mirror of
https://github.com/onyx-dot-app/onyx.git
synced 2026-10-22 11:22:49 -05:00
309 lines
11 KiB
Plaintext
309 lines
11 KiB
Plaintext
# Copy this file to .env so it's picked up by the docker compose yaml files
|
|
# Uncomment the values you would like to set
|
|
# No edits necessary, works out of the box
|
|
|
|
|
|
################################################################################
|
|
## COMMONLY MODIFIED CONFIGURATIONS
|
|
################################################################################
|
|
## Version of Onyx to deploy, default is latest (main built nightly).
|
|
## For Craft, run install.sh with --include-craft instead of editing this file
|
|
## — the installer forces the craft-tagged backend image and applies the
|
|
## docker-compose.craft.yml overlay together.
|
|
IMAGE_TAG=latest
|
|
|
|
## Onyx Craft Configuration
|
|
## Craft enables AI-powered web app building within Onyx (disabled by default).
|
|
## To enable Craft, re-run install.sh with --include-craft. Setting these
|
|
## variables by hand without the craft compose overlay (which only the
|
|
## installer writes) leaves api_server with SANDBOX_BACKEND=docker but no
|
|
## Docker socket mount — sandboxes will fail to provision.
|
|
# ENABLE_CRAFT=true
|
|
#
|
|
## --- Craft sandbox backend (docker-compose only) ---
|
|
## docker-compose defaults SANDBOX_BACKEND to "docker" so api_server drives
|
|
## sandbox containers directly via the host Docker Engine. This requires
|
|
## mounting /var/run/docker.sock into api_server and background — anything
|
|
## that can talk to the Docker socket is effectively root on the host, so
|
|
## only enable Craft on hosts you fully control. Override to "local" only
|
|
## for development against a single backend process (no isolation).
|
|
# SANDBOX_BACKEND=docker
|
|
#
|
|
## SANDBOX_API_SERVER_URL must be a *public* HTTPS URL the sandbox can reach
|
|
## the same way any other Onyx client does — internal compose hostnames like
|
|
## "http://api_server:8080" do not resolve from inside the sandbox bridge.
|
|
# SANDBOX_API_SERVER_URL=https://onyx.your-org.example
|
|
#
|
|
## Sandbox container image. Pinned by default for reproducibility.
|
|
# SANDBOX_CONTAINER_IMAGE=onyxdotapp/sandbox:v0.1.44
|
|
#
|
|
## Sandbox bridge network. Created by install.sh (or manually:
|
|
## docker network create onyx_craft_sandbox
|
|
## Sandboxes join only this network — they cannot reach postgres, redis,
|
|
## minio, or any other compose service by name.
|
|
# SANDBOX_DOCKER_NETWORK=onyx_craft_sandbox
|
|
#
|
|
## Per-sandbox container resource limits. Defaults match K8s pod *requests*
|
|
## (1 CPU / 2Gi), not its limits (2 CPU / 10Gi), since single-VM compose
|
|
## deployments rarely have headroom to over-commit every sandbox.
|
|
# SANDBOX_DOCKER_MEMORY_LIMIT=2g
|
|
# SANDBOX_DOCKER_CPU_LIMIT=1.0
|
|
#
|
|
## EC2 IMDS note: on EC2 the Docker daemon's default bridge allows traffic to
|
|
## 169.254.169.254 (Instance Metadata Service), which can hand out IAM role
|
|
## credentials. The fix is a host-level DOCKER-USER iptables rule that drops
|
|
## bridge traffic to that address. install.sh --include-craft installs this
|
|
## rule automatically when it has sudo/iptables access, and prints manual
|
|
## instructions otherwise.
|
|
|
|
## Auth Settings
|
|
### https://docs.onyx.app/deployment/authentication
|
|
AUTH_TYPE=basic
|
|
# SESSION_EXPIRE_TIME_SECONDS=
|
|
### Recommended for basic auth - used for signing password reset and verification tokens
|
|
### If using install.sh, this will be auto-generated
|
|
### If setting manually, run: openssl rand -hex 32
|
|
USER_AUTH_SECRET=""
|
|
### Recommend to set this for security
|
|
# ENCRYPTION_KEY_SECRET=
|
|
### Optional
|
|
# API_KEY_HASH_ROUNDS=
|
|
### You can add a comma separated list of domains like onyx.app, only those domains will be allowed to signup/log in
|
|
# VALID_EMAIL_DOMAINS=
|
|
### Set to "true" to restrict GET /users to admins. Non-admins can't enumerate
|
|
### accounts or share agents with individual users; group sharing still works.
|
|
# USER_DIRECTORY_ADMIN_ONLY=
|
|
|
|
## Chat Configuration
|
|
# HARD_DELETE_CHATS=
|
|
# MAX_ALLOWED_UPLOAD_SIZE_MB=250
|
|
# Default per-user upload size limit (MB) when no admin value is set.
|
|
# Automatically clamped to MAX_ALLOWED_UPLOAD_SIZE_MB at runtime.
|
|
# DEFAULT_USER_FILE_MAX_UPLOAD_SIZE_MB=100
|
|
|
|
## Base URL for redirects
|
|
# WEB_DOMAIN=
|
|
|
|
## Enterprise Features, requires a paid plan and licenses
|
|
ENABLE_PAID_ENTERPRISE_EDITION_FEATURES=false
|
|
|
|
|
|
################################################################################
|
|
## SERVICES CONFIGURATIONS
|
|
################################################################################
|
|
## Database Configuration
|
|
POSTGRES_USER=postgres
|
|
POSTGRES_PASSWORD=password
|
|
# POSTGRES_DB=
|
|
# POSTGRES_DEFAULT_SCHEMA=
|
|
# POSTGRES_USE_NULL_POOL=
|
|
# POSTGRES_API_SERVER_POOL_SIZE=
|
|
# POSTGRES_API_SERVER_POOL_OVERFLOW
|
|
# POSTGRES_IDLE_SESSIONS_TIMEOUT=
|
|
# POSTGRES_POOL_RECYCLE=
|
|
# Client-side TCP keepalives for the sync engine (sent on idle sockets to
|
|
# stop PgBouncer / NLB from silently closing them). Enabled by default.
|
|
# POSTGRES_TCP_KEEPALIVES=
|
|
# POSTGRES_TCP_KEEPALIVES_IDLE=
|
|
# POSTGRES_TCP_KEEPALIVES_INTERVAL=
|
|
# POSTGRES_TCP_KEEPALIVES_COUNT=
|
|
# DB_READONLY_USER=
|
|
# DB_READONLY_PASSWORD=
|
|
|
|
## File Store Backend: "s3" (default, uses MinIO) or "postgres" (no extra services needed)
|
|
## COMPOSE_PROFILES activates the MinIO service. To use PostgreSQL file storage instead,
|
|
## remove s3-filestore from COMPOSE_PROFILES and set FILE_STORE_BACKEND=postgres.
|
|
COMPOSE_PROFILES=s3-filestore
|
|
FILE_STORE_BACKEND=s3
|
|
|
|
## MinIO/S3 Configuration (only needed when FILE_STORE_BACKEND=s3)
|
|
S3_ENDPOINT_URL=http://minio:9000
|
|
S3_AWS_ACCESS_KEY_ID=minioadmin
|
|
S3_AWS_SECRET_ACCESS_KEY=minioadmin
|
|
S3_FILE_STORE_BUCKET_NAME=onyx-file-store-bucket
|
|
MINIO_ROOT_USER=minioadmin
|
|
MINIO_ROOT_PASSWORD=minioadmin
|
|
|
|
## GCS Configuration (only needed when FILE_STORE_BACKEND=gcs)
|
|
## No sidecar container needed — GCS is a managed service.
|
|
## Remove s3-filestore from COMPOSE_PROFILES when using FILE_STORE_BACKEND=gcs.
|
|
## By default, Application Default Credentials (ADC) are used, which supports
|
|
## GKE Workload Identity, Compute Engine instance SA, and gcloud CLI auth.
|
|
# FILE_STORE_BACKEND=gcs
|
|
# GCS_FILE_STORE_BUCKET_NAME=your-gcs-bucket-name
|
|
# GCS_FILE_STORE_PREFIX=onyx-files
|
|
# GCS_PROJECT_ID=your-gcp-project
|
|
# GCS_SERVICE_ACCOUNT_KEY_PATH=/path/to/service-account-key.json
|
|
# GCS_SERVICE_ACCOUNT_KEY_JSON=
|
|
|
|
## Nginx Proxy Timeout Configuration (in seconds)
|
|
## These settings control how long nginx waits for upstream servers (api_server/web_server)
|
|
## Increase these values if you experience timeout errors with long-running requests
|
|
# NGINX_PROXY_CONNECT_TIMEOUT=300
|
|
# NGINX_PROXY_SEND_TIMEOUT=300
|
|
# NGINX_PROXY_READ_TIMEOUT=300
|
|
|
|
## MCP Server Configuration
|
|
## The MCP (Model Context Protocol) server allows external MCP clients to interact with Onyx
|
|
## Set to true to enable the MCP server (disabled by default)
|
|
# MCP_SERVER_ENABLED=false
|
|
## Port for the MCP server (defaults to 8090)
|
|
# MCP_SERVER_PORT=8090
|
|
## CORS origins for MCP clients (comma-separated list)
|
|
# MCP_SERVER_CORS_ORIGINS=
|
|
|
|
## Discord Bot Configuration
|
|
## The Discord bot allows users to interact with Onyx from Discord servers
|
|
## Bot token from Discord Developer Portal (required to enable the bot)
|
|
# DISCORD_BOT_TOKEN=
|
|
## Command prefix for bot commands (default: "!")
|
|
# DISCORD_BOT_INVOKE_CHAR=!
|
|
|
|
## Celery Configuration
|
|
# CELERY_BROKER_POOL_LIMIT=
|
|
# CELERY_WORKER_DOCFETCHING_CONCURRENCY=
|
|
# CELERY_WORKER_DOCPROCESSING_CONCURRENCY=
|
|
# CELERY_WORKER_LIGHT_CONCURRENCY=
|
|
# CELERY_WORKER_LIGHT_PREFETCH_MULTIPLIER=
|
|
|
|
## AWS Configuration
|
|
# AWS_ACCESS_KEY_ID=
|
|
# AWS_SECRET_ACCESS_KEY=
|
|
# AWS_REGION_NAME=
|
|
# Set to true when using IAM authentication for Postgres connections.
|
|
USE_IAM_AUTH=false
|
|
|
|
|
|
################################################################################
|
|
## DEVELOPER, DEBUGGING, AND LOGGING
|
|
################################################################################
|
|
## Logging and Telemetry
|
|
# LOG_LEVEL is the global knob for log verbosity across every Onyx process:
|
|
# api_server, web_server, model servers, slack/discord bots, AND all Celery
|
|
# workers (primary, light, heavy, docprocessing, docfetching, monitoring,
|
|
# scheduled_tasks, user_file_processing, beat). For per-worker overrides,
|
|
# explicitly add `--loglevel=<value>` to that worker's command in
|
|
# backend/supervisord.conf — an explicit CLI flag takes precedence over
|
|
# LOG_LEVEL inside the worker process.
|
|
LOG_LEVEL=info
|
|
LOG_ONYX_MODEL_INTERACTIONS=False
|
|
# LOG_VESPA_TIMING_INFORMATION=
|
|
# LOG_ENDPOINT_LATENCY=
|
|
# LOG_POSTGRES_LATENCY=
|
|
# LOG_POSTGRES_CONN_COUNTS=
|
|
# DISABLE_TELEMETRY=
|
|
|
|
## Feature Flags
|
|
# SHOW_EXTRA_CONNECTORS=true
|
|
# DISABLE_MODEL_SERVER=false
|
|
|
|
## Analytics
|
|
# SENTRY_DSN=
|
|
|
|
## Demo/Testing
|
|
# MOCK_CONNECTOR_FILE_PATH=
|
|
|
|
|
|
################################################################################
|
|
## ADVANCED CONFIGURATIONS
|
|
################################################################################
|
|
## SlackBot Configuration
|
|
# ONYX_BOT_DISABLE_DOCS_ONLY_ANSWER=
|
|
# ONYX_BOT_FEEDBACK_VISIBILITY=
|
|
# ONYX_BOT_DISPLAY_ERROR_MSGS=
|
|
# NOTIFY_SLACKBOT_NO_ANSWER=
|
|
# ONYX_BOT_MAX_QPM=
|
|
# ONYX_BOT_MAX_WAIT_TIME=
|
|
|
|
## Advanced Auth Settings
|
|
# GOOGLE_OAUTH_CLIENT_ID=
|
|
# GOOGLE_OAUTH_CLIENT_SECRET=
|
|
# REQUIRE_EMAIL_VERIFICATION=
|
|
# SMTP_SERVER=
|
|
# SMTP_PORT=
|
|
# SMTP_USER= # Optional - omit for unauthenticated relays
|
|
# SMTP_PASS= # Optional - omit for unauthenticated relays
|
|
# SMTP_STARTTLS=true # Set to "false" for servers that don't support TLS
|
|
# ENABLE_EMAIL_INVITES=
|
|
# EMAIL_FROM= # Required when SMTP_USER is not set
|
|
# OAUTH_CLIENT_ID=
|
|
# OAUTH_CLIENT_SECRET=
|
|
# OPENID_CONFIG_URL=
|
|
# OIDC_PKCE_ENABLED=
|
|
# TRACK_EXTERNAL_IDP_EXPIRY=
|
|
# CORS_ALLOWED_ORIGIN=
|
|
# INTEGRATION_TESTS_MODE=
|
|
# JWT_PUBLIC_KEY_URL=
|
|
|
|
## Gen AI Settings
|
|
# GEN_AI_MAX_TOKENS=
|
|
# LLM_SOCKET_READ_TIMEOUT=
|
|
# MAX_CHUNKS_FED_TO_CHAT=
|
|
# DISABLE_LITELLM_STREAMING=
|
|
# LITELLM_EXTRA_HEADERS=
|
|
# GEN_AI_API_KEY=
|
|
# GENERATIVE_MODEL_ACCESS_CHECK_FREQ=
|
|
# LITELLM_CUSTOM_ERROR_MESSAGE_MAPPINGS=
|
|
|
|
## Query Options
|
|
# DOC_TIME_DECAY=
|
|
# HYBRID_ALPHA=
|
|
# EDIT_KEYWORD_QUERY=
|
|
# USE_SEMANTIC_KEYWORD_EXPANSIONS_BASIC_SEARCH=
|
|
|
|
## Model Configuration
|
|
# EMBEDDING_BATCH_SIZE=
|
|
# DOCUMENT_ENCODER_MODEL=
|
|
# DOC_EMBEDDING_DIM=
|
|
# NORMALIZE_EMBEDDINGS=
|
|
# ASYM_QUERY_PREFIX=
|
|
# ASYM_PASSAGE_PREFIX=
|
|
# DISABLE_RERANK_FOR_STREAMING=
|
|
# MODEL_SERVER_PORT=
|
|
# INDEX_BATCH_SIZE=
|
|
# MIN_THREADS_ML_MODELS=
|
|
# CLIENT_EMBEDDING_TIMEOUT=
|
|
|
|
## Indexing Configuration
|
|
# VESPA_SEARCHER_THREADS=
|
|
# ENABLED_CONNECTOR_TYPES=
|
|
# DISABLE_INDEX_UPDATE_ON_SWAP=
|
|
# CONTINUE_ON_CONNECTOR_FAILURE=
|
|
# CONFLUENCE_CONNECTOR_LABELS_TO_SKIP=
|
|
# JIRA_CONNECTOR_LABELS_TO_SKIP=
|
|
# WEB_CONNECTOR_VALIDATE_URLS=
|
|
# JIRA_SERVER_API_VERSION=
|
|
# JIRA_CLOUD_API_VERSION=
|
|
# GONG_CONNECTOR_START_TIME=
|
|
# NOTION_CONNECTOR_ENABLE_RECURSIVE_PAGE_LOOKUP=
|
|
# GITHUB_CONNECTOR_BASE_URL=
|
|
# MAX_DOCUMENT_CHARS=
|
|
# MAX_FILE_SIZE_BYTES=
|
|
|
|
## OAuth Connector Configs
|
|
# EGNYTE_CLIENT_ID=
|
|
# EGNYTE_CLIENT_SECRET=
|
|
# EGNYTE_LOCALHOST_OVERRIDE=
|
|
# LINEAR_CLIENT_ID=
|
|
# LINEAR_CLIENT_SECRET=
|
|
|
|
## Miscellaneous
|
|
# ONYX_QUERY_HISTORY_TYPE=
|
|
# CHECK_TTL_MANAGEMENT_TASK_FREQUENCY_IN_HOURS=
|
|
# VESPA_LANGUAGE_OVERRIDE=
|
|
|
|
## Frontend Configs
|
|
# THEME_IS_DARK=
|
|
# NEXT_PUBLIC_DISABLE_LOGOUT=
|
|
# NEXT_PUBLIC_FORGOT_PASSWORD_ENABLED=
|
|
# NEXT_PUBLIC_THEME=
|
|
# NEXT_PUBLIC_DO_NOT_USE_TOGGLE_OFF_DANSWER_POWERED=
|
|
# NEXT_PUBLIC_CUSTOM_REFRESH_URL=
|
|
|
|
## Pointer to services
|
|
POSTGRES_HOST=relational_db
|
|
REDIS_HOST=cache
|
|
MODEL_SERVER_HOST=inference_model_server
|
|
INDEXING_MODEL_SERVER_HOST=indexing_model_server
|
|
INTERNAL_URL=http://api_server:8080
|