended once
# ingest volume is real: set CACHE_STORE=redis (and QUEUE_CONNECTION=redis).
# CACHE_STORE=redis

MEMCACHED_HOST=127.0.0.1

REDIS_CLIENT=phpredis
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

MAIL_MAILER=log
MAIL_SCHEME=null
MAIL_HOST=127.0.0.1
MAIL_PORT=2525
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_FROM_ADDRESS="hello@example.com"
MAIL_FROM_NAME="${APP_NAME}"

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=
AWS_USE_PATH_STYLE_ENDPOINT=false

# One GitHub App serves the whole product. Its OAuth client credentials power
# "Continue with GitHub" on the login and register pages (enable "Request user
# authorization (OAuth) during installation" on the App and set its callback
# URL to {APP_URL}/auth/github/callback); the GITHUB_APP_* keys further down
# power repository access for autofix. Left unset, the button is hidden and
# the routes answer with an error.
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

VITE_APP_NAME="${APP_NAME}"

CLICKHOUSE_SCHEME=http
CLICKHOUSE_HOST=127.0.0.1
CLICKHOUSE_PORT=8123
CLICKHOUSE_DATABASE=bilis
CLICKHOUSE_USERNAME=default
CLICKHOUSE_PASSWORD=
CLICKHOUSE_TIMEOUT=10
CLICKHOUSE_CONNECT_TIMEOUT=3

# Bilis logging into itself. Set both, then add the channel to the stack with
# LOG_STACK=single,bilis. Left unset, the `bilis` channel is inert.
# BILIS_ENDPOINT=https://bilis.app
# BILIS_API_KEY=bilis_9E...
# BILIS_LOG_LEVEL=debug

# Bilis tracing itself, with keepsuit/laravel-opentelemetry. The SDK stays off
# until OTEL_EXPORTER_OTLP_ENDPOINT is set, so these four lines are the whole
# switch. Note the endpoint is the Bilis origin plus /api and nothing more: the
# SDK appends the signal path (/v1/traces) itself, so a value ending in
# /api/v1/traces posts to /api/v1/traces/v1/traces. The header value is
# url-encoded, which is what makes the space in "Bearer bilis_..." survive.
# OTEL_EXPORTER_OTLP_ENDPOINT=https://bilis.app/api
# OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
# OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer%20bilis_9E...
# OTEL_SERVICE_NAME=bilis
#
# Keep every span while traffic is low; move to a ratio when it is not. With
# tail sampling on, the ratio applies to healthy traces only and every errored
# or slow one is kept regardless.
# OTEL_TRACES_SAMPLER_TYPE=traceidratio
# OTEL_TRACES_SAMPLER_TRACEIDRATIO_RATIO=0.1
# OTEL_TRACES_TAIL_SAMPLING_ENABLED=true
#
# Under Octane and Horizon spans are batched and flushed periodically rather
# than per request. Set this if you would rather have them immediately and can
# pay for the export on the worker's own time.
# OTEL_WORKER_MODE_FLUSH_AFTER_EACH_ITERATION=false

# Security headers. The Content-Security-Policy is nonce based and needs no
# configuration for a stock instance; the allow lists exist for extra origins a
# self-hosted deployment adds (an analytics host, an avatar CDN). Space or
# comma separated. Watch a policy before enforcing it with REPORT_ONLY.
# SECURITY_CSP_ENABLED=true
# SECURITY_CSP_REPORT_ONLY=false
# SECURITY_CSP_REPORT_URI=
# SECURITY_CSP_SCRIPT_SRC=
# SECURITY_CSP_STYLE_SRC=
# SECURITY_CSP_IMG_SRC=
# SECURITY_CSP_FONT_SRC=
# SECURITY_CSP_CONNECT_SRC=
# SECURITY_CSP_FRAME_SRC=

# HSTS is only ever sent over a secure request, so a plain-HTTP instance on a
# local network cannot lock itself out. Only set PRELOAD once you are certain:
# removal from the browser preload list takes months.
# SECURITY_HSTS_ENABLED=true
# SECURITY_HSTS_MAX_AGE=31536000
# SECURITY_HSTS_INCLUDE_SUBDOMAINS=true
# SECURITY_HSTS_PRELOAD=false

# Forwarded headers are trusted from every address by default, which is right
# when nothing but the reverse proxy can reach the container. If the app port
# is reachable from anywhere else, name the proxies explicitly instead.
# TRUSTED_PROXIES=10.0.0.0/8,172.16.0.0/12

# Ingest requests per minute, per API key. A rejection is a 429 with
# Retry-After, which exporters retry. 0 disables the limiter.
# BILIS_INGEST_RATE_LIMIT=1200
# BILIS_INGEST_RATE_LIMIT_UNAUTHENTICATED=60

# The OTLP endpoint accepts the protobuf encoding as well as JSON, decoded in
# pure PHP by app/Services/Ingest/Protobuf. Set this to false and a protobuf
# export answers 415 with the JSON hint again; nothing else changes.
# BILIS_OTLP_PROTOBUF=true

# What a gzip or deflate request body may expand to, in bytes. A body that
# reaches the cap is discarded rather than half-read.
# BILIS_INGEST_MAX_DECOMPRESSED_BYTES=33554432

# Analytics on the public pages and the app shell. Leave the URL empty to emit
# no script and allow no third-party origin in the policy.
# BILIS_ANALYTICS_SCRIPT_URL=
# BILIS_ANALYTICS_WEBSITE_ID=

# The autofix control plane. Off until AUTOFIX_ENABLED is true, and each repo
# opts in separately from its project settings. Bilis holds every credential
# below; Ayos only ever gets short-lived, per-job material.
# AUTOFIX_ENABLED=false

# Ayos is not a service: one fix job is one container run with no inbound HTTP,
# so there is no URL to call and no shared secret. `local` spawns the runner as
# a child process (development); `scaleway` starts a Serverless Job run.
# AUTOFIX_RUNNER_DRIVER=local
# AUTOFIX_RUNNER_ENTRYPOINT=/path/to/ayos/dist/src/entry.js
# AUTOFIX_RUNNER_NODE=/usr/local/bin/node
#
# AUTOFIX_RUNNER_DRIVER=scaleway
# AUTOFIX_SCW_JOB_DEFINITION_ID=
# SCW_SECRET_KEY=
# SCW_REGION=fr-par

# The same GitHub App as GITHUB_CLIENT_ID above — these are its installation
# side: reading repositories and opening pull requests once a team installs
# it to enable autofix. The private key is the PEM, base64 encoded, and is
# never handed to Ayos. The slug is the App's URL name, used to build the
# https://github.com/apps/{slug}/installations/new install link.
# GITHUB_APP_ID=
# GITHUB_APP_SLUG=
# GITHUB_APP_PRIVATE_KEY=
# GITHUB_APP_WEBHOOK_SECRET=

# Ed25519 key used to mint the browser stream tokens. The stream is served by
# Bilis now, so this key never leaves the application — it scopes a viewer's
# connection to one job on top of the session policy.
# AUTOFIX_STREAM_PRIVATE_KEY=

# Fallback model key, for single-tenant and self-hosted instances where "the
# customer" and "the operator" are the same party.
#
# On a multi-tenant instance each TEAM brings its own keys instead — as many as
# it likes, one per provider or several against the same one, added in team
# settings and stored encrypted. That is not decoration: a key travels to the
# runner inside the job spec, and the platform offers no per-run secret channel
# (see ayos/DEPLOY.md §2), so a key scoped to one customer with a spend limit at
# the provider is what bounds the damage if a run record is read.
#
# AUTOFIX_LLM_PROVIDER names which provider the fallback key is for: anthropic,
# openai or openrouter. Bilis sends it with the job, because the party holding
# the key is the only one that knows where it is valid.
# AUTOFIX_LLM_API_KEY=
# AUTOFIX_LLM_PROVIDER=anthropic

# The remote MCP server signs its OAuth tokens with these. Generate a pair with
# `php artisan passport:keys` and paste the PEM bodies here: written to disk
# instead, they live in a container filesystem that does not survive a deploy,
# and a regenerated pair disconnects every agent silently.
PASSPORT_PRIVATE_KEY=
PASSPORT_PUBLIC_KEY=