-
Notifications
You must be signed in to change notification settings - Fork 110
Expand file tree
/
Copy path.env.example
More file actions
170 lines (148 loc) · 6.37 KB
/
Copy path.env.example
File metadata and controls
170 lines (148 loc) · 6.37 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
# OpenCode WebUI Configuration
# Copy this file to .env and customize as needed
# Default values are defined in: shared/src/config/defaults.ts
# ============================================
# Backend Server Configuration
# ============================================
PORT=5003
HOST=0.0.0.0
CORS_ORIGIN=http://localhost:5173
NODE_ENV=production
LOG_LEVEL=info
# ============================================
# OpenCode Server
# ============================================
OPENCODE_SERVER_PORT=5551
OPENCODE_HOST=127.0.0.1
# Optional - bearer password required when OPENCODE_HOST=0.0.0.0 (external exposure).
# The managed OpenCode server will refuse to start if OPENCODE_HOST is not
# localhost/127.0.0.1 and no password is configured (either here or via
# Settings → OpenCode → Server Auth).
# DB-stored passwords (set via UI) override this env var.
# OPENCODE_SERVER_PASSWORD=
# Optional - Basic Auth username (default: opencode)
# OPENCODE_SERVER_USERNAME=opencode
# Optional - import an existing standalone OpenCode install on first startup
# Useful for Docker when your host OpenCode data is bind-mounted into the container
# OPENCODE_IMPORT_CONFIG_PATH=/import/opencode-config/opencode.json
# OPENCODE_IMPORT_STATE_PATH=/import/opencode-state
# ============================================
# Database
# ============================================
DATABASE_PATH=./data/opencode.db
# ============================================
# Workspace Configuration
# ============================================
WORKSPACE_PATH=./workspace
# Optional - Docker: bind /workspace to a host directory instead of the named
# volume, and run the container as your host user so the files stay usable from
# the host without root. Set PUID/PGID to the output of `id -u` / `id -g`.
# OCM_WORKSPACE_HOST_PATH=/absolute/path/to/opencode-workspace
# PUID=1000
# PGID=1000
# Optional - convenience vars for Docker bind mounts documented in docs/configuration/docker.md
# OCM_REPOS_HOST_PATH=/Users/you/Development
# OCM_OPENCODE_CONFIG_HOST_PATH=/Users/you/.config/opencode
# OCM_OPENCODE_STATE_HOST_PATH=/Users/you/.local/share/opencode
# ============================================
# Timeouts (milliseconds)
# ============================================
PROCESS_START_WAIT_MS=2000
PROCESS_VERIFY_WAIT_MS=1000
HEALTH_CHECK_TIMEOUT_MS=30000
# ============================================
# File Limits (MB)
# ============================================
MAX_FILE_SIZE_MB=50
MAX_UPLOAD_SIZE_MB=50
# ============================================
# Logging
# ============================================
DEBUG=false
# ============================================
# Authentication (Better Auth)
# ============================================
# AUTH_SECRET is required - generate with: openssl rand -base64 32
AUTH_SECRET=CHANGE_ME_GENERATE_WITH_openssl_rand_base64_32
# Trusted origins for authentication (comma-separated)
# Add your server's external URL when accessing remotely
# AUTH_TRUSTED_ORIGINS=http://localhost:5173,http://localhost:5003
# Admin Account (optional - for pre-configured single-user mode)
# When set, admin user is created on first startup and self-registration is disabled
# ADMIN_EMAIL=admin@example.com
# ADMIN_PASSWORD=your-secure-password
# Password Reset (set to true to force password update from ADMIN_PASSWORD)
# Remove after resetting password
# ADMIN_PASSWORD_RESET=false
# Secure Cookies (set to false when running HTTP without a reverse proxy)
# Defaults to true in production, false in development
# AUTH_SECURE_COOKIES=true
# OAuth Providers (optional - enable by providing client ID and secret)
# GITHUB_CLIENT_ID=
# GITHUB_CLIENT_SECRET=
# GOOGLE_CLIENT_ID=
# GOOGLE_CLIENT_SECRET=
# DISCORD_CLIENT_ID=
# DISCORD_CLIENT_SECRET=
# Passkey/WebAuthn Configuration
PASSKEY_RP_ID=localhost
PASSKEY_RP_NAME=OpenCode Manager
PASSKEY_ORIGIN=http://localhost:5003
# ============================================
# Push Notifications (VAPID)
# Enables push notifications for the PWA (background alerts for agent
# questions, permission requests, errors, and session completions).
#
# Setup:
# 1. Generate keys: pnpm dlx web-push generate-vapid-keys
# 2. Set VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY from the output
# 3. Set VAPID_SUBJECT to a mailto: address (REQUIRED for iOS/Safari)
#
# IMPORTANT: VAPID_SUBJECT MUST use the mailto: format for iOS/Safari
# push notifications to work. Apple's push service rejects https:// subjects.
# Example: mailto:you@yourdomain.com
#
# Browser requirements:
# - HTTPS required (except localhost)
# - Safari/iOS: Requires mailto: VAPID_SUBJECT and HTTPS
# ============================================
# VAPID_PUBLIC_KEY=
# VAPID_PRIVATE_KEY=
# VAPID_SUBJECT=mailto:you@yourdomain.com
# ============================================
# Agent Sandboxing (microsandbox)
# Sandboxed agent commands run inside a microVM managed by msb. Linux host
# with /dev/kvm is required; enable the sandbox overlay to grant the container
# KVM access and persist sandbox state:
# docker compose -f docker-compose.yml -f docker-compose.sandbox.yml up -d
# ============================================
# OCI image the microVM boots from. The default ships gh, a Playwright Chromium,
# and the node:24 toolchain; any image you point this at must contain every tool
# the agent expects to run and a shell at /bin/sh.
# SANDBOX_IMAGE=docker.io/cstechdev/ocm-sandbox:latest
# MicroVM memory (e.g. 4G)
# SANDBOX_MEMORY=4G
# MicroVM CPU count
# SANDBOX_CPUS=2
# Guest identity sandboxed commands run as: a numeric uid, a numeric uid:gid,
# or a guest username. Defaults to PUID so the guest identity always matches
# the workspace owner; a guest username is resolved to the Manager's uid:gid.
# When a configured numeric identity cannot match the workspace owner,
# enforcement is reported unavailable.
# SANDBOX_EXEC_USER=${PUID:-1000}
# Network mode for the microVM: public, private, or host, or a comma-separated
# composition (for example public,host)
# SANDBOX_NET=public
# Timeout for microVM startup, in milliseconds
# SANDBOX_START_TIMEOUT_MS=300000
# Timeout for a single sandboxed command, in milliseconds
# SANDBOX_EXEC_TIMEOUT_MS=600000
# ============================================
# Frontend Configuration (Vite)
# These are optional - frontend uses defaults if not set
# ============================================
# VITE_API_URL=http://localhost:5003
# VITE_SERVER_PORT=5003
# VITE_OPENCODE_PORT=5551
# VITE_MAX_FILE_SIZE_MB=50
# VITE_MAX_UPLOAD_SIZE_MB=50