.env.example

# --- Shared env vars ---
LOG_LEVEL=INFO
COMPOSE_PROJECT_NAME=tracecat
COMPOSE_BAKE=true

# --- Network configuration ---
PUBLIC_APP_PORT=80
PUBLIC_APP_URL=http://localhost:${PUBLIC_APP_PORT}
PUBLIC_API_URL=${PUBLIC_APP_URL}/api
INTERNAL_API_URL=http://api:8000

# -- Caddy env vars ---
BASE_DOMAIN=:${PUBLIC_APP_PORT}
ADDRESS=0.0.0.0

# --- Frontend env vars ---
NODE_ENV=development
NEXT_PUBLIC_APP_ENV=development
# The frontend app URL
NEXT_PUBLIC_APP_URL=${PUBLIC_APP_URL}
# Allows the browser to communicate with the backend
NEXT_PUBLIC_API_URL=${PUBLIC_API_URL}
# Allows the frontend server (inside docker) to communicate with the backend server (inside docker)
NEXT_SERVER_API_URL=${INTERNAL_API_URL}

# --- App and DB env vars ---
# One of `development`, `staging`, or `production`
TRACECAT__APP_ENV=development
# Platform-owned distributed tracing (separate from tenant agent OTel settings)
TRACECAT__PLATFORM_OTEL_ENABLED=false
# OTLP/HTTP collector base URL (defaults to `http://localhost:4318`)
OTEL_EXPORTER_OTLP_ENDPOINT=
# Optional OTLP headers for API/worker only (`key=value,key2=value2`)
OTEL_EXPORTER_OTLP_HEADERS=
# Used to encrypt/decrypt sensitive keys in the database
# Can be generated using `python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"`
TRACECAT__DB_ENCRYPTION_KEY=your-tracecat-db-fernet-key
# Used to authenticate with Tracecat services
# Can be generated using `openssl rand -hex 32`
TRACECAT__SERVICE_KEY=your-tracecat-service-key
TRACECAT__EXECUTOR_TOKEN_TTL_SECONDS=900
# Used to generate private webhook URLs
# Can be generated using `openssl rand -hex 32`
TRACECAT__SIGNING_SECRET=your-tracecat-signing-secret
# API Service URL
TRACECAT__API_URL=${INTERNAL_API_URL}
# Root path to deal with extra path prefix behind the reverse proxy
TRACECAT__API_ROOT_PATH=/api
# This the public URL for the frontend
TRACECAT__PUBLIC_APP_URL=${PUBLIC_APP_URL}
# This is the public URL for incoming webhooks
# If you wish to expose your webhooks to the internet, you can use a tunneling service like ngrok.
# If using ngrok, run `ngrok http --domain=INSERT_STATIC_NGROK_DOMAIN_HERE 8001`
# to start ngrok and update this with the forwarding URL
TRACECAT__PUBLIC_API_URL=${PUBLIC_API_URL}
# CORS (comma-separated string of allowed origins)
TRACECAT__ALLOW_ORIGINS=http://localhost:3000,${PUBLIC_APP_URL}
# Postgres SSL mode
TRACECAT__DB_SSLMODE=disable

# --- Postgres ---
TRACECAT__POSTGRES_USER=postgres
TRACECAT__POSTGRES_PASSWORD=postgres
TRACECAT__DB_URI=postgresql+psycopg://${TRACECAT__POSTGRES_USER}:${TRACECAT__POSTGRES_PASSWORD}@postgres_db:5432/postgres

# --- Authentication ---

# First user to promote to superadmin
TRACECAT__AUTH_SUPERADMIN_EMAIL=

# One or more comma-separated values from `basic`, `oidc`, `saml`
TRACECAT__AUTH_TYPES=basic
# One or more comma-separated domains, e.g. `example.com,example.org`
# Leave blank to allow all domains
TRACECAT__AUTH_ALLOWED_DOMAINS=
TRACECAT__AUTH_MIN_PASSWORD_LENGTH=12

# OIDC / OAuth
OIDC_ISSUER=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_SCOPES="openid profile email"

# MCP server (external IDE integrations)
TRACECAT_MCP__FILE_TRANSFER_URL_EXPIRY_SECONDS=300
TRACECAT_MCP__STARTUP_MAX_ATTEMPTS=3
TRACECAT_MCP__STARTUP_RETRY_DELAY_SECONDS=2

# Legacy aliases (still supported)
OAUTH_CLIENT_ID=
OAUTH_CLIENT_SECRET=

# Used for password reset and email verification tokens
# Can be generated using `openssl rand -hex 32`
USER_AUTH_SECRET=your-auth-secret

# SAML SSO settings
SAML_IDP_METADATA_URL=
SAML_ACCEPTED_TIME_DIFF=3

# --- Temporal ---
TEMPORAL__CLUSTER_URL=temporal:7233
TEMPORAL__CLUSTER_QUEUE=tracecat-task-queue
TEMPORAL__CLUSTER_NAMESPACE=default
TEMPORAL__POSTGRES_USER=temporal
TEMPORAL__POSTGRES_PASSWORD=temporal
TEMPORAL__UI_VERSION=latest
# Workflow history retention for the Temporal namespace, applied when the
# namespace is first created. Minimum 1 day. See
# https://docs.tracecat.com/self-hosting/temporal-retention
TEMPORAL__DEFAULT_NAMESPACE_RETENTION=24h
# Leave empty if not using Temporal Cloud
TEMPORAL__API_KEY=
# Worker concurrency tuning (DSL worker). Lower these on small CPU allocations to
# reduce GIL contention that can trip Temporal's workflow deadlock detector.
TEMPORAL__THREADPOOL_MAX_WORKERS=100
TEMPORAL__MAX_CONCURRENT_ACTIVITIES=100
TEMPORAL__MAX_CONCURRENT_WORKFLOW_TASKS=100
# Agent workflow worker activity admission.
TRACECAT__AGENT_MAX_CONCURRENT_ACTIVITIES=100
# Agent execution worker activity admission.
TRACECAT__AGENT_EXECUTOR_MAX_CONCURRENT_ACTIVITIES=1

# --- Executor ---
TRACECAT__EXECUTOR_BACKEND=direct
TRACECAT__DISABLE_NSJAIL=true
TRACECAT__LITELLM_BASE_URL=http://litellm:4000
# Executor concurrency tuning. Lower these on small CPU allocations.
TRACECAT__EXECUTOR_MAX_CONCURRENT_ACTIVITIES=16
TRACECAT__EXECUTOR_THREADPOOL_MAX_WORKERS=16
# Max parallel iterations within a single action's `for_each` loop.
TRACECAT__EXECUTOR_FOR_EACH_MAX_CONCURRENCY=4

# --- Workflow Artifacts ---
# Retention period in days for workflow artifacts in blob storage.
# Objects older than this will be automatically deleted via S3 lifecycle rules.
# Set to 0 to disable automatic expiration.
# Default: 30 days (matches Temporal Cloud workflow history retention).
TRACECAT__WORKFLOW_ARTIFACT_RETENTION_DAYS=30

# --- Blob storage ---
TRACECAT__BLOB_STORAGE_BUCKET_WORKFLOW=tracecat-workflow
TRACECAT__BLOB_STORAGE_BUCKET_ATTACHMENTS=tracecat-attachments
TRACECAT__BLOB_STORAGE_BUCKET_REGISTRY=tracecat-registry
TRACECAT__BLOB_STORAGE_BUCKET_AGENT=tracecat-agent
# Total request attempts (initial try + retries) for transient S3/MinIO failures.
TRACECAT__BLOB_STORAGE_MAX_ATTEMPTS=5

# --- MinIO ---
MINIO_ROOT_USER=minio
MINIO_ROOT_PASSWORD=password

# --- Redis ---
REDIS_HOST=redis
REDIS_PORT=6379
REDIS_URL=redis://${REDIS_HOST}:${REDIS_PORT}

# --- Cloud only ---
# Tracecat Cloud only, please ignore if self-hosted:
NEXT_PUBLIC_POSTHOG_KEY=
NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com
NEXT_PUBLIC_DISABLE_SESSION_RECORDING=true

# --- Externalization ---
# Store large action results and triggers in blob storage instead of Temporal history.
TRACECAT__RESULT_EXTERNALIZATION_ENABLED=true
# Store large collections as chunked manifests in blob storage.
TRACECAT__COLLECTION_MANIFESTS_ENABLED=true
# Threshold in bytes above which payloads are externalized to blob storage.
TRACECAT__RESULT_EXTERNALIZATION_THRESHOLD_BYTES=128000

# --- Agent filesystem persistence ---
# Maximum compressed bytes retained in each worker's local agent snapshot archive cache.
TRACECAT__AGENT_FS_ARCHIVE_CACHE_MAX_BYTES=10737418240

# --- Local registry ---
# Enable this only for local-registry development. Leave disabled for normal remote/builtin registry use.
TRACECAT__LOCAL_REPOSITORY_ENABLED=false
# Absolute host path to the local registry package for Docker bind mounts.
TRACECAT__LOCAL_REPOSITORY_PATH=/absolute/path/to/internal-registry
# Keep the default unless you need extra import paths in the executor containers.
PYTHONPATH=/home/apiuser/.local:/app/local_registry

# --- Enterprise ---
# Modifying the following flags requires a Tracecat Enterprise License.
# Features activated by feature flags may be gated behind a license key in the future.
# Feature flags (comma-separated list)
TRACECAT__FEATURE_FLAGS=""
TRACECAT__EE_MULTI_TENANT=false