171 lines
7.9 KiB
Bash
171 lines
7.9 KiB
Bash
# Database Configuration
|
|
DATABASE_URL=postgresql+psycopg://postgres:postgres@db:5432/replypier
|
|
|
|
# CORS Configuration add backend url to allow cors from frontend
|
|
CORS_ORIGINS=["http://localhost:3000","http://localhost:8000"]
|
|
|
|
# Firebase Configuration
|
|
FIREBASE_CREDENTIALS=app/config/firebase-config.json
|
|
|
|
# Widget Configuration # prod image remove :3000 port, since frontend is running on port 80
|
|
VITE_WIDGET_URL=http://localhost:8000
|
|
FRONTEND_URL=http://localhost:3000
|
|
# Public URL of THIS backend. Self-hosters MUST set this to their domain
|
|
# (e.g. https://support.example.com) — the chat widget derives its API/WS URLs
|
|
# from it, so if it stays localhost the embedded widget can't reach the backend.
|
|
BACKEND_URL=http://localhost:8000
|
|
|
|
# Public help center URL style:
|
|
# path -> {BACKEND_URL}/help/{slug}, served same-origin (no DNS/TLS/proxy). Default, best for self-host.
|
|
# subdomain -> https://{slug}.<HELP_CENTER_BASE_DOMAIN> (needs wildcard DNS + TLS; used by cloud).
|
|
# A verified custom domain always overrides this.
|
|
HELP_CENTER_PUBLIC_MODE=path
|
|
|
|
# JWT Configuration
|
|
# These sign your auth and conversation tokens - anyone who knows them can forge
|
|
# tokens for any user, so the placeholders below must be replaced. Outside
|
|
# ENVIRONMENT=development the app refuses to start while they are still in place.
|
|
# Generate each (64 hex characters) with:
|
|
# openssl rand -hex 32
|
|
JWT_SECRET_KEY=your_jwt_secret_key_here
|
|
JWT_ALGORITHM=HS256
|
|
CONVERSATION_SECRET_KEY=your_conversation_secret_key_here
|
|
|
|
# Encryption and Redis
|
|
# REQUIRED outside development: encrypts API keys, provider/OAuth credentials, chat
|
|
# messages, session summaries and agent memory at rest. Losing or changing it makes
|
|
# existing data unreadable, so back it up separately from the database.
|
|
#
|
|
# The value is a Fernet key that has been base64-encoded a second time: a
|
|
# 60-character string ending in '='. Generate one with either of:
|
|
# python -c "import base64;from cryptography.fernet import Fernet;print(base64.b64encode(Fernet.generate_key()).decode())"
|
|
# openssl rand -base64 32 | tr '+/' '-_' | tr -d '\n' | base64
|
|
#
|
|
# Leaving the placeholder below in place means: outside development the app
|
|
# refuses to start; in development it generates a throwaway key on every boot,
|
|
# so anything encrypted before a restart becomes unreadable after it.
|
|
ENCRYPTION_KEY=your_fernet_encryption_key_here
|
|
|
|
# Escape hatch for deployments created before ENCRYPTION_KEY had to be set, whose
|
|
# data is encrypted under the old public default. It downgrades the startup error
|
|
# to a warning so those instances still boot. Anyone with a copy of the database
|
|
# can read their conversations and stored credentials, so treat it as temporary.
|
|
# Moving off the old key means re-encrypting what it wrote, not just swapping the
|
|
# value - see the key-id rotation note at the top of app/core/encryption.py.
|
|
# ALLOW_INSECURE_ENCRYPTION_KEY=false
|
|
REDIS_ENABLED=true
|
|
REDIS_URL=redis://localhost:6379/0
|
|
|
|
# Environment
|
|
ENVIRONMENT=development
|
|
|
|
# S3 Configuration
|
|
S3_FILE_STORAGE=false
|
|
S3_BUCKET=replypier-uploads
|
|
S3_REGION=us-east-1
|
|
# Leave both blank on EC2/ECS/EKS to use the attached IAM role — boto3 then
|
|
# resolves credentials from its default chain. Set them only for static keys;
|
|
# a placeholder value here is treated as a real (invalid) key.
|
|
AWS_ACCESS_KEY_ID=
|
|
AWS_SECRET_ACCESS_KEY=
|
|
# Lifetime of generated presigned URLs, in seconds. They are re-signed on every
|
|
# response, so this only needs to outlive a page render. AWS rejects SigV4
|
|
# presigns above 604800 (7 days); larger values are clamped to that.
|
|
S3_PRESIGN_EXPIRY_SECONDS=3600
|
|
|
|
# Jira — create an OAuth 2.0 (3LO) app at developer.atlassian.com. Unlike the
|
|
# other integrations the redirect URI is configured here rather than derived
|
|
# from BACKEND_URL, so it must match the callback registered on the Atlassian
|
|
# app exactly (route: {API_V1_STR}/jira/callback).
|
|
JIRA_CLIENT_ID=your_jira_client_id_here
|
|
JIRA_CLIENT_SECRET=your_jira_client_secret_here
|
|
JIRA_REDIRECT_URI=http://localhost:8000/api/v1/jira/callback
|
|
|
|
SHOPIFY_API_KEY=your_shopify_key
|
|
SHOPIFY_API_SECRET=your_shopify_secret
|
|
SHOPIFY_API_VERSION=2025-04
|
|
|
|
# Slack channel — create an app at api.slack.com/apps. The OAuth redirect URI is
|
|
# derived from BACKEND_URL, so add {BACKEND_URL}/api/v1/channels/slack/callback
|
|
# to the app's Redirect URLs. Without SLACK_SIGNING_SECRET every incoming Slack
|
|
# webhook is rejected with a 403, since signature checks fail closed.
|
|
SLACK_CLIENT_ID=your_slack_client_id
|
|
SLACK_CLIENT_SECRET=your_slack_client_secret
|
|
SLACK_SIGNING_SECRET=your_slack_signing_secret
|
|
|
|
# CRM lead push (HubSpot / Pipedrive) — create OAuth apps at
|
|
# developers.hubspot.com and developers.pipedrive.com. Redirect URIs derive from
|
|
# BACKEND_URL: add {BACKEND_URL}/api/v1/crm/hubspot/callback and
|
|
# {BACKEND_URL}/api/v1/crm/pipedrive/callback to the respective apps.
|
|
HUBSPOT_CLIENT_ID=your_hubspot_client_id
|
|
HUBSPOT_CLIENT_SECRET=your_hubspot_client_secret
|
|
PIPEDRIVE_CLIENT_ID=your_pipedrive_client_id
|
|
PIPEDRIVE_CLIENT_SECRET=your_pipedrive_client_secret
|
|
|
|
# Meta channels (WhatsApp Cloud API, Messenger, Instagram) — create an app at
|
|
# developers.facebook.com. META_WEBHOOK_VERIFY_TOKEN is any random string you pick
|
|
# and also enter in the App Dashboard webhook config.
|
|
META_APP_ID=your_meta_app_id
|
|
META_APP_SECRET=your_meta_app_secret
|
|
META_WEBHOOK_VERIFY_TOKEN=any_random_string_you_choose
|
|
META_GRAPH_VERSION=v21.0
|
|
# Only for cloud-hosted one-click onboarding; leave blank for self-hosting.
|
|
# META_CONFIG_ID: WhatsApp Embedded Signup. META_MESSENGER_CONFIG_ID: Facebook
|
|
# Login for Business, for connecting a Page (Messenger + Instagram DM).
|
|
META_CONFIG_ID=
|
|
META_MESSENGER_CONFIG_ID=
|
|
# Instagram API with Instagram Login (no Facebook Page needed). These are the
|
|
# Instagram app id/secret from the app's Instagram product, NOT the Meta ones.
|
|
INSTAGRAM_APP_ID=
|
|
INSTAGRAM_APP_SECRET=
|
|
# Comma-separated emails allowed to use one-click Meta signup. Empty = everyone.
|
|
# Set this while the Meta app is in App Review so the flow can be exercised in
|
|
# production without offering customers a login that would fail for them.
|
|
SIGNUP_ALLOWED_EMAILS=
|
|
|
|
VERIFY_SSL_CERTIFICATES=true
|
|
|
|
# Which addresses the AI base URL, MCP server URLs and ticket database (or its
|
|
# SSH host) may point at. These are dialled by this server, so:
|
|
# any -> no restriction. Default; lets a self-hosted install reach its
|
|
# own network (Ollama on localhost, an internal MCP server, a
|
|
# private database).
|
|
# public_only -> refuse private, loopback, link-local and reserved addresses.
|
|
# Use it when people you don't control can configure these
|
|
# (a shared or multi-tenant deployment). Checked on the
|
|
# address actually dialled, redirects included; these
|
|
# connections then bypass HTTP(S)_PROXY.
|
|
OUTBOUND_URL_POLICY=any
|
|
|
|
# STDIO MCP connectors run a command on this server, typed by an org admin.
|
|
# Keep true on your own install; set false wherever people you don't control
|
|
# can add connectors (a shared or multi-tenant deployment).
|
|
MCP_STDIO_ENABLED=true
|
|
|
|
# Enhanced Website Knowledge Base Configuration
|
|
KB_MAX_DEPTH=5
|
|
KB_MAX_LINKS=25
|
|
KB_MIN_CONTENT_LENGTH=100
|
|
KB_TIMEOUT=30
|
|
KB_MAX_RETRIES=3
|
|
KB_MAX_WORKERS=5
|
|
KB_BATCH_SIZE=5
|
|
KB_SOURCE_TIME_LIMIT_SECONDS=1800
|
|
KB_PDF_MAX_PAGES=300
|
|
|
|
# Seconds a single agent run (model + tool calls) may take before it is
|
|
# cancelled and the visitor gets an error reply. Raise it if agents with many
|
|
# MCP/Shopify tools hit the limit on legitimate answers.
|
|
AGENT_RUN_TIMEOUT=90
|
|
|
|
# agno's own run reporting to api.agno.com. Off unless set to true here; when on,
|
|
# it runs inside every agent run and counts against AGENT_RUN_TIMEOUT.
|
|
# AGNO_TELEMETRY=true
|
|
# AGNO_MONITOR=true
|
|
|
|
# Tool calls an agent may make in one turn before it has to answer from what it
|
|
# already retrieved. Hitting this is not an error — the agent answers without
|
|
# further tools. Raise it if agents with many knowledge sources or MCP tools are
|
|
# answering from too little context.
|
|
AGENT_TOOL_CALL_LIMIT=5
|