env.example

# ==============================================================================
# DeepEye Environment Configuration (Example)
# ==============================================================================
# 1. Copy this file to .env: `cp env.example .env`
# 2. Update the variables below with your specific configuration.
# 3. Docker Compose will automatically read the .env file.
# ==============================================================================

# ------------------------------------------------------------------------------
# 1. Multi-User Isolation (CRITICAL for Shared Servers)
# ------------------------------------------------------------------------------
# Unique name for your deployment. Prevents container and volume name conflicts.
# Suggestion: deepeye_yourname (e.g., deepeye_liboyan)
COMPOSE_PROJECT_NAME=deepeye_yourname

# ------------------------------------------------------------------------------
# 2. Port Configuration
# ------------------------------------------------------------------------------
# The main port to access the DeepEye application via the Nginx Gateway.
# Everyone on the same server MUST use a unique port.
HOST_GATEWAY_PORT=8080

# ------------------------------------------------------------------------------
# 3. LLM Provider Configuration (REQUIRED)
# ------------------------------------------------------------------------------
# Configure your AI backend (OpenAI, Anthropic, or OpenAI-compatible providers).
LLM_API_KEY=sk-your-api-key-here
LLM_BASE_URL=https://api.openai.com/v1
LLM_MODEL=replace-with-your-model-name
LLM_TEMPERATURE=0.7
# Max tokens for LLM completion. Set this to a value your provider/model actually supports.
# DeepSeek chat endpoints commonly accept up to 8192 output tokens.
LLM_MAX_TOKENS=8192
STARTUP_WARMUP_ENABLED=true
STARTUP_WARMUP_STRICT=true
STARTUP_WARMUP_TIMEOUT_SECONDS=15
API_LIMIT_CONCURRENCY=200
API_TIMEOUT_KEEP_ALIVE_SECONDS=60
CELERY_WORKER_CONCURRENCY=4
DOCKER_CONTROL_URL=http://runtime-control:8010
DOCKER_CONTROL_API_KEY=change-me-runtime-control-key
DOCKER_CONTROL_TIMEOUT_SECONDS=30
AGENT_DATASOURCE_SCHEMA_CACHE_TTL_SECONDS=300
PREVIEW_RUNTIME_TTL_SECONDS=3600
PREVIEW_RUNTIME_MAX_CONTAINERS=8

# Database schema migrations are applied automatically by docker compose.
# For local manual runs, use:
# uv run alembic -c packages/backend/alembic.ini upgrade head

# ------------------------------------------------------------------------------
# 4. Storage & Database Credentials (OPTIONAL)
# ------------------------------------------------------------------------------
# Required for backend + docker compose services.
POSTGRES_USER=postgres
POSTGRES_PASSWORD=replace-with-strong-postgres-password
MINIO_ACCESS_KEY=replace-with-minio-access-key
MINIO_SECRET_KEY=replace-with-minio-secret-key

# Test datasource container (retail-ops-db)
RETAIL_OPS_DB_USER=retail_ops
RETAIL_OPS_DB_PASSWORD=replace-with-retail-ops-db-password
RETAIL_OPS_DB_NAME=retail_ops

# ------------------------------------------------------------------------------
# 5. Video workspace (Optional - for local runs without Docker)
# ------------------------------------------------------------------------------
# Directory for video configs and TSX components. Default: /workspace in Docker;
# locally auto-falls back to .video_workspace in cwd if /workspace is not writable.
# Uncomment to override (e.g. for local testing):
# VIDEO_WORKSPACE_DIR=./.video_workspace

# ------------------------------------------------------------------------------
# 6. Runtime Images (Optional)
# ------------------------------------------------------------------------------
# Dashboard node uses an isolated runtime image (docker/Dockerfile.dashboard).
# Keep default unless you need a custom tag from private registry.
# DASHBOARD_IMAGE=deepeye-dashboard:latest
#
# Video preview node also uses an isolated runtime image (docker/Dockerfile.video-preview).
# Backend auto-builds this image when missing (set VIDEO_PREVIEW_AUTO_BUILD=false to disable).
# VIDEO_PREVIEW_IMAGE=deepeye-video-preview:latest
# VIDEO_PREVIEW_AUTO_BUILD=true

# ------------------------------------------------------------------------------
# 7. Azure Speech TTS (Optional - for data video narration)
# ------------------------------------------------------------------------------
# Required only if you use the data video generation node (video.generator).
# Get key/region from Azure Portal > Speech Services > Keys and Endpoint.
# AZURE_SPEECH_KEY=your-azure-speech-key
# AZURE_SPEECH_REGION=eastasia

# ------------------------------------------------------------------------------
# 8. Security Settings
# ------------------------------------------------------------------------------
# Secret key for JWT token generation. Use at least 32 random chars.
JWT_SECRET_KEY=replace-with-32-plus-random-characters

# CORS allowlist (JSON array). Required for cookie-based auth.
BACKEND_CORS_ORIGINS=["http://localhost:5173","http://127.0.0.1:5173"]

# JWT token expirations
ACCESS_TOKEN_EXPIRE_MINUTES=60
REFRESH_TOKEN_EXPIRE_DAYS=7

# Auth cookie settings
AUTH_COOKIE_SAMESITE=lax
AUTH_COOKIE_SECURE=false

# Email verification / password reset
EMAIL_VERIFICATION_TOKEN_EXPIRE_MINUTES=1440
PASSWORD_RESET_TOKEN_EXPIRE_MINUTES=30
REQUIRE_EMAIL_VERIFICATION=false
AUTH_FRONTEND_BASE_URL=http://localhost:5173
AUTH_DEBUG_RETURN_ACTION_TOKEN=false

# Optional SMTP (leave empty to disable real email sending)
# AUTH_SMTP_HOST=smtp.example.com
# AUTH_SMTP_PORT=587
# AUTH_SMTP_USERNAME=example-user
# AUTH_SMTP_PASSWORD=example-password
# AUTH_SMTP_USE_TLS=true
# AUTH_EMAIL_FROM=noreply@example.com

# Login throttle (best-effort in-process limits)
AUTH_LOGIN_MAX_ATTEMPTS=8
AUTH_LOGIN_WINDOW_SECONDS=300

# Optional local escape hatch:
# Set true to allow weak defaults in development only.
ALLOW_INSECURE_DEFAULTS=false