-
Notifications
You must be signed in to change notification settings - Fork 25
Expand file tree
/
Copy path.env.example
More file actions
149 lines (118 loc) · 5.65 KB
/
Copy path.env.example
File metadata and controls
149 lines (118 loc) · 5.65 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
# Lobu Configuration
# Copy this file to .env and fill in your values
# ===========================================
# PLATFORM CONNECTIONS
# ===========================================
# Platform credentials (Slack, Telegram, Discord, WhatsApp, Teams) are
# configured via the settings page or connections CRUD API and stored in
# Postgres. They are NOT set as environment variables.
# ===========================================
# REQUIRED TO BOOT
# ===========================================
# These three are the only env vars the gateway requires at startup.
# Everything else can be configured at runtime via the admin UI.
# Postgres connection (with pgvector extension installed).
DATABASE_URL=postgresql://lobu:lobu@localhost:5432/lobu?sslmode=disable
# 32-byte base64 — generate with: openssl rand -base64 32
# Encrypts provider API keys, OAuth tokens, and other secrets stored in
# Postgres. Loses every encrypted secret if you change it after first boot.
ENCRYPTION_KEY=
# 32-byte base64 — generate with: openssl rand -base64 32
# Signs admin-UI session cookies. Auto-generated ephemerally in `lobu run`
# (local CLI mode); MUST be set explicitly in Docker / k8s deployments.
BETTER_AUTH_SECRET=
# ===========================================
# LLM PROVIDER KEYS (Optional — set only what you use)
# ===========================================
# Lobu supports 16 providers (see config/providers.json). None are required
# at boot. Provider keys can also be added via the admin UI at runtime
# without restarting the server.
# Anthropic (Claude)
ANTHROPIC_API_KEY=
# Alternative to ANTHROPIC_API_KEY for Claude Code: OAuth token
CLAUDE_CODE_OAUTH_TOKEN=
# OpenAI-compatible providers (set only what you intend to use)
OPENAI_API_KEY=
GROQ_API_KEY=
GEMINI_API_KEY=
OPENROUTER_API_KEY=
DASHSCOPE_API_KEY=
# ===========================================
# EXECUTION SETTINGS
# ===========================================
# Execution timeout in minutes (default: 10)
TIMEOUT_MINUTES=10
# Comma-separated list of additional allowed tools (optional)
ALLOWED_TOOLS=
# Comma-separated list of disallowed tools (optional)
DISALLOWED_TOOLS=
# ===========================================
# ENVIRONMENT AND LOGGING
# ===========================================
NODE_ENV=development
LOG_LEVEL=INFO
# Worker idle cleanup time in minutes (default: 60)
WORKER_IDLE_CLEANUP_MINUTES=60
# Error reporting (Sentry). Both server and the worker subprocess report to
# Sentry Issues when SENTRY_DSN is set; leave it unset to disable all reporting.
# ENVIRONMENT tags every event — set it to `development` locally so a DSN you add
# for testing doesn't pollute the production environment in Sentry.
# SENTRY_DSN=
# ENVIRONMENT=development
# ===========================================
# WORKER NETWORK ACCESS CONTROL
# ===========================================
# Workers run in isolated network and access internet via gateway's filtering proxy.
#
# Empty/unset: Complete isolation (deny all) - SECURE DEFAULT
# *: Unrestricted access (NOT RECOMMENDED for production)
# Comma-separated domains: Allowlist mode
#
# Domain format: api.example.com (exact) or .example.com (wildcard)
WORKER_ALLOWED_DOMAINS=api.anthropic.com,.anthropic.com,registry.npmjs.org,.npmjs.org,github.com,.github.com,.githubusercontent.com,.lobu.com
# Explicitly blocked domains (optional, use with WORKER_ALLOWED_DOMAINS=*)
WORKER_DISALLOWED_DOMAINS=
# Optional remote runtime provider for worker bash commands (deployment-wide
# default / self-host; per-agent selection comes from its Environment).
# Default/unset: local per-conversation workspaces with embedded just-bash.
# vercel: route bash through a Vercel persistent sandbox. The sandbox filesystem
# is the workspace source of truth; regular files are not synced locally.
# Provider credentials are read from the org vault (per-environment) and fall
# back to the app process environment here:
# VERCEL_TEAM_ID + VERCEL_PROJECT_ID + VERCEL_TOKEN.
# LOBU_RUNTIME_PROVIDER=vercel
# LOBU_VERCEL_SANDBOX_NAME_PREFIX=lobu
# LOBU_VERCEL_SANDBOX_RUNTIME=node24
# VERCEL_SANDBOX_DEFAULT_RUNTIME=node24
# LOBU_VERCEL_SANDBOX_VCPUS=1
# Falls back to TIMEOUT_MINUTES * 60000 when unset.
# LOBU_VERCEL_SANDBOX_TIMEOUT_MS=600000
# LOBU_VERCEL_SANDBOX_KEEP_LAST_SNAPSHOTS=1
# LOBU_VERCEL_SANDBOX_DELETE_EVICTED_SNAPSHOTS=true
# LOBU_VERCEL_SANDBOX_SNAPSHOT_EXPIRATION_MS=
# Worker env passthrough (WORKER_ENV_* vars are forwarded to workers with prefix stripped)
# Example: WORKER_ENV_FOO=bar -> FOO=bar in worker
# ===========================================
# GATEWAY
# ===========================================
# Public gateway URL (required for OAuth callbacks)
PUBLIC_GATEWAY_URL=https://app.lobu.ai
# Optional Lobu base MCP URL override.
# File-first projects can enable Lobu with [memory] in lobu.config.ts;
# when set, Lobu scopes this base URL to the org declared there.
MEMORY_URL=https://lobu.com/mcp
# System skills registry URL (points to config/system-skills.json)
# LOBU_SYSTEM_SKILLS_URL=file:///app/config/system-skills.json
# ===========================================
# TRANSACTIONAL EMAIL (Resend)
# ===========================================
# Required in production for magic link, password reset, and invitation emails.
# In development, if RESEND_API_KEY is unset, magic links are logged to the server console.
RESEND_API_KEY=
# From addresses. Must use a domain verified in Resend with SPF/DKIM/DMARC set up.
EMAIL_FROM_AUTH="Lobu <emre@lobu.ai>"
EMAIL_FROM_INVITES="Lobu <emre@lobu.ai>"
# Reply-To for transactional mail. Should be a monitored inbox.
EMAIL_REPLY_TO=emre@lobu.ai
# List-Unsubscribe value. Adds one-click unsubscribe headers (helps keep mail out of Promotions).
EMAIL_UNSUBSCRIBE=mailto:emre@lobu.ai