canvas-notebook/.env.docker.example at main · canvascoding/canvas-notebook · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
# Canvas Notebook — Docker configuration with managed Postgres
# Copy this file to .env.docker.local and fill in the REQUIRED section.

# ─── REQUIRED: Edit these before first start ─────────────────────────────────

# Public URL where the app will be reachable.
# With the included compose.ghcr.yaml this is http://localhost:3456 by default.
BASE_URL=http://localhost:3456

# Auth base URL — usually the same as BASE_URL.
BETTER_AUTH_BASE_URL=http://localhost:3456

# Optional additional browser origins, comma-separated. These are also allowed
# to establish the authenticated chat WebSocket connection.
# BETTER_AUTH_TRUSTED_ORIGINS=https://admin.example.com

# Auth secrets used by better-auth to sign sessions/tokens.
# Generate both with: openssl rand -base64 32
BETTER_AUTH_SECRET=SET_WITH_OPENSSL_RAND_BASE64_32
CANVAS_INTERNAL_API_KEY=SET_WITH_OPENSSL_RAND_BASE64_32

# ─── OPTIONAL: Change if needed ──────────────────────────────────────────────

# Logging
# LOG_LEVEL: off | error | warn | info | debug (default: info in production)
LOG_LEVEL=info
# LOG_TO_STDOUT: true | false (default: false in production)
LOG_TO_STDOUT=false
# LOG_FILE: Custom log file path (default: /data/logs/runtime.log in production)
# LOG_FILE=/data/logs/runtime.log

# Guided onboarding hints are disabled by default. Set this to true only when
# you want to enable the in-app walkthrough for users.
# ONBOARDING_HINTS=true

# The Mobile App promotion remains off until the public App Store listing is ready.
# It is shown only to eligible desktop users and is frequency-capped per account.
# CANVAS_MOBILE_APP_PROMO_ENABLED=true

# Browser-based exports (PDF/Marp/Mermaid) are CPU/RAM intensive.
# Defaults are conservative for small Cube instances: one active job and one queued job.
# CANVAS_BROWSER_EXPORT_MAX_QUEUE=1
# CANVAS_BROWSER_EXPORT_QUEUE_WAIT_TIMEOUT_MS=15000
# CANVAS_BROWSER_EXPORT_MIN_FREE_MEMORY_MB=256
# CANVAS_BROWSER_EXPORT_MAX_LOAD_PER_CPU=2
# Marp Node heap plus Linux CPU/nice child-process limits:
# CANVAS_BROWSER_EXPORT_CHILD_MEMORY_MB=1024
# CANVAS_BROWSER_EXPORT_CHILD_CPU_SECONDS=60
# CANVAS_BROWSER_EXPORT_CHILD_NICE=10

# ─── DATABASE: Required production defaults ──────────────────────────────────

COMPOSE_PROFILES=postgres
CANVAS_DATABASE_PROVIDER=postgres
CANVAS_POSTGRES_MODE=managed
DATABASE_URL=postgresql://canvas:change-me@postgres:5432/canvas_notebook
CANVAS_POSTGRES_DB=canvas_notebook
CANVAS_POSTGRES_USER=canvas
CANVAS_POSTGRES_PASSWORD=change-me
CANVAS_POSTGRES_VECTOR_ENABLED=true

# ─── SINGLE-USER DEFAULTS: Usually leave as-is ───────────────────────────────

# The Dockerfile already sets NODE_ENV=production.
# Only uncomment this if you need to override the environment.
# NODE_ENV=production

# The container already defaults to PORT=3000 and HOSTNAME=0.0.0.0.
# Only uncomment these if you need to override the defaults.
# PORT=3000
# HOSTNAME=0.0.0.0

# Base path for app data (workspaces, skills, secrets, migration backups, etc.).
# PostgreSQL runtime does not create sqlite.db; it is only used by explicit legacy imports.
# The Dockerfile already defaults to DATA=/data, which matches the compose volume mount.
# Only uncomment this if you need to override the path.
# DATA=/data

# ─── OPTIONAL: Headless / recovery admin creation ────────────────────────────
# Normally you create the first admin account in the browser on first start.
# Uncomment these only if you need an automatic admin account during container startup
# (for example for headless installs or lockout recovery).
# BOOTSTRAP_ADMIN_EMAIL=admin@example.com
# BOOTSTRAP_ADMIN_PASSWORD=change-me-immediately
# BOOTSTRAP_ADMIN_NAME=Administrator

# ─── OPTIONAL: Staged Community Team rollout ─────────────────────────────────
# These server-only gates default to false. They permit new Control Plane
# communication paths but never replace signed license or seat-limit checks.
# Keep all three disabled for normal Community Solo installations.
# CANVAS_TEAM_SEAT_CLIENT_ENABLED=false
# CANVAS_TEAM_SEAT_COMMUNITY_CLAIM_ENABLED=false
# CANVAS_TEAM_SEAT_MEMBERSHIP_MUTATIONS_ENABLED=false

# Certificate environment and trust stores are server-only. Production is the
# default; development, test or staging must be selected explicitly.
# CANVAS_LICENSE_RUNTIME_ENVIRONMENT=production
# CANVAS_LICENSE_PUBLIC_KEY=
# CANVAS_LICENSE_TRUSTED_PUBLIC_KEY_FINGERPRINTS=
# CANVAS_LICENSE_TEST_PUBLIC_KEY=
# CANVAS_LICENSE_TEST_TRUSTED_PUBLIC_KEY_FINGERPRINTS=
# CANVAS_LICENSE_TEST_AUDIENCE=canvas-notebook-test

# An already connected Community Team license is refreshed server-side without
# an active browser session. Set this to false only for maintenance/debugging.
# CANVAS_TEAM_LICENSE_REFRESH_ENABLED=true

# Commercial Community Team certificates remain usable for at most this many
# seconds after their signed expiry when refresh fails temporarily (for example
# while the installation has no internet connection). The value is clamped to
# seven days; test and manual licenses never receive offline grace.
# CANVAS_TEAM_LICENSE_OFFLINE_GRACE_SECONDS=86400

# Optional refresh tuning. Defaults: refresh every 5 minutes, start refreshing
# 5 minutes before certificate expiry, exponential retry from 15 to 300 seconds.
# CANVAS_TEAM_LICENSE_REFRESH_INTERVAL_SECONDS=300
# CANVAS_TEAM_LICENSE_REFRESH_AHEAD_SECONDS=300
# CANVAS_TEAM_LICENSE_REFRESH_BACKOFF_INITIAL_SECONDS=15
# CANVAS_TEAM_LICENSE_REFRESH_BACKOFF_MAX_SECONDS=300

# The server periodically enforces the signed Team seat limit and the
# data-preserving Solo fallback. Keep this enabled in production.
# CANVAS_TEAM_LICENSE_LIFECYCLE_ENABLED=true
# CANVAS_TEAM_LICENSE_LIFECYCLE_INTERVAL_SECONDS=60