Forge/.env.example at main · Codename-11/Forge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
# ---- Forge environment ----
# Copy to .env and fill in.

# Core
NODE_ENV=development
NEXT_PUBLIC_APP_URL=http://localhost:3000

# Database — Postgres
DATABASE_URL=postgresql://forge:forge@localhost:5432/forge?schema=public

# Redis (pub/sub, BullMQ, rate limiting)
REDIS_URL=redis://localhost:6379

# Auth — NextAuth v5
# AUTH_SECRET also keys the AES-256-GCM encryption of stored SSO client
# secrets (src/server/crypto.ts) — rotating it invalidates sessions and those
# secrets, so re-enter providers in Identity & sign-in after a rotation.
AUTH_SECRET=change-me-to-32-random-bytes
AUTH_URL=http://localhost:3000
# Environment-backed bootstrap/break-glass instance administrator. Normal
# local users have durable, individually hashed passwords in Postgres.
ADMIN_EMAIL=admin@example.local
ADMIN_PASSWORD=change-me-bootstrap-password
ADMIN_NAME=Forge Administrator
ADMIN_HANDLE=admin

# OAuth providers are now managed in the UI (Identity & sign-in),
# stored in the SsoProvider table. These env vars are OPTIONAL bootstrap
# only: if set and no matching DB row exists yet, a provider row is seeded
# from them on first boot. After that, manage everything in the UI.
AUTH_GITHUB_ID=
AUTH_GITHUB_SECRET=
AUTH_GOOGLE_ID=
AUTH_GOOGLE_SECRET=

# Outbound account setup, password reset, password-change, and workspace
# invitation mail. EMAIL_SERVER is the compact SMTP URL form;
# alternatively set SMTP_HOST/SMTP_PORT/SMTP_SECURE/SMTP_USER/SMTP_PASSWORD,
# or use RESEND_API_KEY. Production invite attempts fail closed when no
# account-email attempt fails closed when no transport is configured.
EMAIL_SERVER=smtp://user:pass@smtp.example.com:587
EMAIL_FROM="Forge <noreply@forge.local>"
SMTP_HOST=
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=
SMTP_PASSWORD=
RESEND_API_KEY=

# Plugin / agent authentication
PLUGIN_JWT_ISSUER=forge
PLUGIN_JWT_AUDIENCE=forge-plugins
PLUGIN_JWT_SECRET=change-me-plugin-signing-key

# MCP — Model Context Protocol endpoint auth
MCP_PUBLIC_BASE=http://localhost:3000/api/mcp

# Observability
SENTRY_DSN=
LOG_LEVEL=info

# Feature flags
FEATURE_PLUGINS=true
FEATURE_REALTIME=true

# Optional transitional artifact renderer. Forge owns artifacts, revisions,
# review, comments, and sharing; Artifact Preview receives pinned render bundles.
# Enable it per workspace under Settings → Artifacts after configuring both.
ARTIFACT_PREVIEW_URL=http://localhost:8765
ARTIFACT_PREVIEW_TOKEN=

# ---- AI features (optional) ----
# Forge-internal AI: triage on issue create + Coach diagnostic comments
# on stalls / no-acks / SLA breaches. Per-workspace toggles live in
# /settings/workspace. Provider is per-workspace too — default `hermes`.
#
# Provider env vars (only the active provider's vars need to be set):
#
#   hermes (default)  HERMES_GATEWAY_URL (default http://127.0.0.1:8642/v1)
#                     HERMES_GATEWAY_TOKEN
#   openai            OPENAI_API_KEY  (+ optional OPENAI_BASE_URL for
#                                       OpenRouter / vLLM / etc.)
#   anthropic         ANTHROPIC_API_KEY
#   custom            FORGE_AI_BASE_URL + FORGE_AI_API_KEY
#
# Hermes is preferred — it routes via the model-router plugin so you
# don't have to manage upstream provider keys here.
HERMES_GATEWAY_URL=http://127.0.0.1:8642/v1
HERMES_GATEWAY_TOKEN=
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
FORGE_AI_BASE_URL=
FORGE_AI_API_KEY=

# ---- Object storage (S3 / MinIO) ----
# Forge stores attachments in an S3-compatible bucket per workspace. Global
# user avatars use S3_GLOBAL_BUCKET (default forge-global) with the same S3
# endpoint and credentials, keeping account media outside tenant buckets.
# In dev we run MinIO via docker/docker-compose.yml:
#
#   docker compose -f docker/docker-compose.yml up -d minio
#
# Then open the web console at http://localhost:59001 and log in with
# the MINIO_ROOT_USER / MINIO_ROOT_PASSWORD baked into compose
# (forgeminio / forgeminio-dev-password). Buckets are created lazily
# by the app on first attachment upload — no manual setup needed.
#
# MinIO uses its root credentials as the S3 access key / secret, so the
# values below MUST match docker-compose.yml's MINIO_ROOT_USER /
# MINIO_ROOT_PASSWORD.
S3_ENDPOINT=http://localhost:59000
S3_ACCESS_KEY=forgeminio
S3_SECRET_KEY=forgeminio-dev-password
S3_REGION=us-east-1
S3_FORCE_PATH_STYLE=true
S3_GLOBAL_BUCKET=forge-global