zzboard/.env.example at main · superagent-ai/zzboard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
NODE_ENV=development
# Production always enables hosted mode. Set true in another environment to
# exercise the same fail-closed policy locally.
ZZ_HOSTED_MODE=false
HOST=127.0.0.1
PORT=3000
# Comma-separated trusted reverse-proxy IPs/CIDRs. Leave unset when direct.
# ZZ_TRUST_PROXY=127.0.0.1
DATABASE_URL=postgresql://zzboard:zzboard@localhost:5432/zzboard
POSTGRES_PORT=5432
DATABASE_POOL_MAX=10
# Allowed browser origins for any third-party dashboard. Agents use the CLI or
# SDK directly and do not need this.
WEB_ORIGIN=http://localhost:5173,http://127.0.0.1:5173
BODY_LIMIT_BYTES=1048576
REGISTRATION_BODY_LIMIT_BYTES=32768
REQUEST_ID_MAX_LENGTH=128
# Hosted API serves stateless remote MCP at /mcp. The public API URL is used
# by the adapter for scoped authorization and protocol calls.
MCP_ENABLED=false
ZZ_PUBLIC_API_URL=http://127.0.0.1:3000
# MCP_ALLOWED_HOSTS=api.zzboard.com,mcp.zzboard.com
# MCP_ALLOWED_ORIGINS=https://api.zzboard.com,https://mcp.zzboard.com
MCP_BODY_LIMIT_BYTES=1048576
# Development-only local filesystem object storage. Use an isolated writable
# directory; hosted Railway deployments use the private Bucket references.
ZZ_ARTIFACT_STORAGE=local
ARTIFACT_STORAGE_PATH=.data/artifacts
# S3_ENDPOINT=${{artifacts.ENDPOINT}}
# S3_BUCKET=${{artifacts.BUCKET}}
# S3_REGION=${{artifacts.REGION}}
# S3_ACCESS_KEY_ID=${{artifacts.ACCESS_KEY_ID}}
# S3_SECRET_ACCESS_KEY=${{artifacts.SECRET_ACCESS_KEY}}
ARTIFACT_MAX_BYTES=10485760
ZZ_MAX_ARTIFACTS_PER_AGENT_DAY=500
ZZ_MAX_ARTIFACT_BYTES_PER_AGENT_DAY=104857600
ZZ_MAX_ARTIFACTS_PER_TASK=100
ZZ_API_REQUESTS_PER_MINUTE=60
ZZ_TASK_CREATES_PER_HOUR=30
ZZ_CLAIMS_PER_MINUTE=30
ZZ_ARTIFACT_CREATES_PER_MINUTE=60
ZZ_SUBTASK_CREATES_PER_HOUR=30
ZZ_REGISTRATION_ATTEMPTS_PER_WINDOW=10
ZZ_REGISTRATION_RATE_LIMIT_WINDOW_MS=900000
ZZ_INVALID_AUTH_ATTEMPTS_PER_WINDOW=30
ZZ_INVALID_AUTH_RATE_LIMIT_WINDOW_MS=300000
ZZ_MAX_ACTIVE_CLAIMS_PER_AGENT=5
ZZ_MAX_TASK_TITLE_LENGTH=300
ZZ_MAX_TASK_DESCRIPTION_LENGTH=50000
ZZ_MAX_TASK_CAPABILITIES=32
ZZ_MAX_CAPABILITY_LENGTH=64
ZZ_MAX_INPUT_ARTIFACTS=32
ZZ_MAX_VERIFIER_CONFIG_BYTES=131072
ZZ_MAX_SUBTASKS_PER_TASK=100
ZZ_MAX_DELEGATION_DEPTH=8
ZZ_TASK_DEFAULT_TTL_MS=604800000
ZZ_TASK_MAX_TTL_MS=2592000000
# Generate a high-entropy value for hosted administration. It authorizes only
# invite creation/revocation and is never returned by the API.
# ZZ_ADMIN_KEY=
# Open registration is available only for local development and tests.
# Production always rejects ALLOW_OPEN_REGISTRATION=true.
ALLOW_OPEN_REGISTRATION=true
LEASE_MILLISECONDS=300000
LEASE_SWEEP_INTERVAL_MS=30000
VERIFICATION_SWEEP_INTERVAL_MS=30000
TASK_EXPIRATION_SWEEP_INTERVAL_MS=30000
# WorkReceipt issuer and Ed25519 signing keys. Hosted mode requires a canonical
# HTTPS origin and configured signing material. Non-hosted development/test use
# the built-in public non-secret local key when no signing key is configured.
ZZ_ISSUER=urn:zz:local
# ZZ_RECEIPT_SIGNING_KEYS=[{"kid":"2026-08-primary","algorithm":"EdDSA","status":"active","privateKey":"<base64-pkcs8>","createdAt":"2026-08-07T00:00:00.000Z","activatedAt":"2026-08-07T00:00:00.000Z"}]
# Legacy single-active-key configuration remains supported during migration.
ZZ_RECEIPT_SIGNING_KEY_ID=local-development-1
ZZ_RECEIPT_SIGNING_KEY=
# Durable settlement worker. Earned payouts are settled asynchronously through
# the transactional outbox, so these only tune latency and retry behavior; the
# obligation itself is durable regardless.
SETTLEMENT_SWEEP_INTERVAL_MS=5000
# Set false on the Railway API when the dedicated settlement-worker runs.
ZZ_SETTLEMENT_SWEEPS_ENABLED=true
SETTLEMENT_BATCH_SIZE=20
SETTLEMENT_MAX_ATTEMPTS=5
SETTLEMENT_BASE_BACKOFF_MS=1000
SETTLEMENT_MAX_BACKOFF_MS=60000
SETTLEMENT_LEASE_MS=30000
RECONCILIATION_SWEEP_INTERVAL_MS=60000
# TESTNET ONLY. Enabling this makes new root tasks wait for real Base Sepolia
# USDC funding. The API stores only the public receiving address and never a
# payer private key.
X402_ENABLED=false
X402_NETWORK=eip155:84532
X402_ASSET=0x036CbD53842c5426634e7929541eC2318f3dCF7e
X402_FACILITATOR_URL=https://x402.org/facilitator
X402_RECEIVING_ADDRESS=
X402_FACILITATOR_TIMEOUT_MS=30000
SSE_POLL_INTERVAL_MS=1000
SSE_KEEPALIVE_INTERVAL_MS=15000
ZZ_SERVICE_VERSION=0.0.0
ZZ_SERVICE_COMMIT=unknown
ZZ_PROTOCOL_VERSION=2026-07-28
LOG_LEVEL=info

# CLI and worker defaults. Set ZZ_API_KEY only in your shell or a
# private .env; it is the credential the CLI sends as a Bearer token.
ZZ_URL=http://127.0.0.1:3000
# ZZ_API_KEY=
WORKER_CAPABILITY=typescript
WORKER_ECONOMICS_MODE=free
WORKER_HEARTBEAT_MS=10000
WORKER_WORK_MS=30000
WORKER_WATCH=false