helprs/.env.example at main · mariuspruvot/helprs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
# =============================================================================
# helPRs Configuration
# =============================================================================
# Copy this file to .env and fill in all values.
# See docs/self-hosting.md for detailed setup instructions.

# --- Database ----------------------------------------------------------------
# For local dev with docker-compose, the defaults (helprs/helprs) work as-is.
# For production, use strong credentials and update POSTGRES_PASSWORD below.
DATABASE_URL=postgresql+asyncpg://helprs:helprs@db:5432/helprs

# --- Security ----------------------------------------------------------------
# JWT signing key (used for access tokens and refresh tokens)
# Generate: python -c "import secrets; print(secrets.token_urlsafe(48))"
SECRET_KEY=

# Encryption key for stored credentials (Fernet symmetric encryption)
# Generate: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
FERNET_KEY=

# Previously-active keys, JSON list, newest first. Values encrypted under them
# stay readable, so FERNET_KEY can be replaced without a downtime window:
#   1. set the new key as FERNET_KEY and move the old one here
#   2. deploy - new writes use the new key, old values still decrypt
#   3. uv run python -m helprs.scripts.rotate_credentials
#   4. empty this list and deploy again
# Leave unset when no rotation is in flight: a retired key is exactly as
# sensitive as a live one for as long as it appears here.
# FERNET_KEY_FALLBACKS=["<previous-key>"]

# Admin panel password. Required when ENVIRONMENT=production; when it is unset
# the panel is not mounted at all, in any environment.
ADMIN_PASSWORD=

# --- GitHub App --------------------------------------------------------------
# Create a GitHub App at https://github.com/settings/apps/new
# See docs/self-hosting.md Step 1 for full instructions.

# Numeric App ID (shown at the top of the app settings page)
GITHUB_APP_ID=

# OAuth Client ID and Secret (under "OAuth credentials" in app settings)
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

# Webhook secret (must match what you entered when creating the app)
# Generate: python -c "import secrets; print(secrets.token_urlsafe(32))"
GITHUB_WEBHOOK_SECRET=

# RSA private key for the GitHub App (base64-encoded PEM)
# Generate the key in GitHub App settings, then encode:
#   base64 -i your-app.private-key.pem | tr -d '\n'
# Note: docker-compose env_file doesn't support multi-line values.
# Alternative: use docker-compose.override.yml with a YAML block scalar.
GITHUB_APP_PRIVATE_KEY=

# --- Sentry (optional) ------------------------------------------------------
# Error tracking. Leave empty to disable.
SENTRY_DSN=

# --- URLs --------------------------------------------------------------------
# API URL as seen by the frontend (Vite build-time variable)
VITE_API_URL=http://localhost:8000

# GitHub App slug (from the GitHub App settings URL, e.g. "helprs-dev").
# Build-time Vite variable used by the frontend to build the "Install app" link.
VITE_GITHUB_APP_SLUG=

# Public URL of the frontend (used by the backend to build links in PR comments)
APP_BASE_URL=http://localhost:5173

# CORS allowed origins (JSON array)
CORS_ORIGINS=["http://localhost:5173"]

# --- Environment -------------------------------------------------------------
# "development" or "production"
# Production mode enforces:
#   - Non-empty SECRET_KEY, FERNET_KEY, ADMIN_PASSWORD
#   - Real password required for admin panel login
ENVIRONMENT=development

# --- Container Orchestration -------------------------------------------------
# Maximum container lifetime in seconds before forced cleanup (default: 900 = 15 min)
CONTAINER_TTL_SECONDS=900

# Number of uvicorn workers (default: 4)
UVICORN_WORKERS=4

# --- Database pool, PER WORKER ----------------------------------------------
# UVICORN_WORKERS x (DB_POOL_SIZE + DB_MAX_OVERFLOW) must stay below the
# Postgres server's max_connections (default 100). Defaults give 4 x 15 = 60.
# DB_POOL_SIZE=10
# DB_MAX_OVERFLOW=5

# Absolute path to skills/ directory on the Docker host.
# Required for Docker-in-Docker volume mounts (the API container mounts this
# path into claude-runner containers). Must be an absolute path on the HOST,
# not inside the container. In local dev, docker-compose.yml defaults this to
# ${PWD}/skills; only set it explicitly in production.
# SKILLS_HOST_PATH=/absolute/path/to/helprs/skills

# GID of the `docker` group on the host. The API container joins this group
# so it can talk to the mounted Docker socket. Defaults to 994 if unset.
# Find it with: getent group docker | cut -d: -f3
# DOCKER_GID=994

# --- Postgres (production compose only) -------------------------------------
# Only used by infra/coolify/docker-compose.prod.yml (required there).
# The dev docker-compose.yml hardcodes the dev password.
POSTGRES_PASSWORD=