efficientAI/env.example at main · EfficientAI-tech/efficientAI · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
# =============================================================================
# SELF-HOST ONBOARDING — what to set (config.yml + this file)
# =============================================================================
# Primary file: config.yml  (copy from config.yml.example or: eai init-config)
# Secrets / CI overrides:   .env  (copy this file to .env)
#
# --- REQUIRED in config.yml (every self-host) ---
# app.frontend_base_url     Public URL users open (https://evals.yourcompany.com).
#                           Drives invite links + trusted Host header (exact hostname only).
# database.url              PostgreSQL connection string.
# redis.url                 Redis for API + workers.
# celery.broker_url         Same Redis URL (or dedicated broker).
# celery.result_backend     Same Redis URL (or dedicated backend).
# cors.origins              Browser origins; include your frontend_base_url origin.
#
# --- REQUIRED for production (pick config.yml OR .env; env wins for SECRET_KEY) ---
# app.debug: false          config.yml
# app.secret_key             Long random string OR set SECRET_KEY below (32+ chars).
# FRONTEND_BASE_URL          Only if injecting via env instead of app.frontend_base_url.
# DEBUG=false                .env when not using config.yml debug flag.
# security: remove trusted_hosts localhost/127.0.0.1 — not for production.
# API on another hostname?   security.public_base_url: "https://api.yourcompany.com"
#                           (same allowlist as frontend_base_url; or use security.trusted_hosts)
#
# --- REQUIRED if you use blob storage (call-import artifacts, uploads, PDF history) ---
# storage.blob_provider      s3 | gcs | azure in config.yml
# s3.* / gcs.* / azure.*     Bucket + credentials in config.yml or cloud IAM.
# S3_ACCESS_KEY_ID           .env optional when using ${S3_ACCESS_KEY_ID} in YAML.
#
# --- OPTIONAL — sensible defaults; skip unless you need them ---
# security.*                 CSP voice SDK allowlist is built into app/config.py.
#                           Host allowlist auto from frontend_base_url.
# operational.trusted_ips    Defaults: 10.0.0.0/8, 172.16.0.0/12, 127.0.0.0/8 (VPC/LB/metrics).
# rate_limits                Omit entirely (self-host). HTTP limits OFF by default.
# workers.*                  Celery concurrency tuning — only when scaling imports/evals.
# security.trusted_hosts     Extra hostnames only; omit localhost in prod. Use public_base_url for API host.
# security.hsts_enabled      true behind HTTPS in production.
# license.key                config.yml if using licensed enterprise features.
#
# --- SaaS (EfficientAI cloud) ONLY — do not copy to self-host ---
# rate_limits.enforce: true   HTTP abuse limits (auth, health, UI creates).
#
# Full variable reference below.
# =============================================================================

# Database Configuration
DATABASE_URL=postgresql://efficientai:password@db:5432/efficientai
POSTGRES_USER=efficientai
POSTGRES_PASSWORD=password
POSTGRES_DB=efficientai

# Redis Configuration
REDIS_URL=redis://redis:6379/0

# Application Configuration
APP_NAME=Voice AI Evaluation Platform
APP_VERSION=0.1.0
API_V1_PREFIX=/api/v1
DEBUG=True
SECRET_KEY=your-secret-key-here-change-in-production
SERVICE_MODE=api
# Leave empty for single-process local dev (web + phone WS on the API port).
# Set when running a dedicated media worker (docker ``media`` service or ``eai telephony-worker``):
# MEDIA_WS_BASE_URL=ws://localhost:8001
MEDIA_PORT=8001

# File Storage
UPLOAD_DIR=/app/uploads
MAX_FILE_SIZE_MB=500
ALLOWED_AUDIO_FORMATS=wav,mp3,flac,m4a

# S3 (optional — used when config.docker.yml references ${S3_ACCESS_KEY_ID})
# Required for call-import PDF report history (stored artifacts); without blob storage,
# PDF generation still streams inline but is not versioned.
# S3_ACCESS_KEY_ID=
# S3_SECRET_ACCESS_KEY=

# Celery Configuration
CELERY_BROKER_URL=redis://redis:6379/0
CELERY_RESULT_BACKEND=redis://redis:6379/0

# CORS
CORS_ORIGINS=["http://localhost:3000", "http://localhost:8000"]

# API Settings
API_KEY_HEADER=X-API-Key
# Legacy field — not enforced on HTTP handlers today.
RATE_LIMIT_PER_MINUTE=60

# -----------------------------------------------------------------------------
# Rate limits & throughput (read before changing config.yml)
# -----------------------------------------------------------------------------
# Self-hosted default: API_RATE_LIMIT_ENFORCE=false (no HTTP 429 from our middleware).
# EfficientAI SaaS: set rate_limits.enforce: true in deployment config.yml.
#
# API_RATE_LIMIT_ENFORCE (yaml: rate_limits.enforce)
#   When false (self-host default): none of the HTTP limits below apply.
#
# When enforce is true (SaaS), limits apply ONLY to:
#   1) Auth abuse — POST /auth/login, POST /auth/register (per client IP)
#      yaml: rate_limits.auth_per_ip_per_minute  (default in code: 60)
#   2) Health abuse — GET /health for anonymous IPs (LB/VPC peers exempt)
#      yaml: operational.health_rate_limit_per_minute  (default: 60)
#   3) UI resource create — ONLY these POST handlers (NOT metrics, NOT call imports):
#      agents, personas, scenarios, chat sessions
#      yaml: rate_limits.resource_create_burst / sustained / org_per_hour
#      resource_create_org_per_hour=0 disables the shared org bucket (default).
#
# NOT HTTP rate-limited (scale paths — do not add enforce_resource_create_limiter):
#   call_imports*, evaluations*, evaluators*, traces ingest, metric create, bulk uploads.
#
# Worker throughput (separate from HTTP 429; config.yml workers: section):
#   eval_*_inflight_limit, import_*_inflight_limit, telephony_import_credit_limit
#   Caps parallel Celery rows / telephony API budget (not changed by HTTP rate-limit defaults).
# API_RATE_LIMIT_ENFORCE=false

# HTTP security headers (see config.yml.example security section)
CSP_ENABLED=true
CSP_REPORT_ONLY=false
# app.frontend_base_url in config.yml drives trusted Host allowlist (exact host only).
# FRONTEND_BASE_URL required when DEBUG=false.

# -----------------------------------------------------------------------------
# Authentication (pluggable auth providers)
# -----------------------------------------------------------------------------
# Comma-separated or JSON list. See config.yml.example for full docs.
# OSS default:        api_key,local_password
# Enterprise SSO:     api_key,external_oidc   (Okta / Azure AD / Google / Cognito / Auth0 / ...)
AUTH_PROVIDERS=["api_key","local_password"]

# Local password (HS256 Bearer tokens signed with SECRET_KEY)
AUTH_LOCAL_TOKEN_TTL_MINUTES=15
AUTH_REFRESH_TOKEN_TTL_DAYS=7
AUTH_LOCAL_ALLOW_SIGNUP=true
# Browser sessions use httpOnly cookies (eai_access/eai_refresh) + CSRF (eai_csrf).
# AUTH_COOKIE_SESSION_ENABLED=true
# AUTH_COOKIE_SECURE=true
# AUTH_COOKIE_SAMESITE=lax

# Recording URL SSRF allowlist (optional extras merged onto built-in defaults).
# Built-in suffixes include: exotel.com, plivo.com, vobiz.ai, amazonaws.com,
# cloudfront.net, googleapis.com, blob.core.windows.net, digitaloceanspaces.com,
# backblazeb2.com, r2.cloudflarestorage.com, vapi.ai, retell.ai, elevenlabs.io,
# daily.co, livekit.cloud, smallest.ai
# RECORDING_URL_ALLOWED_HOST_SUFFIXES=["recordings.mycompany.com"]

# Production deploy (Phase C — set before go-live):
# SECRET_KEY=<64+ char random, rotate on deploy>
# DEBUG=false
# app.frontend_base_url in config.yml — trusted Host = that hostname (+ optional security.trusted_hosts / TRUSTED_HOSTS env)
# operational.trusted_ips in config.yml — optional; replaces defaults (10/8, 172.16/12, 127/8 in config.py)
# Used for /metrics access, /health rate-limit exempt, Host checks for VPC LB peers
# operational.health_rate_limit_per_minute — caps anonymous /health abuse (LB peers exempt)
# security.public_base_url in config.yml
# security.hsts_enabled: true
# ALB listener policy: ELBSecurityPolicy-TLS13-1-2-2021-06

# External OIDC (requires an EFFICIENTAI_LICENSE with feature "oidc_sso")
# Works with any OIDC-compliant IdP: Okta, Azure AD / Entra ID,
# Google Workspace, AWS Cognito, Auth0, Ping, JumpCloud, OneLogin, etc.
# When external_oidc is listed in AUTH_PROVIDERS, both issuer and audience
# are REQUIRED — the application refuses to start if either is missing.
# AUTH_OIDC_ISSUER=https://example.okta.com
# AUTH_OIDC_AUDIENCE=efficientai  # REQUIRED with external_oidc (expected `aud` claim)
# AUTH_OIDC_CLIENT_ID=0oa...
# AUTH_OIDC_JWKS_URI=https://example.okta.com/oauth2/v1/keys
# AUTH_OIDC_DEFAULT_ORG_NAME=Example Inc
# AUTH_OIDC_ORG_CLAIM_PATH=https://efficientai.com/org

# Enterprise license JWT (RS256). Obtain from the EfficientAI team.
# EFFICIENTAI_LICENSE=eyJhbGciOi...

# -----------------------------------------------------------------------------
# Usage cost flush (Celery Beat + worker-usage queue)
# Beat enqueues flush + evaluator cron dispatch; worker-usage runs those tasks.
# Platform schedules (alerts, FX, prune) run on the co-located platform worker.
# See README "Usage Pricing Ops". Copy to .env for Docker Compose / local dev.
# -----------------------------------------------------------------------------
USAGE_FLUSH_BUCKET_BATCH_SIZE=500
USAGE_FLUSH_MAX_BATCHES_PER_RUN=30
USAGE_FLUSH_BEAT_SECONDS=120
USAGE_FLUSH_LOCK_TTL_SECONDS=300
USAGE_READ_CACHE_TTL_SECONDS=90
CRON_DISPATCH_INTERVAL_SECONDS=30