LabSafe/.env.example at main · SayQuan1/LabSafe · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
APP_ENV=dev
API_HOST=127.0.0.1
API_PORT=8000
AI_INFERENCE_HOST=127.0.0.1
AI_INFERENCE_PORT=8001
AI_INFERENCE_URL=http://127.0.0.1:8001
REDIS_URL=redis://localhost:6379/0
# Development validate_image dispatch and opt-in general consumer (separate processes).
WORKER_DISPATCH_ENABLED=0
WORKER_IMAGE_VALIDATION_ENABLED=0
WORKER_INFERENCE_ENABLED=0
WORKER_RULE_EVALUATION_ENABLED=0
# CSV report publisher/consumer opt-in; reports use q.reports independently of q.general.
WORKER_REPORT_EXPORT_ENABLED=0
# Identity, foundation and image-job query APIs are opt-in; use this exact HTTPS origin.
API_IDENTITY_ENABLED=0
PUBLIC_ORIGIN=https://labsafe.example.org
CSRF_KEY_FILE=.local-secrets/csrf-key
DATABASE_URL_FILE=.local-secrets/database-url
DATABASE_SCHEMA=labsafe_dev_local

# Dev/test upload grants, validation acceptance, image metadata and download signing. Requires a private,
# versioned bucket, least-privilege API credentials and same-origin HTTPS:443.
# New manual image-job replay also requires this API storage configuration.
# Image downloads use the same API credentials with O/A GetObjectVersion permission.
API_UPLOADS_ENABLED=0
S3_ENDPOINT=http://127.0.0.1:9000
S3_PUBLIC_ENDPOINT=https://labsafe.example.org
S3_BUCKET=labsafe-private
S3_REGION=us-east-1
S3_ACCESS_KEY_FILE=.local-secrets/s3-api-access-key
S3_SECRET_KEY_FILE=.local-secrets/s3-api-secret-key
# General Worker credentials: staging GET/version; original/analysis GET/version + PUT.
# CSV reports also need HEAD/GET/version + PUT on authorized reports (R) paths.
# No Delete, ListBucket or administration; never fall back to API credentials.
S3_WORKER_ACCESS_KEY_FILE=.local-secrets/s3-worker-access-key
S3_WORKER_SECRET_KEY_FILE=.local-secrets/s3-worker-secret-key

AI_MODE=mock
AI_TOKEN_FILE=.local-secrets/ai-token
AI_ALLOWED_TENANTS=11111111-1111-4111-8111-111111111111
# AI_MODE=cpu enables the resident development CPU HTTP service after pinned load/smoke.
# Generate these local files with tools.ml.create_cpu_bundle in the isolated AI environment.
# Absolute paths and explicit artifact roots (Windows semicolon; Unix colon) are required.
AI_CPU_BUNDLE_FILE=
AI_CPU_BUNDLE_SHA256=
AI_ARTIFACT_ROOTS=
# Worker pin contains only Version metadata; never pass model paths/credentials to requests.
AI_EXPECTED_VERSION_FILE=
# AI reads analysis versions only.
# Fixed labsafe-private bucket/us-east-1; explicit endpoint allowlist, no AWS provider chain.
# Plain HTTP is restricted to loopback; deployed stores require verified HTTPS.
AI_S3_ENDPOINT=http://127.0.0.1:9000
AI_S3_ALLOWED_ENDPOINTS=http://127.0.0.1:9000
AI_S3_ACCESS_KEY_FILE=.local-secrets/s3-ai-read-access-key
AI_S3_SECRET_KEY_FILE=.local-secrets/s3-ai-read-secret-key
# Grant only s3:GetObjectVersion on allowed tenant/lab analysis PNGs. No PUT/List/Delete.
AI_MAX_INFLIGHT=1
AI_FIXTURE_SCENARIO=no_targets
AI_FIXTURE_DELAY_MS=0
# Independent CPU image/S3 Worker process; ORM and ONNX environments stay separate.
WORKER_EVIDENCE_PYTHON=.venv-evidence/Scripts/python.exe
SERVICE_COMMIT=local-development
VITE_APP_ENV=dev