BioModStack/.env.core-runtime.example at main · MolBioFreak/BioModStack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# Copy to .env.core-runtime.local or export these before running the core runtime.
# Required host path for persistent BioModStack state. The core runtime fails
# closed when this is absent; it does not infer a state root.
BMS_STATE_DIR=/mnt/BioModStack

# Default container-side mount path for persisted state.
# If Nextflow path coupling still expects /mnt/BioModStack, set this to /mnt/BioModStack.
BMS_CONTAINER_STATE_PATH=/var/lib/biomodstack

# Optional explicit overrides inside the API container.
BMS_INPUTS_CONTAINER_PATH=/var/lib/biomodstack/inputs
BMS_DB_CONTAINER_PATH=/var/lib/biomodstack/biomodstack.db
BMS_RESULTS_CONTAINER_PATH=/var/lib/biomodstack/bms_results

# Container-side workflow work root. Host-native workflow launches use the
# generated install profile path, e.g. /mnt/BioModStack/work on this machine.
BMS_WORK=/var/lib/biomodstack/work

# Stable hosted web UI port. Development Vite owns 18082; production /bms/ stays here.
BMS_WEB_HOST_PORT=18080

# Optional CM principal, ownership, and capability boundary. It is retained for
# possible future shared or remote use and is disabled by default. Set this to 1
# only when the selected ingress provides the complete authenticated path.
BMS_CM_AUTHORIZATION_ENABLED=0
# When authorization is enabled, use a random value available only to the API,
# bms-web, and reviewed Tailnet nginx containers. Never expose it to browser
# JavaScript. This boundary intentionally uses one application principal.
BMS_CM_TRUSTED_PROXY_SECRET=
# Comma-separated browser origins and matching nginx host regex. Keep these
# server-owned; add an external reverse-proxy/Tailscale hostname explicitly.
BMS_CM_ALLOWED_ORIGINS=http://127.0.0.1:18080,http://localhost:18080
BMS_CM_ALLOWED_HOST_PATTERN=127\.0\.0\.1|localhost

# Frontend/API cross-origin defaults for localhost and Cordova shells.
# Add any remote wrapper origin explicitly via CORS_ORIGINS when needed.
CORS_ORIGINS=http://127.0.0.1,http://127.0.0.1:18082,http://127.0.0.1:18080,http://localhost,https://localhost,http://localhost:18082,http://localhost:18080,https://localhost:18082,https://127.0.0.1

# Enable the honest first-wave guard: containerized core runtime should not own workflow launches yet.
BMS_CORE_RUNTIME_MODE=1

# Host-networked core-runtime containers reach the host-native Production workflow adapter on localhost:18101.
BMS_WORKFLOW_ADAPTER_LANE=production
BMS_WORKFLOW_ADAPTER_URL=http://127.0.0.1:18101

BMS_HOST_AGENT_URL=http://127.0.0.1:18798
BMS_HOST_AGENT_TIMEOUT_SECONDS=2.0

# ONT raw-signal runtime. Build the pinned image with
# scripts/build_ont_raw_signal_runtime.sh and copy its emitted image ID and
# digest here. Validation and waveform lookup require the image. Whole-run
# POD5-to-BLOW5 conversion remains disabled until fidelity and host-capacity
# acceptance is complete.
BMS_ONT_CONTAINER_RUNTIME=docker
BMS_ONT_SLOW5TOOLS_IMAGE=
BMS_ONT_SLOW5TOOLS_IMAGE_DIGEST=
BMS_ONT_RAW_SIGNAL_STAGING_ROOT=/var/lib/biomodstack/ont-raw-signal-staging
BMS_ONT_RAW_SIGNAL_MIN_FREE_BYTES=21474836480
BMS_ONT_RAW_SIGNAL_ACQUISITION_PRESSURE=unknown

# Mk1D reconnect is a root-installed, fixed recovery transaction. The normal
# launcher reads BMS_MK1D_RECOVERY_GID only from root-owned
# /etc/biomodstack/mk1d-reconnect.env after validating it; do not set that GID
# here. This host path is mounted read-only into bms-api for the fixed socket.
BMS_MK1D_RECOVERY_SOCKET_DIR=/run/biomodstack
BMS_MK1D_RECONNECT_SOCKET=/run/biomodstack/mk1d-reconnect.sock
BMS_MK1D_RECONNECT_TIMEOUT_SECONDS=100
# Required only for the local BMS-host Mk1D reconnect action. Generate a random
# server-only value and provide it to bms-api and bms-web only. Do not place it
# in Tailnet configuration, policy, browser code, or a forwarded request.
BMS_MK1D_RECONNECT_LOCAL_PROXY_SECRET=

# Authoritative annotation-source retrieval. Addgene requires a developer token
# scoped catalog:retrieve-with-sequences; never expose it to frontend code.
ADDGENE_API_TOKEN=
# Optional NCBI E-utilities identity/rate-limit configuration. Public accession
# retrieval works without these values at the lower unauthenticated rate limit.
NCBI_API_KEY=
NCBI_EMAIL=

# Server-owned Boltz API credentials and deterministic result retrieval. The
# CLI and download paths are inside the state bind mount; never expose the key
# to frontend code or persist it in Job/Design metadata.
BOLTZ_API_KEY=
BMS_BOLTZ_API_CLI=/var/lib/biomodstack/tools/boltz-api
BMS_BOLTZ_API_HOME=/var/lib/biomodstack/secrets/boltz-api-home
BMS_BOLTZ_DOWNLOAD_ROOT=/var/lib/biomodstack/boltz_results

# Compact BioXP control plane. A target profile is saved explicitly through
# /api/bioxp/profile or the feature-gated top-bar menu; startup never auto-connects.
BMS_FEATURE_BIOXP=1
BMS_BIOXP_MUTATIONS_ENABLED=0
BMS_BIOXP_ALLOWED_HOSTS=robot
# Required before connection: set only the deployed robot's trusted network(s).
BMS_BIOXP_ALLOWED_CIDRS=

# Optional compose project override for host-side operator scripts. The API
# container should use Host Agent lifecycle controls instead of a Docker socket.
COMPOSE_PROJECT_NAME=biomodstack-core-runtime
BMS_DOCKER_COMPOSE_PROJECT=biomodstack-core-runtime