traceroot/.env.example at main · traceroot-ai/traceroot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
# =============================================================================
# TraceRoot Development Environment
# =============================================================================
# Copy to .env and update values marked CHANGEME for production.
# This single file is used by ALL services (Python backend, Next.js frontend,
# TS worker). No other .env files are needed.

# --- Database (PostgreSQL) ---------------------------------------------------
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/postgres  # CHANGEME

# --- ClickHouse ---------------------------------------------------------------
CLICKHOUSE_HOST=localhost
CLICKHOUSE_PORT=8123
CLICKHOUSE_USER=clickhouse
CLICKHOUSE_PASSWORD=clickhouse  # CHANGEME
CLICKHOUSE_DATABASE=default

# --- S3 / MinIO ---------------------------------------------------------------
S3_ENDPOINT_URL=http://localhost:9090
S3_ACCESS_KEY_ID=minio
S3_SECRET_ACCESS_KEY=minio-password  # CHANGEME
S3_BUCKET_NAME=traceroot
S3_REGION=us-east-1

# --- Redis --------------------------------------------------------------------
REDIS_URL=redis://localhost:6379/0

# --- Rate limiting (REST API) -------------------------------------------------
# Cloud-only: no-op when ENABLE_BILLING=false (the operator's own infra is the
# ceiling). Per-plan defaults live in backend/shared/config.py (RateLimitSettings).
# RATE_LIMIT_ENABLED=true              # master kill-switch
# RATE_LIMIT_STORAGE_URI=              # defaults to REDIS_URL; memory:// for single-process

# --- REST API (Python FastAPI) ------------------------------------------------
# NOTE: Do NOT use generic HOST= or PORT= here — Next.js also reads PORT
# and would start on the wrong port. FastAPI defaults to 0.0.0.0:8000.
CORS_ORIGINS=["http://localhost:3000"]

# --- Internal API (Python <-> Next.js service communication) ------------------
TRACEROOT_UI_URL=http://localhost:3000
# Host/browser-usable UI URL used in client-facing links (trace_url, whoami).
# Keep host-reachable (e.g. http://localhost:3000); do NOT set to http://web:3000.
TRACEROOT_PUBLIC_UI_URL=http://localhost:3000
INTERNAL_API_SECRET=dev-internal-secret  # CHANGEME in production

# --- Worker (Python/Celery) ---------------------------------------------------
POLL_INTERVAL_SECONDS=5
BATCH_SIZE=100

# --- Billing Worker (Node.js) -------------------------------------------------
BACKEND_INTERNAL_URL=http://localhost:8000  # Python backend URL for internal API calls
USAGE_METERING_CRON="5 * * * *"  # Cron schedule for usage metering job

# --- better-auth --------------------------------------------------------------
BETTER_AUTH_URL=http://localhost:3000
BETTER_AUTH_SECRET=your-better-auth-secret  # CHANGEME - must be 32+ characters
NEXT_PUBLIC_APP_URL=http://localhost:3000

# --- Google OAuth (optional for local dev) ------------------------------------
# AUTH_GOOGLE_CLIENT_ID=your-google-client-id
# AUTH_GOOGLE_CLIENT_SECRET=your-google-client-secret

# --- Frontend -----------------------------------------------------------------
NEXT_PUBLIC_API_URL=http://localhost:8000/api/v1

# --- Email (optional) ---------------------------------------------------------
# TRACEROOT_SMTP_URL=smtp://user:pass@host:port
# TRACEROOT_SMTP_MAIL_FROM=noreply@yourdomain.com

# --- Billing Toggle -----------------------------------------------------------
# Set to "false" for self-hosted deployments to unlock all features, skip seat
# limits, and never block ingestion. When "false", you don't need to run the
# billing worker or configure Stripe keys below.
ENABLE_BILLING=false

# Enterprise Edition (self-hosted)
# Set this to enable enterprise features (SSO, audit logs, advanced RBAC)
# TRACEROOT_EE_LICENSE_KEY=traceroot_ee_your_key_here

# --- Stripe Billing -----------------------------------------------------------
STRIPE_SECRET_KEY=sk_test_xxx  # CHANGEME - from Stripe Dashboard > Developers > API keys
# For local dev: run `stripe listen --forward-to localhost:3000/api/billing/webhook` and copy the printed whsec_ value here
STRIPE_WEBHOOK_SIGNING_SECRET=whsec_xxx  # CHANGEME - from Stripe CLI or Dashboard > Webhooks
STRIPE_PRICE_ID_STARTER=price_xxx  # CHANGEME - from Stripe Dashboard > Products > Prices
STRIPE_PRICE_ID_PRO=price_xxx  # CHANGEME
STRIPE_PRICE_ID_AI_USAGE=price_xxx  # CHANGEME
STRIPE_PRICE_ID_RCA_USAGE=price_xxx  # CHANGEME - separate metered product for RCA runs
STRIPE_PRICE_ID_DETECTOR_USAGE=price_xxx  # CHANGEME - meter for managed detector inference (1.05x pass-through)

# --- GitHub App ---------------------------------------------------------------
GITHUB_APP_ID=                      # From GitHub App settings > General > App ID
GITHUB_APP_NAME=                    # Your app's slug (e.g. "traceroot-dev")
GITHUB_APP_PRIVATE_KEY=             # PEM key (Settings > Private keys > Generate)
GITHUB_APP_CLIENT_ID=               # From GitHub App settings > General > Client ID
GITHUB_APP_CLIENT_SECRET=           # From GitHub App settings > General > Client secrets
GITHUB_OAUTH_REDIRECT_URI=http://localhost:3000/api/github/callback

# --- Slack App ---------------------------------------------------------------
# Create at https://api.slack.com/apps → "Create New App" → "From scratch".
# Configure:
#   - OAuth & Permissions → Bot Token Scopes:
#       chat:write, chat:write.public, channels:read, groups:read
#   - OAuth & Permissions → Redirect URLs: paste SLACK_REDIRECT_URI below
# Then read values from "Basic Information" → "App Credentials".
SLACK_CLIENT_ID=                    # Basic Information > App Credentials > Client ID
SLACK_CLIENT_SECRET=                # Basic Information > App Credentials > Client Secret
SLACK_STATE_SECRET=                 # Generate locally: `openssl rand -hex 32`
SLACK_REDIRECT_URI=http://localhost:3000/api/slack/oauth/callback

# --- Encryption (BYOK) --------------------------------------------------------
# 64-character hex string (256 bits) for AES-256-GCM encryption of BYOK keys.
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
ENCRYPTION_KEY=9cf7ec27e77884f3d76dda6312f55317b2b6fff317e5b09d4a9ad7b20eff5e00

# --- AI Agent Service ---------------------------------------------------------
AGENT_SERVICE_URL=http://localhost:8100

# --- LLM API Keys -------------------------------------------------------------
# Required for AI Agent and Detectors features.
# At least one key is needed. Anthropic is the default provider.
# These can also be configured per-workspace in the UI (Settings > API Keys).
# ANTHROPIC_API_KEY=sk-ant-...  # CHANGEME - required for Claude models (default)
# OPENAI_API_KEY=sk-...         # CHANGEME - required if using GPT models

# Timeout (ms) for the model-provider "Test connection" check, bounding each
# connectivity probe so a stalled provider host can't hang the request. Optional;
# defaults to 10000, capped at 60000. Invalid/zero/negative values use the default.
# MODEL_PROVIDER_TEST_TIMEOUT_MS=10000

# --- Detectors ----------------------------------------------------------------
# Per-attempt wall-clock timeout (ms) for the detector LLM-as-judge eval. Bounds
# a hung or unreachable provider so it can't stall the detector worker.
# DETECTOR_EVAL_TIMEOUT_MS=60000

# ── Sandbox Provider ──────────────────────────────────────────────────────────
# Choose: "docker" (dev/self-hosted) or "daytona" (production/SaaS)
SANDBOX_PROVIDER=docker

# Daytona settings (when SANDBOX_PROVIDER=daytona)
# DAYTONA_API_KEY=your-api-key

# --- Analytics (PostHog) -------------------------------------------------------
# Get these from https://us.posthog.com → Project Settings → Project API Key
# Leave blank to disable analytics (safe for local dev)
# NEXT_PUBLIC_POSTHOG_KEY=phc_your_project_api_key_here
# NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com

# --- Branding / Public URLs ---------------------------------------------------
NEXT_PUBLIC_LOGO_URL=https://raw.githubusercontent.com/traceroot-ai/traceroot/main/frontend/ui/public/images/traceroot_icon.png
NEXT_PUBLIC_DOCS_URL=https://traceroot.ai/docs
NEXT_PUBLIC_GITHUB_REPO_URL=https://github.com/traceroot-ai/traceroot
NEXT_PUBLIC_GITHUB_ISSUES_URL=https://github.com/traceroot-ai/traceroot/issues
NEXT_PUBLIC_DISCORD_INVITE_URL=https://discord.gg/TM2m3CtKuC
NEXT_PUBLIC_FOUNDERS_CAL_URL=https://cal.com/traceroot/30min