Repository navigation
Expand file tree
/
Copy path.env.example
More file actions
132 lines (119 loc) · 6.38 KB
/
Copy path.env.example
File metadata and controls
132 lines (119 loc) · 6.38 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
OMNARA_API_ADDR=:8080
# Metrics HTTP servers are only for health and metrics endpoints.
OMNARA_API_METRICS_ADDR=:8081
OMNARA_WORKER_METRICS_ADDR=:8082
OMNARA_MAINTENANCE_METRICS_ADDR=:8083
OMNARA_LOG_LEVEL=info
OMNARA_ALLOW_INSECURE_DEV_DEFAULTS=1
OMNARA_WORKER_EVENT_WEBHOOK_CONCURRENCY=128
OMNARA_EVENT_WEBHOOK_PER_ORG_CONCURRENCY=128
OMNARA_WORKER_CAPACITY=4
OMNARA_WORKER_INBOX_CAPACITY=4
OMNARA_WORKER_DISCORD_CAPACITY=1024
OMNARA_WORKER_ASYNC_TOOL_CAPACITY=32
OMNARA_WORKER_BACKGROUND_TOOL_CAPACITY=8
# Dedicated maintenance process interval. Use `go run ./cmd/maintenance` when
# running global maintenance separately from workers.
OMNARA_MAINTENANCE_INTERVAL=1s
# Redis Pub/Sub wakeups are best-effort; this is the API-side fallback drain
# floor for connected daemon sockets when wakeups are missed.
OMNARA_DAEMON_SOCKET_FALLBACK_DRAIN_INTERVAL=30s
OMNARA_DAEMON_SOCKET_FALLBACK_DRAIN_JITTER=10s
OMNARA_DATABASE_URL=postgres://omnara:omnara@127.0.0.1:55432/omnara?sslmode=disable
OMNARA_REDIS_URL=redis://127.0.0.1:6379/0
OMNARA_MIGRATIONS_DIR=migrations
OMNARA_MIGRATION_TIMEOUT=30m
# The URL users open in their browser. Defaults: http://localhost:8000 for the
# compose stack, http://localhost:5173 for `make run-*`. Set it when using a
# real domain or a tunnel.
# OMNARA_PUBLIC_URL=
# Separate versioned API URL; set identically on API, worker, and maintenance.
# OMNARA_PUBLIC_API_URL=
# __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS=host.example.com
# set __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS if OMNARA_PUBLIC_URL is served from
# a tunnel for testing slack or sandboxes
# Use embedded for a single-binary/self-hosted release, or disabled when a
# separate frontend host owns web assets.
OMNARA_WEB_SERVING=disabled
# Comma-separated proxy CIDRs whose X-Forwarded-For/X-Real-IP headers may be
# trusted for auth rate limiting. Include only proxy/load-balancer hops that you
# control, not client networks. Leave empty when the API is directly exposed.
# OMNARA_TRUSTED_PROXY_CIDRS=10.0.0.0/24
OMNARA_AUTH_SIGNUP_ENABLED=1
OMNARA_AUTH_PASSWORD_RESET_ENABLED=1
# Optional social/SSO browser login connectors. This list is authoritative at
# startup: previously configured instance connectors omitted here are disabled.
# Slugs must be lowercase URL-safe labels. GitHub defaults its OAuth endpoints;
# custom GitHub-compatible providers must provide issuer, authorization_url,
# token_url, and userinfo_url. OIDC connectors always use issuer discovery.
# OIDC connectors default to email_trust_policy "none"; use "verified_email"
# only for providers you trust to create/link accounts from verified email.
# Google can be configured as kind "oidc" with verified_email trust. Production
# connector URLs must use HTTPS, except localhost URLs used for local IdP testing.
# OMNARA_AUTH_CONNECTORS_JSON=[{"slug":"github","kind":"github","display_name":"GitHub","client_id":"<id>","client_secret":"<secret>"},{"slug":"google","kind":"oidc","display_name":"Google","issuer":"https://accounts.google.com","client_id":"<id>","client_secret":"<secret>","email_trust_policy":"verified_email"}]
# First-party auth emails. Local insecure dev defaults to console logging when
# this is left as none; production signup/reset require smtp or sendgrid.
OMNARA_EMAIL_DRIVER=console
OMNARA_EMAIL_FROM=
# OMNARA_SMTP_ADDR=smtp.example.com:587
# OMNARA_SMTP_USERNAME=
# OMNARA_SMTP_PASSWORD=
# Production SMTP auth email requires STARTTLS by default.
# OMNARA_SMTP_REQUIRE_TLS=1
# SENDGRID_API_KEY=
# Tenant application secrets are encrypted with envelope encryption. Configure a
# JSON key ring of key id to base64 32-byte key, plus the active key id for new
# writes. To rotate: add a new key, set it active, rewrap stored versions off the
# old key, then remove the old key after no versions reference it.
# Generate each non-dev key with: openssl rand -base64 32
# OMNARA_SECRET_ENCRYPTION_KEYS={"key-2026-06":"<base64-32-byte-key>"}
# OMNARA_SECRET_ENCRYPTION_ACTIVE_KEY_ID=key-2026-06
# When OMNARA_ALLOW_INSECURE_DEV_DEFAULTS=1 and both values are empty, local dev
# uses an insecure deterministic key with id "dev-local".
# Base64 32-byte key for signing skill downloads; must match on API and worker.
# Empty uses an insecure dev key when OMNARA_ALLOW_INSECURE_DEV_DEFAULTS=1.
# OMNARA_SKILL_DOWNLOAD_SIGNING_KEY=
# OMNARA_BILLING_URL=
# OMNARA_DAEMON_RELEASE_URL=https://releases.omnara.com/omnarad/latest
# MCP registry snapshot the API serves server search from; generate one with `make mcp-registry-sync`.
# OMNARA_MCP_REGISTRY_SNAPSHOT_PATH=/app/mcp-registry/mcp-registry.json
# OMNARA_DEFAULT_MACHINE_POOL_TEMPLATES=default-machine-pools-example.yaml
# OMNARA_UNIKRAFT_DEFAULT_POOL_TOKEN=
# Optional operator-provisioned model provider for new organizations.
# OMNARA_DEFAULT_MODEL_PROVIDER_TEMPLATE=
# OMNARA_HOSTED_API_URL=https://operator.example.com/internal
# OMNARA_HOSTED_API_TOKEN=
# OMNARA_MEMORY_DIR=
# Artifact content (file attachments, tool outputs) lives in S3-compatible
# object storage; a bucket is required. When
# OMNARA_ALLOW_INSECURE_DEV_DEFAULTS=1 and the bucket is empty, local dev
# uses the compose RustFS service (http://127.0.0.1:59000, bucket "omnara").
# In production point these at a real bucket; leave the access keys empty to
# use the AWS default credential chain.
# OMNARA_BLOB_S3_BUCKET=
# OMNARA_BLOB_S3_REGION=
# OMNARA_BLOB_S3_ENDPOINT=
# OMNARA_BLOB_S3_ACCESS_KEY_ID=
# OMNARA_BLOB_S3_SECRET_ACCESS_KEY=
# OMNARA_BLOB_S3_USE_PATH_STYLE=0
# Model provider API keys are used by the local example bootstrap and live tests.
OPENAI_API_KEY=
# OPENAI_BASE_URL=https://api.openai.com/v1
OPENROUTER_API_KEY=
# OPENROUTER_BASE_URL=https://openrouter.ai/api/v1
# Optional OpenRouter app attribution. These identify the Omnara deployment on
# OpenRouter and are only sent for the OpenRouter provider.
# OMNARA_OPENROUTER_SITE_URL=https://omnara.com
# OMNARA_OPENROUTER_APP_TITLE=Omnara
# OMNARA_OPENROUTER_APP_CATEGORIES=cloud-agent
ANTHROPIC_API_KEY=
# ANTHROPIC_BASE_URL=https://api.anthropic.com
# Black-box API suite (internal/blackbox, make test-blackbox) runs against an
# already-deployed control plane. The token is a personal access token for the
# target. The OpenRouter key is optional: without it the TestLive... tests skip.
# OMNARA_BLACKBOX_API_URL=...
# OMNARA_BLACKBOX_TOKEN=omnara_pat_v1_...
# OMNARA_BLACKBOX_OPENROUTER_KEY=
# OMNARA_BLACKBOX_OPENROUTER_MODEL=nvidia/nemotron-3-ultra-550b-a55b:free
# OMNARA_BLACKBOX_LOG=/tmp/blackbox-run.log
# OMNARA_BLACKBOX_LOG_VERBOSE=1