106 lines
6.0 KiB
Bash
106 lines
6.0 KiB
Bash
RAGCORE_ENV=development
|
|
RAGCORE_LOG_LEVEL=INFO
|
|
RAGCORE_SECRET_KEY=replace-with-at-least-32-random-characters
|
|
RAGCORE_DATABASE_URL=postgresql+psycopg://ragcore:ragcore@postgres:5432/ragcore
|
|
RAGCORE_QDRANT_URL=http://qdrant:6333
|
|
RAGCORE_QDRANT_API_KEY=replace-with-at-least-32-random-characters
|
|
# For a disposable acceptance stack set RAGCORE_ENV=rc. RC applies the same
|
|
# strong-secret, HTTPS, proxy and absolute-storage checks as production.
|
|
# Configure only the SHA-256 digest; the cutover CLI prompts operators for the
|
|
# separate high-entropy token without echoing it or putting it in argv.
|
|
# Bind it to one configured operator UUID so the evidence actor cannot be
|
|
# self-asserted independently of the credential.
|
|
# RAGCORE_EMBEDDING_CUTOVER_OPERATOR_ID=<operator-uuid>
|
|
# RAGCORE_EMBEDDING_CUTOVER_OPERATOR_TOKEN_SHA256=<lowercase-sha256>
|
|
RAGCORE_OLLAMA_URL=http://ollama:11434
|
|
# M6 operator-only shadow migration. The file is mounted read-only into the app
|
|
# container; never put the credential value in this env file.
|
|
RAGCORE_MODELFORGE_BASE_URL=http://modelforge:8000
|
|
RAGCORE_MODELFORGE_CREDENTIAL_FILE=/run/secrets/ragcore/modelforge_embedding_credential
|
|
RAGCORE_MODELFORGE_EMBEDDING_CAPABILITY=rag.embedding@1
|
|
# Optional initial selection route for a ModelForge profile.
|
|
# The active route is persisted with its profile and Qdrant collection; changing
|
|
# this value after first selection bootstrap does not remap runtime traffic.
|
|
# RAGCORE_MODELFORGE_EMBEDDING_EXPERIMENT_ROUTE=rc-canary-2026-09
|
|
RAGCORE_MODELFORGE_SECRET_ROOT=./.state/secrets
|
|
RAGCORE_BLOB_ROOT=/var/lib/ragcore/blobs
|
|
RAGCORE_PARSED_ROOT=/var/lib/ragcore/parsed
|
|
RAGCORE_TEMP_ROOT=/var/lib/ragcore/tmp
|
|
# The explicit allowlist of server-side paths a Folder or Git source may read.
|
|
# Comma-separated absolute paths, as seen *inside the worker container*; every
|
|
# entry must also be mounted there (see compose.yaml's `worker` volumes).
|
|
#
|
|
# Empty means no filesystem-backed source can be created or synced at all.
|
|
# That is the deliberate default: without an allowlist, anyone who may create
|
|
# a source could point the worker at /etc, /app or a database volume. There is
|
|
# no implicit default root, least of all "/".
|
|
#
|
|
# Mount the content read-only and keep the allowlist as narrow as the corpus:
|
|
# RAGCORE_SOURCE_ROOTS=/mnt/rag-sources
|
|
#
|
|
# The read-only mount is a security invariant, not a suggestion: it is what
|
|
# makes the remaining window between path validation, stat and open harmless.
|
|
#
|
|
# This list is deployment-wide, with no per-workspace mapping, so a path inside
|
|
# it may well be another tenant's corpus. That is why only PLATFORM_ADMIN holds
|
|
# FILESYSTEM_SOURCE_MANAGE and may configure Folder / local-Git sources; see
|
|
# docs/07_SECURITY/SECURITY_CONTROLS.md, "Filesystem-backed sources".
|
|
RAGCORE_SOURCE_ROOTS=
|
|
# How many jobs one worker process handles at once. The queue hands each loop
|
|
# a different job (FOR UPDATE SKIP LOCKED), and the model-call budget still
|
|
# bounds what they can all do to Ollama, so raising this speeds up ingestion
|
|
# without stampeding the model server. Every loop holds one database
|
|
# connection while it works; the pool is sized from this number. Default 1.
|
|
RAGCORE_WORKER_CONCURRENCY=1
|
|
# How often the worker looks for sources whose sync interval has elapsed. This
|
|
# is the resolution of the schedule, not the schedule: each source syncs on its
|
|
# own interval, and a source without one (the default) never syncs on a timer.
|
|
RAGCORE_SYNC_SCHEDULER_INTERVAL_SECONDS=60
|
|
# Shared by app and worker so both see the same active embedding profile.
|
|
RAGCORE_MODEL_STATE_ROOT=/var/lib/ragcore/models
|
|
RAGCORE_PUBLIC_BASE_URL=http://localhost:8088
|
|
# Comma-separated direct proxy IPs/CIDRs allowed to set X-Forwarded-*.
|
|
# Required in production; wildcard, 0.0.0.0/0 and ::/0 are rejected.
|
|
# Prefer the proxy's static IP (documented example: 172.30.50.2). A CIDR trusts
|
|
# every address in it, including its Docker gateway, and is only safe when every
|
|
# possible peer in that range is an authorized reverse proxy.
|
|
RAGCORE_TRUSTED_PROXY_IPS=
|
|
RAGCORE_API_TOKEN_PEPPER=replace-with-independent-random-pepper
|
|
RAGCORE_OIDC_ISSUER=https://auth.example.test/application/o/ragcore/
|
|
RAGCORE_OIDC_CLIENT_ID=ragcore
|
|
RAGCORE_OIDC_CLIENT_SECRET=replace-with-at-least-32-random-characters
|
|
# JSON object mapping Authentik group names to RAGCore roles; unmapped groups
|
|
# grant nothing (deny-by-default). Example: {"ragcore-admins": "platform_admin"}
|
|
RAGCORE_OIDC_GROUP_ROLES={}
|
|
# Unset (commented out, not blank -- an empty value fails UUID parsing)
|
|
# means OIDC/SSO is disabled and /auth/* fails closed (503); RAGCore is
|
|
# single-workspace-per-deployment for OIDC in V1, so this must be the id of
|
|
# the one real workspace OIDC logins are scoped to.
|
|
# RAGCORE_OIDC_WORKSPACE_ID=00000000-0000-0000-0000-000000000000
|
|
# Optional first-boot-only bootstrap: registers and activates this embedding
|
|
# model if (and only if) no embedding profile is active yet -- never
|
|
# overwrites an existing one. Both must be set together; the model must
|
|
# already be pulled in the deployed Ollama instance (RAGCORE_OLLAMA_URL).
|
|
# RAGCORE_BOOTSTRAP_EMBEDDING_PROVIDER=ollama
|
|
# RAGCORE_BOOTSTRAP_EMBEDDING_MODEL=nomic-embed-text:1.5
|
|
# Optional: OpenTelemetry tracing/metrics export. The app and worker both
|
|
# start cleanly with this unset/false -- no collector is required. When
|
|
# enabled, both export OTLP/HTTP to <endpoint>/v1/traces and /v1/metrics.
|
|
# RAGCORE_OTEL_ENABLED=true
|
|
# RAGCORE_OTEL_EXPORTER_ENDPOINT=http://otel-collector:4318
|
|
POSTGRES_USER=ragcore
|
|
POSTGRES_PASSWORD=ragcore
|
|
POSTGRES_DB=ragcore
|
|
QDRANT_API_KEY=replace-me
|
|
RAGCORE_HOST_PORT=8088
|
|
# The read-only MCP adapter's own service (see compose.yaml's `mcp` service).
|
|
RAGCORE_MCP_HOST_PORT=8090
|
|
# Local host access for Alembic and integration tests; containers use postgres:5432.
|
|
RAGCORE_POSTGRES_HOST_PORT=15432
|
|
# Production: set these to direct SSD/NVMe pool paths, not /mnt/user.
|
|
RAGCORE_STATE_ROOT=./.state
|
|
# Host directory mounted read-only into the worker at /mnt/rag-sources,
|
|
# where RAGCORE_SOURCE_ROOTS then permits it. Mounting without allowlisting
|
|
# reads nothing; allowlisting without mounting fails to resolve.
|
|
RAGCORE_SOURCE_MOUNT=./.state/sources
|