-
-
Notifications
You must be signed in to change notification settings - Fork 135
Expand file tree
/
Copy path.env.example
More file actions
161 lines (136 loc) · 6.63 KB
/
Copy path.env.example
File metadata and controls
161 lines (136 loc) · 6.63 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
# ============================================
# ServerKit Configuration
# ============================================
# Copy this file to .env and customize for your environment
# Generate secure keys with: python -c "import secrets; print(secrets.token_hex(32))"
# ============================================
# ----------------------------------------
# REQUIRED: Security Keys
# ----------------------------------------
# Generate unique keys for production!
SECRET_KEY=your-secret-key-here
JWT_SECRET_KEY=your-jwt-secret-key-here
# Fernet key for encrypting secrets at rest.
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
SERVERKIT_ENCRYPTION_KEY=your-fernet-key-here
# ----------------------------------------
# Database Configuration
# ----------------------------------------
# SQLite (default - good for small deployments).
# NOTE the path is relative to the backend working directory.
# DATABASE_URL=sqlite:///serverkit.db
# PostgreSQL (recommended for production):
# DATABASE_URL=postgresql://user:password@localhost:5432/serverkit
# MySQL:
# DATABASE_URL=mysql://user:password@localhost:3306/serverkit
# ── Under Docker, use SERVERKIT_DATABASE_URL instead ──
# docker-compose.yml pins DATABASE_URL to /app/instance/serverkit.db, the path
# backed by the persistent volume, and ignores the DATABASE_URL above. That is
# on purpose: a *relative* sqlite path resolves inside the container and is
# destroyed by the next `compose down`. To point Docker at another database,
# set this instead — it wins:
# SERVERKIT_DATABASE_URL=postgresql://user:password@db:5432/serverkit
# ----------------------------------------
# Network Configuration
# ----------------------------------------
# CORS Origins - your domain(s), comma-separated
CORS_ORIGINS=http://localhost,https://your-domain.com
# Public URL that agents should dial back to. Set this whenever the panel
# sits behind a reverse proxy / tunnel / custom domain — the connection
# string the panel issues to agents will embed this URL instead of the
# request's Host header (which would otherwise be the internal IP/port).
# Leave commented out for plain localhost development.
# SERVERKIT_PUBLIC_URL=https://panel.your-domain.com
# Port. Only the Flask *development* server reads this (`python run.py`).
# Under Docker the container always listens on 5000 and you publish it with
# SERVERKIT_HTTP_PORT (see docker-compose.yml); under gunicorn the port comes
# from SERVERKIT_BACKEND_PORT.
# PORT=5000
# ----------------------------------------
# Trusted reverse proxy (client IP)
# ----------------------------------------
# Derive the real client IP from X-Forwarded-For (via Werkzeug ProxyFix) for
# rate limiting, login lockout and audit logs, instead of logging every request
# as the proxy's address.
#
# Turn it on ONLY when a proxy you control is the sole route in. The header is
# whatever the caller typed, so if anything can open a connection to the backend
# port directly, this hands attackers the ability to forge the IP that those
# very throttles key on.
#
# Off by default HERE because this file is the Docker/manual path, and
# docker-compose.yml publishes port 5000 on all interfaces. Set it to true once
# you put a proxy in front AND stop direct access to 5000 — bind it to loopback
# (see docs/INSTALLATION.md → "Running behind your own reverse proxy") or
# firewall it.
#
# Host installs do not use this file: install.sh writes its own .env and enables
# this automatically, because there gunicorn binds loopback behind our nginx.
#
# TRUSTED_PROXY_HOPS = proxies in front of Flask. Your proxy alone = 1; your
# proxy plus ServerKit's nginx = 2; add Cloudflare on top and it goes up again.
TRUST_PROXY_HEADERS=false
TRUSTED_PROXY_HOPS=1
# ----------------------------------------
# Login brute-force throttle (per client IP)
# ----------------------------------------
# On top of the per-user account lockout, block a client IP after too many
# failed logins (defends against password-spraying across many usernames).
# Defaults shown; override only if you need to tune them.
# AUTH_IP_MAX_ATTEMPTS=10
# AUTH_IP_WINDOW_MINUTES=15
# AUTH_IP_BLOCK_MINUTES=15
# ----------------------------------------
# Rate-limit storage backend
# ----------------------------------------
# Default is in-memory, which matches the deliberate single-worker gunicorn
# design (see docs/ARCHITECTURE.md). Point at Redis to share limit state
# across processes and silence flask-limiter's in-memory production warning.
# RATELIMIT_STORAGE_URI=redis://localhost:6379/0
# ----------------------------------------
# Environment
# ----------------------------------------
# Options: development, production
FLASK_ENV=production
# ----------------------------------------
# GitHub Repository (for agent downloads)
# ----------------------------------------
# This is used to fetch agent releases for the downloads page
SERVERKIT_GITHUB_REPO=jhd3197/ServerKit
# ----------------------------------------
# Theme Registry
# ----------------------------------------
# Curated theme index for the Browse gallery. Unset = the public registry
# (https://serverkit.ai/themes/index.json); set-but-empty = disabled (bundled
# themes only).
# SERVERKIT_THEMES_REGISTRY_URL=https://serverkit.ai/themes/index.json
# Seconds to cache the registry index before re-fetching (default 3600).
# SERVERKIT_THEMES_REGISTRY_TTL=3600
# ----------------------------------------
# Optional: Notification Webhooks
# ----------------------------------------
# These can also be configured via the web UI at Settings > Notifications
# Discord Webhook URL
# DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...
# Slack Webhook URL
# SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...
# Telegram Bot
# TELEGRAM_BOT_TOKEN=your-bot-token
# TELEGRAM_CHAT_ID=your-chat-id
# ----------------------------------------
# Security opt-ins & special modes
# ----------------------------------------
# Allow installed extensions to pip-install the Python requirements they ship.
# Off by default: pip runs with the backend's privileges.
# SERVERKIT_ALLOW_PLUGIN_PIP=false
# Allow extension downloads from non-HTTPS / private-network URLs.
# SERVERKIT_ALLOW_PRIVATE_DOWNLOADS=false
# Read-only demo panel (mutating API calls are refused).
# SERVERKIT_DEMO_MODE=false
# Stream simulated deploys through the real deploy pipeline (no Docker needed).
# SERVERKIT_DEMO_DEPLOYS=false
# Mark this panel as a staging install (reported by /health).
# SERVERKIT_STAGING=false
# Add request duration, SQL duration and statement count to Server-Timing.
# Temporary local/staging diagnosis; disabled by default. No SQL text is emitted.
# SERVERKIT_PROFILE_REQUESTS=false