-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy path.env.example
More file actions
151 lines (124 loc) · 7.02 KB
/
Copy path.env.example
File metadata and controls
151 lines (124 loc) · 7.02 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
# =============================================================================
# Hephaestus self-hosted — environment
# =============================================================================
#
# ./setup.sh # generate internal secrets, then fill in external values
# docker compose up -d
#
# Full guide (read it first): https://ls1intum.github.io/Hephaestus/admin/install
#
# Hardware honesty: 4 vCPUs / 8 GB RAM / 40 GB SSD recommended. The stack runs
# two JVM services plus Postgres and NATS; 4 GB RAM is the absolute floor and
# only without AI practice review. Each concurrent AI review sandbox may use
# up to 4 GiB on top.
# =============================================================================
# --- General (REQUIRED) ------------------------------------------------------
# Public hostname the instance is served on (DNS A record -> this host).
# No scheme, no trailing slash. Example: hephaestus.example.com
APP_HOSTNAME=
# Release to run: an exact version, no leading `v`, never `latest`.
# Must match the release you checked out. See the install guide.
IMAGE_TAG=0.74.0
# Email for Let's Encrypt certificate-expiry notices.
ACME_EMAIL=
# --- Secrets (REQUIRED — generate once, then never change) -------------------
# Database password. Applied only when the data volume is first initialized.
POSTGRES_PASSWORD=
# AES-256 key encrypting credentials at rest (and sealing the JWT signing key).
# EXACTLY 32 printable, non-space ASCII characters. Losing or changing it makes every stored provider
# token unreadable — treat it like the database itself and back it up.
HEPHAESTUS_SECURITY_ENCRYPTION_KEY=
# Base64-encoded 32-byte AES key sealing the short-lived OAuth state cookies.
HEPHAESTUS_AUTH_STATE_COOKIE_KEY=
# Shared secret verifying inbound GitHub/GitLab webhooks (min 32 chars).
# You will enter this same value on the GitHub side — see the install guide.
WEBHOOK_SECRET=
# --- Login (at least one provider REQUIRED, or nobody can sign in) -----------
# GitHub OAuth App (https://github.com/settings/developers -> "New OAuth App").
# Authorization callback URL: https://<APP_HOSTNAME>/api/login/oauth2/code/github
# Named GH_OAUTH_* (not GITHUB_OAUTH_*) because GitHub Actions reserves the
# GITHUB_ prefix; the container still presents the right name to the server.
GH_OAUTH_CLIENT_ID=
GH_OAUTH_CLIENT_SECRET=
# GitLab OAuth application (optional; gitlab.com or self-hosted; scope: read_user).
# Callback: https://<APP_HOSTNAME>/api/login/oauth2/code/gitlab
#GITLAB_OAUTH_CLIENT_ID=
#GITLAB_OAUTH_CLIENT_SECRET=
#GITLAB_OAUTH_BASE_URL=https://gitlab.com
#GITLAB_OAUTH_DISPLAY_NAME=GitLab
# --- First admin (REQUIRED — set BEFORE first boot) ---------------------------
# Who becomes instance admin on their first sign-in. Comma-separated
# <provider>:@<username> or <provider>:<numeric-id>, e.g. github:@octocat
# On public github.com prefer the numeric id (from
# https://api.github.com/users/<login>) — handles can be reclaimed.
HEPHAESTUS_AUTH_BOOTSTRAP_ADMINS=
# Break-glass fallback: enables one-time POST /auth/bootstrap-admin while no
# admin exists. Leave unset unless you need it; unset again after use.
#HEPHAESTUS_AUTH_BOOTSTRAP_TOKEN=
# --- GitHub App (optional — PAT-only mode works without any of these) --------
# Needed for posting AI review feedback back to GitHub and higher rate limits.
# Setup guide: https://ls1intum.github.io/Hephaestus/admin/github-integration
GH_APP_PRIVATE_KEY=
#GH_APP_ID=
#GH_APP_INSTALLATION_URL=
# Legacy GitHub token used for contributor metadata only. Leave blank.
GH_AUTH_TOKEN=
# --- Optional integrations ----------------------------------------------------
# GitLab sync, Slack, Outline, AI practice review: enable by uncommenting here.
# See https://ls1intum.github.io/Hephaestus/admin/production-setup for each bundle.
#GITLAB_ENABLED=false
#GITLAB_WORKSPACE_CREATION=false
# Default GitLab instance for sync + workspace creation (compose otherwise defaults
# this to the maintainers' gitlab.lrz.de). Point it at your instance.
#GITLAB_DEFAULT_SERVER_URL=https://gitlab.com
#HEPHAESTUS_INTEGRATION_SLACK_ENABLED=false
#HEPHAESTUS_INTEGRATION_SLACK_CLIENT_ID=
#HEPHAESTUS_INTEGRATION_SLACK_CLIENT_SECRET=
#HEPHAESTUS_INTEGRATION_SLACK_SIGNING_SECRET=
#HEPHAESTUS_INTEGRATION_OUTLINE_ENABLED=false
#HEPHAESTUS_INTEGRATION_OUTLINE_ALLOWED_ORIGINS=
# AI practice review bundle (enable all three together), plus a provider registered under
# Instance admin → AI models (or a workspace's own "bring your own AI provider") in the UI.
# Budget ~4 GiB RAM per sandbox. The agent job queue runs on PostgreSQL — NATS (below) is only
# needed for webhook/sync ingest, not for practice review.
#AGENT_ENABLED=false
#HEPHAESTUS_FABRIC_GC_RETENTION_DAYS=30
#GIT_CHECKOUT_ENABLED=false
# Supplementary group the app joins so the agent sandbox can reach the Docker socket. The image runs
# unprivileged and the socket is root:docker 0660, so a wrong value fails every sandbox start with
# "permission denied" — at first review, not at boot. Read your host's id with
# `getent group docker | cut -d: -f3`; the 999 default is right on many Debian hosts and wrong on others.
#DOCKER_GROUP_ID=999
#PRACTICE_REVIEW_FOR_ALL=false
#SANDBOX_MAX_CONCURRENT=1
# --- Misc (optional) -----------------------------------------------------------
# Imprint/privacy pages (required for public instances in e.g. Germany):
# see https://ls1intum.github.io/Hephaestus/admin/legal-pages
#LEGAL_PROFILE=
# Sentry error tracking. Leave blank to disable.
SENTRY_DSN=
SENTRY_ENVIRONMENT=production
# PostHog product analytics — disabled unless POSTHOG_ENABLED=true; the keys below
# do nothing on their own. Leave the two keys present (blank is fine) either way.
#POSTHOG_ENABLED=false
POSTHOG_PROJECT_API_KEY=
POSTHOG_API_HOST=
# Container memory limits for the two JVMs. Each sizes its heap from its own limit, so lowering a
# limit lowers the heap with it. Lower both before the first start on a host below 8 GB RAM.
#APPLICATION_SERVER_MEM_LIMIT=5g
#WEBHOOK_SERVER_MEM_LIMIT=2g
# NATS JetStream limits, sized for a single host. NATS_JS_MAX_FILE_BYTES is what the broker may hold
# for all webhook streams together, in bytes, and the receiver refuses to start if the per-stream
# bounds sum above it. Keep it below the free space on the nats-data volume.
# https://ls1intum.github.io/Hephaestus/admin/webhook-ingestion-operations
NATS_JS_MAX_MEM=1G
NATS_JS_MAX_FILE_BYTES=10737418240
# Per-stream disk ceilings, sized down from the reference deployment's 1 GiB and 10 GiB. github
# carries essentially all of the traffic, so it is the only one that needs its own number. The four
# together must stay under NATS_JS_MAX_FILE_BYTES or the receiver refuses to start; at these values
# they come to 7.5 GiB of the 10 GiB above, leaving the rest for JetStream's own bookkeeping.
HEPHAESTUS_WEBHOOK_STREAM_MAX_BYTES=512MB
HEPHAESTUS_WEBHOOK_STREAM_MAX_BYTES_GITHUB=6GB
# Proxy-trust regex; the default matches reverse-proxy's fixed IP (172.29.47.2).
# Only set when you changed that IP or the subnet in compose.single-host.yaml.
#HEPHAESTUS_TRUSTED_PROXIES=172\.29\.47\.2