OmniPanel/.env.example at main · Nanboy-Ronan/OmniPanel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
RAP_SECRET=change-me
# Comma-separated previous RAP_SECRET values, accepted for verifying
# already-issued JWTs only — leave empty outside of a rotation window. See the
# secret rotation runbook in README.md.
RAP_SECRET_PREVIOUS=
RAP_DATABASE_URL=postgresql+asyncpg://rpa:rpa@127.0.0.1:5432/rpa
WECOM_CORP_ID=
WECOM_AGENT_ID=
WECOM_APP_SECRET=
WECOM_STREAMLIT_REDIRECT_URI=https://example.com/
# Public URL of the Streamlit app, used to build the WeChat Work OAuth
# redirect link shown in notifications/emails. Falls back to
# WECOM_STREAMLIT_REDIRECT_URI when unset.
APP_URL=
API_URL=http://localhost:8000
CORS_ORIGINS=http://localhost:8501
SSL_KEYFILE=
SSL_CERTFILE=
WECOM_DEFAULT_ROLE=viewer
WECOM_AUTO_CREATE_USERS=true
WECOM_OAUTH_SCOPE=snsapi_privateinfo
PORT=8000
HOST=0.0.0.0
PROXY_HEADERS=yes
# IPs allowed to set X-Forwarded-For; anything else is treated as the real
# client (no header spoofing). Must list every hop that legitimately sits in
# front of this process. In the documented deployment that's only the
# Streamlit process, which calls the API over loopback — leave at the default
# unless your topology differs.
FORWARDED_ALLOW_IPS=127.0.0.1

# 中文问数据 (NL-to-SQL). Optional — enable the AI query helper in the SQL console.
# Configure the API key for any providers you want, then users pick provider +
# model from a dropdown in the SQL console. Keys stay server-side. No key set on
# any provider → feature returns 503 and nothing else is affected.
#
# NL_SQL_PROVIDER / NL_SQL_MODEL are only the *default* selection; the dropdown
# can switch at query time. NL_SQL_MODEL is used only when valid for the chosen
# provider, otherwise that provider's first model is used.
NL_SQL_PROVIDER=anthropic
NL_SQL_MODEL=

# Set one or more of these. Each named provider has a fixed base_url + model list
# built in (see app/utils/nl_to_sql.PROVIDERS); just supply the key.
ANTHROPIC_API_KEY=
MINIMAX_API_KEY=
DEEPSEEK_API_KEY=
MOONSHOT_API_KEY=
ZHIPU_API_KEY=

# Generic OpenAI provider. Leave OPENAI_BASE_URL empty for real OpenAI, or point
# it at any other OpenAI-compatible endpoint not covered by the named providers.
OPENAI_API_KEY=
OPENAI_BASE_URL=

# Set when PostgreSQL runs in a Docker container and the host has no pg_dump/psql.
# Backups (pg_dump) and restores (psql) are then run inside this container via
# `docker exec`, streaming the dump to/from a host file. Leave empty to use the
# host's own client tools.
RPA_PG_DOCKER_CONTAINER=

# WeChat Official Accounts. Prefer numbered variables when multiple accounts
# are connected. Keep real secrets in local .env only.
WECHAT_APP_ID_1=
WECHAT_APP_SECRET_1=
WECHAT_ACCOUNT_NAME_1=
WECHAT_APP_ID_2=
WECHAT_APP_SECRET_2=
WECHAT_ACCOUNT_NAME_2=
WECHAT_APP_ID_3=
WECHAT_APP_SECRET_3=
WECHAT_ACCOUNT_NAME_3=

# Daily WeChat metric auto-sync (app/scheduler.py). OFF by default — without
# this set to true the accounts above are only ever synced by hand from the
# 微信公众号 page, and the DataCube 180-day retention window silently expires.
# Every run sends a WeCom message (failures always; successes unless
# WECOM_NOTIFY_SUCCESS=false).
WECHAT_AUTO_SYNC_ENABLED=true
WECHAT_AUTO_SYNC_HOUR=3
WECHAT_AUTO_SYNC_WINDOW_DAYS=170

# Per-run WeCom success notifications for the collector and WeChat sync.
# Failures are always sent regardless of this flag.
WECOM_NOTIFY_SUCCESS=true

# Daily backstop: alerts when an enabled pipeline (collector / WeChat sync /
# monthly backup) has produced no run at all — the per-run notifications above
# say nothing when a pipeline stops firing entirely.
WATCHDOG_ENABLED=true
WATCHDOG_HOUR=9

# Creator-portal collector (run by the rpa-collector systemd timer, not by the
# API process). See docs/collector.md.
COLLECTOR_ENABLED=false
COLLECTOR_XHS_ENABLED=true
COLLECTOR_ZHIHU_ENABLED=true
COLLECTOR_PUGONGYING_ENABLED=true
# Keep false: true headless is unverified against XHS's CAS login. On a
# headless VM the systemd unit wraps the run in `xvfb-run -a` instead.
COLLECTOR_HEADLESS=false
COLLECTOR_API_URL=http://127.0.0.1:8000
COLLECTOR_SERVICE_EMAIL=
COLLECTOR_SERVICE_PASSWORD=