forked from onecli/onecli
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.example
More file actions
134 lines (125 loc) · 7.07 KB
/
Copy path.env.example
File metadata and controls
134 lines (125 loc) · 7.07 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
# OneCLI environment reference. You do NOT copy this file.
#
# `pnpm dev` creates and maintains `.env` itself: it generates every required
# secret on first run (BETTER_AUTH_SECRET, SECRET_ENCRYPTION_KEY,
# GATEWAY_INTERNAL_SECRET, RUNNER_TOKEN, CHANNEL_ADAPTER_TOKEN), writes the
# dev DATABASE_URL, and never overwrites a value you set. A self-host install
# gets the same treatment from `pnpm run setup` (into docker/.env) or the
# install script (into ~/.onecli/.env).
#
# Everything below is an OPTIONAL override: put a line in `.env` only when you
# want something other than the default. Your shell environment always beats
# the file.
# Local dev database — what `pnpm dev` writes and `pnpm db:up` starts.
# DATABASE_URL=postgresql://onecli:onecli@localhost:5432/onecli
# Google sign-in — optional. Email and password always works; setting these
# adds a "Continue with Google" button beside it.
# Redirect URI: <API_URL>/auth/callback/google
# GOOGLE_CLIENT_ID=
# GOOGLE_CLIENT_SECRET=
# Where the gateway calls the api-server for internal work (1Password op://
# resolution). Dev default shown; the compose stack sets http://api:10256.
# INTERNAL_API_URL=http://localhost:10256
# ── Public URL ──────────────────────────────────────────────────────────
#
# ONE var answers "where do people open OneCLI": ONECLI_EXTERNAL_URL. It is
# deliberately not derived from the address the server binds to — those are
# different things, and only you know the first one. Every other address
# derives from it by one rule:
#
# http means PORTS mode: the api and gateway live on the same host, on
# their own ports (10256 / 10255 by default)
# https means PROXY mode: one origin; your reverse proxy terminates TLS
# and routes /v1 + /auth to the api and /gw/* to
# the gateway (see docs/self-hosting.md)
#
# The cookie Secure flag, OAuth redirect URIs, CLI api-host, install
# snippets, emails, Slack buttons, and the links the gateway writes into
# agent-facing responses all follow from it. Unset means localhost — right
# for a laptop or a tunnel (ssh -L), and the gateway says so loudly at
# startup when links would point at the fallback.
# ONECLI_EXTERNAL_URL=http://192.168.1.50:10254
# ONECLI_EXTERNAL_URL=https://onecli.example.com
# ── Advanced networking (most installs never set these) ─────────────────
#
# APP_URL is the legacy alias of ONECLI_EXTERNAL_URL (older installs; kept
# working forever). Unlike the canonical var it never derives the api and
# gateway origins — set those explicitly if you use it.
# APP_URL=https://onecli.example.com
#
# API_URL / GATEWAY_API_URL override single origins for split-host installs
# (dashboard and api on different hosts). OAuth redirect URIs are /v1
# endpoints answered by the api-server — never by the dashboard — so they
# resolve from the api origin. Unset, they derive from ONECLI_EXTERNAL_URL,
# or from each incoming request when nothing is configured at all.
# API_URL=https://api.onecli.example.com
# GATEWAY_API_URL=https://gw.onecli.example.com
#
# Extra browser origins the auth layer should trust (comma-separated), for
# an install reachable at more than one address (a LAN IP and a DNS name).
# Sessions stay per-hostname; this only stops the sign-in 403.
# ONECLI_TRUSTED_ORIGINS=http://192.168.1.50:10254
#
# Sibling subdomains (app + api under one parent) JUST WORK: the session
# cookie is automatically issued for the most specific shared parent so the
# dashboard, the API and the gateway all see the login. Mind the tradeoff
# that comes with any shared cookie domain: EVERY subdomain of that parent
# can read the session cookie, so don't host untrusted apps on sibling
# subdomains. Pin a different scope, or set `none` to keep the cookie on the
# API host only:
# BETTER_AUTH_COOKIE_DOMAIN=onecli.example.com
#
# After changing the cookie's domain, browsers may still hold the old cookie
# beside the new one until it expires — have users clear cookies (or clear
# the `sessions` table) if logins act stale.
#
# Hosts that share NO parent domain — localhost plus a tunnel, two unrelated
# domains — cannot share a cookie at all (a browser rule, not a OneCLI one):
# serve everything behind ONE origin instead, e.g. a reverse proxy. `pnpm dev`
# does exactly that out of the box: the dev server proxies /v1, /auth and the
# gateway under :10254, so one tunnel in front of it serves the whole product.
# Agent proxy — the scheme-less host:port AGENT CONTAINERS use as their
# CONNECT proxy target (HTTPS_PROXY). Machine-to-machine plane, never a
# browser origin; the compose stack sets gateway:10255. The old
# GATEWAY_BASE_URL name keeps working as a permanent alias.
# Self-host: host.docker.internal:10255, Cloud: gateway.onecli.sh:10255
# ONECLI_AGENT_PROXY_ADDRESS=host.docker.internal:10255
# ── Hosted agents: the runner plane ─────────────────────────────────────
# FOR `pnpm dev` YOU NORMALLY SET NOTHING HERE. The launcher's built-in dev
# defaults supply the host-shaped values (advertised host, a routable sandbox
# network, the `onecli-agent:dev` image tag) and it mints RUNNER_TOKEN into
# `.env` for you. Compose overrides all of it with container-shaped values.
# Set something below only to depart from that — e.g. on LINUX, where
# `host.docker.internal` does not resolve inside a container:
# RUNNER_ADVERTISED_HOST=172.17.0.1
# ONECLI_AGENT_PROXY_ADDRESS=172.17.0.1:10255
#
# The runner is the daemon that starts, parks, and reaps agent sandboxes.
# Without a registered runner the hosted-agent surface stays hidden entirely.
# Runner-side settings (the runner process only; local defaults shown)
# RUNNER_CONTROL_PLANE_URL=http://localhost:10256
# RUNNER_BACKEND=docker
# RUNNER_AGENT_IMAGE=onecli-agent:dev
# RUNNER_SANDBOX_NETWORK=onecli-sandboxes-dev
# Set false ONLY for local development, where the gateway runs on the host
# rather than on the sandbox network. In a real deployment this stays true —
# it is what makes gateway-only egress an enforced boundary.
# RUNNER_NETWORK_INTERNAL=false
# RUNNER_ADVERTISED_HOST=host.docker.internal
# RUNNER_MAX_SANDBOXES=4
# Per-sandbox resource limits (a real container's real ceilings)
# RUNNER_SANDBOX_MEMORY_MB=2048
# RUNNER_SANDBOX_CPUS=1
# RUNNER_SANDBOX_PIDS=512
# Plain Linux: make host.docker.internal resolve inside sandboxes
# RUNNER_SANDBOX_EXTRA_HOSTS=host.docker.internal:host-gateway
# The stale-label orphan sweep (leftovers of a dead runner id): false = log only
# RUNNER_ORPHAN_REAP=true
# RUNNER_ORPHAN_GRACE_SECONDS=3600
# How long a sandbox may sit idle before it is parked (its disk survives)
# SANDBOX_IDLE_STOP_SECONDS=1800
# How stale a runner's heartbeat may be before it reads as offline
# RUNNER_ONLINE_THRESHOLD_SECONDS=90
# Ceiling on sandboxes held awake by live background work, per runner
# (default: RUNNER_MAX_SANDBOXES − 1, floor 1 — one slot always stays free)
# MAX_HELD_AWAKE_SANDBOXES=3