agent-git-service/.env.example at main · ngaut/agent-git-service · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
# agent-git-service configuration reference.
# Copy this file to .env, then fill or export the required quick-start values below.
# Do not commit real credentials or production DSNs.
# Use `make test-setup` when you need the test-only local TiDB playground.

# ==============================================================================
# Required quick-start settings
# ==============================================================================

# TiDB or MySQL-compatible connection string. TiDB Zero quickstarts can use the
# default test database. Production and persistent deployments should use TiDB
# Cloud Starter with a dedicated gh-server database. TiDB Cloud public
# connections require tls=true.
# Examples:
# DB_DSN="<zero-user>:<zero-password>@tcp(<zero-host>:4000)/test?parseTime=true&timeout=10s&tls=true"
# DB_DSN="<prefix>.root:<password>@tcp(<tidb-cloud-host>:4000)/gh-server?parseTime=true&timeout=10s&tls=true"
DB_DSN=""

# Use production listener mode for the local quickstart: one HTTP listener on
# PORT. Development listener mode is for github.localhost TLS/multi-listener
# development.
LISTEN_MODE="production"

# Development mode seeds the local admin user below at startup.
ENVIRONMENT="development"

# Local HTTP endpoint used by the quickstart.
PORT="8080"
BASE_URL="http://localhost:8080"

# Directory where bare Git repositories are stored.
GIT_REPO_DIR="gitrepos"

# Seeded site admin credentials for local quickstart runs.
ADMIN_LOGIN="octocat"
ADMIN_TOKEN="local-dev-token"

# ==============================================================================
# Local development auth toggles
# ==============================================================================

# Local development only. Production refuses ALLOW_ANY_TOKEN=true.
ALLOW_ANY_TOKEN="false"

# ==============================================================================
# Browser and CORS settings
# ==============================================================================

# Console frontend base URL used for browser redirects from Git repo URLs.
CONSOLE_BASE_URL="http://localhost:5173"

# Optional external console page used by OAuth device flow prompts. Leave empty
# to use the built-in /login/device fallback page.
OAUTH_DEVICE_VERIFICATION_URL=""

# Comma-separated explicit CORS origin allowlist. Leave empty to derive local
# origins from CONSOLE_BASE_URL.
CORS_ALLOWED_ORIGINS=""

# ==============================================================================
# Secret encryption
# ==============================================================================

# Base64-encoded 32-byte private key for GitHub Actions secret encryption.
# Leave empty for local single-node development; set the same value on every
# server instance in multi-node deployments.
SECRET_ENCRYPTION_KEY=""

# ==============================================================================
# Optional embedding search
# ==============================================================================

# Enables semantic/vector issue and pull-request search. When empty, storage and
# search still work with lexical-only matching.
EMBEDDING_API_KEY=""
EMBEDDING_BASE_URL="https://api.openai.com"
EMBEDDING_MODEL="text-embedding-3-small"

# Optional vector size override. Empty or 0 lets the provider/model decide.
EMBEDDING_DIMENSIONS=""

# Maximum concurrent background embedding requests.
EMBEDDING_CONCURRENCY="50"

# ==============================================================================
# Optional Auth0 human login
# ==============================================================================

AUTH0_ISSUER=""
AUTH0_CLIENT_ID=""
AUTH0_AUDIENCE=""

# Optional generic OIDC human login. When set, these enable the provider-neutral
# /api/v3/oidc/* endpoints. Existing Auth0-only deployments can continue using
# AUTH0_* without changing provider values for linked identities.
OIDC_PROVIDER=""
OIDC_ISSUER=""
OIDC_DISCOVERY_URL=""
OIDC_CLIENT_ID=""
OIDC_CLIENT_SECRET=""
OIDC_AUDIENCE=""
OIDC_SCOPES="openid profile email"
OIDC_ALLOW_INSECURE_HTTP="false"

# Optional Login-with-Slock OAuth. When set, these enable /auth/slock/login and
# /auth/slock/callback. The Slock callback URL is BASE_URL + /auth/slock/callback.
SLOCK_ORIGIN=""
SLOCK_API_ORIGIN=""
SLOCK_CLIENT_ID=""
SLOCK_CLIENT_SECRET=""

# ==============================================================================
# Optional workflow execution sandbox
# ==============================================================================

# Disabled by default. When false, workflow execution fails closed.
ENABLE_WORKFLOW_EXEC="false"
WORKFLOW_EXEC_IMAGE="bash:5.2"
WORKFLOW_EXEC_TIMEOUT="2m"
WORKFLOW_EXEC_CPUS="1.0"
WORKFLOW_EXEC_MEMORY="256m"
WORKFLOW_EXEC_PIDS_LIMIT="128"
WORKFLOW_EXEC_NOFILE="1024"
WORKFLOW_EXEC_TMPFS_SIZE="64m"

# ==============================================================================
# Optional Git HTTP push handling
# ==============================================================================

# Maximum bytes accepted for one chunked git push request. Default is 2 GiB.
GITHTTP_MAX_PUSH_BYTES=""

# Directory for temporary spooled chunked push bodies. Empty uses the system
# temp directory.
GITHTTP_SPOOL_DIR=""

# ==============================================================================
# Optional logging
# ==============================================================================

# LOG_FORMAT defaults to json in production and text otherwise. Valid values:
# text, json.
LOG_FORMAT=""

# Valid values: debug, info, warn, error. Empty defaults to info.
LOG_LEVEL=""

# Force source locations in logs. Empty enables source in non-production only.
LOG_ADD_SOURCE=""