config.example.env

#!/usr/bin/env bash

# Please change this to domain of the server where oneuptime is hosted on.
HOST=localhost
PROVISION_SSL=false

# OneUptime Port. This is the port where OneUptime will be hosted on. 
ONEUPTIME_HTTP_PORT=80

# ==============================================
# SETTING UP TLS/SSL CERTIFICATES
# ==============================================
# OneUptime can automatically provision SSL certificates for the HOST when PROVISION_SSL=true.
# This requires port 80/443 to be reachable for Let's Encrypt validation and the HOST domain pointing to this server.
# If you prefer to terminate TLS on an external reverse proxy, leave PROVISION_SSL=false and manage certificates yourself.
HTTP_PROTOCOL=http

# Captcha configuration
CAPTCHA_ENABLED=false
CAPTCHA_SITE_KEY=
CAPTCHA_SECRET_KEY=

# Secrets - PLEASE CHANGE THESE. Please change these to something random. All of these can be different values.
ONEUPTIME_SECRET=please-change-this-to-random-value
REGISTER_PROBE_KEY=please-change-this-to-random-value
DATABASE_PASSWORD=please-change-this-to-random-value
CLICKHOUSE_PASSWORD=please-change-this-to-random-value
REDIS_PASSWORD=please-change-this-to-random-value
ENCRYPTION_SECRET=please-change-this-to-random-value
GLOBAL_PROBE_1_KEY=probe-1-please-change-this-to-random-value
GLOBAL_PROBE_2_KEY=probe-2-please-change-this-to-random-value


# If you are connecting Status Pages to custom domains, then this will be the port where the status page will be hosted on.
# This should be https port because oneuptime automatically generates ssl certs from lets encrypt. 
STATUS_PAGE_HTTPS_PORT=443


# If you would like to attach status pages to custom domains use this setting.
# For example, lets say you would like the status page to be hosted on status.yourcompany.com, then
# 1. Create a A record in your DNS provider with the name "oneuptime.yourcompany.com" and value to Public IP of the server oneuptime is deployed on.
# 2. Set the STATUS_PAGE_CNAME_RECORD to "oneuptime.yourcompany.com"
# 3. Create CNAME record in your DNS provider with the name "status.yourcompany.com" and value "oneuptime.yourcompany.com"
STATUS_PAGE_CNAME_RECORD=oneuptime.yourcompany.com

# If you would like to attach public dashboards to custom domains use this setting.
# Works the same way as STATUS_PAGE_CNAME_RECORD but for dashboards.
# For example, if you want dashboard.yourcompany.com to show a public dashboard:
# 1. Set the DASHBOARD_CNAME_RECORD to "oneuptime.yourcompany.com"
# 2. Create CNAME record in your DNS provider with the name "dashboard.yourcompany.com" and value "oneuptime.yourcompany.com"
DASHBOARD_CNAME_RECORD=oneuptime.yourcompany.com


# --------------------------------------------- #
# You can safely ignore anything below this line. Keep them as default to make things work. 
# --------------------------------------------- #
# This supports test | production | development | ci. 
# Development is used for local development. Test is used for insider / beta / staging builds. Production is used for production ready app. ci is for testing in the CI/CD. 
ENVIRONMENT=production

# What image should we pull from docker hub. This only applies when the ENVIRONMENT is production or test
APP_TAG=release

# Change this to true if you are using enterprise edition. Keep it false if you are using community edition.
IS_ENTERPRISE_EDITION=false

# What is the name of the docker compose project. This is used to prefix the docker containers.
COMPOSE_PROJECT_NAME=oneuptime


# Clickhouse Settings
CLICKHOUSE_USER=default
CLICKHOUSE_DATABASE=oneuptime
CLICKHOUSE_HOST=clickhouse
CLICKHOUSE_PORT=8123
# Per-container ClickHouse connection pool ceilings. The ingest pool (used by
# the fan-in telemetry writer) inherits CLICKHOUSE_MAX_OPEN_CONNECTIONS when
# left empty.
CLICKHOUSE_MAX_OPEN_CONNECTIONS=100
CLICKHOUSE_INGEST_MAX_OPEN_CONNECTIONS=


# Postgres DB Settings. 
DATABASE_PORT=5432
DATABASE_USERNAME=postgres
DATABASE_NAME=oneuptimedb
DATABASE_HOST=postgres

# Used to connect to managed postgres providers.
# Fill only what your provider needs.
DATABASE_SSL_REJECT_UNAUTHORIZED=false
DATABASE_SSL_CA=
DATABASE_SSL_KEY=
DATABASE_SSL_CERT=

# Redis DB Settings. 

REDIS_HOST=redis
REDIS_PORT=6379
REDIS_DB=0
REDIS_USERNAME=default
REDIS_IP_FAMILY=
REDIS_TLS_CA=
REDIS_TLS_SENTINEL_MODE=false

# Hostnames. Usually does not need to change. 
SERVER_APP_HOSTNAME=app
#Ports. Usually they don't need to change.

APP_PORT=3002
TEST_SERVER_PORT=3800
HOME_PORT=1444
# Plans
# This is in the format of PlanName,PlanIdFromBillingProvider,MonthlySubscriptionPlanAmountInUSD,YearlySubscriptionPlanAmountInUSD,Order,TrialPeriodInDays
# Enterprise plan will have -1 which means custom pricing. 
SUBSCRIPTION_PLAN_BASIC=Basic,priceMonthlyId,priceYearlyId,0,0,1,0
SUBSCRIPTION_PLAN_GROWTH=Growth,priceMonthlyId,priceYearlyId,0,0,2,14
SUBSCRIPTION_PLAN_SCALE=Scale,priceMonthlyId,priceYearlyId,0,0,3,0
SUBSCRIPTION_PLAN_ENTERPRISE=Enterprise,priceMonthlyId,priceYearlyId,-1,-1,4,14


# If you want to run the backup script, then you need to fill these values.
DATABASE_BACKUP_DIRECTORY=/Backups
DATABASE_BACKUP_HOST=localhost
DATABASE_BACKUP_PORT=5400
DATABASE_BACKUP_NAME=oneuptimedb
DATABASE_BACKUP_USERNAME=postgres
DATABASE_BACKUP_PASSWORD=${DATABASE_PASSWORD}


# If you want to run the restore script, then you need to fill these values. Use host.docker.internal if you want to use the host machine's IP.
DATABASE_RESTORE_HOST=host.docker.internal
DATABASE_RESTORE_DIRECTORY=/Backups
DATABASE_RESTORE_PORT=5400
DATABASE_RESTORE_NAME=oneuptimedb
DATABASE_RESTORE_USERNAME=postgres
DATABASE_RESTORE_PASSWORD=${DATABASE_PASSWORD}
DATABASE_RESTORE_FILENAME=db-31.backup

ANALYTICS_KEY=
ANALYTICS_HOST=

# Offline ad conversion uploads (Google Ads, Meta, Microsoft, LinkedIn,
# Reddit) are SaaS-only and configured through the Helm chart
# (values.yaml -> marketing.*), not through docker compose.

DATABASE_MIGRATIONS_HOST=localhost
DATABASE_MIGRATIONS_PORT=5400

# Global Probes
# This is in the format of GLOBAL_PROBE_NAME=ProbeName,ProbeDescription,ProbeKey
GLOBAL_PROBE_1_NAME="Probe-1"
GLOBAL_PROBE_1_DESCRIPTION="Global probe to monitor oneuptime resources"
GLOBAL_PROBE_1_MONITORING_WORKERS=5
GLOBAL_PROBE_1_MONITOR_FETCH_LIMIT=10
GLOBAL_PROBE_1_ONEUPTIME_URL=http://localhost
GLOBAL_PROBE_1_SYNTHETIC_MONITOR_SCRIPT_TIMEOUT_IN_MS=60000
GLOBAL_PROBE_1_CUSTOM_CODE_MONITOR_SCRIPT_TIMEOUT_IN_MS=60000
GLOBAL_PROBE_1_PORT=3874
# (Optional) If you want to use a proxy for the probe, then you can set the proxy URL here. For example, if you're using a proxy server like Caddy or Nginx, then you can set the proxy URL here.
GLOBAL_PROBE_1_PROXY_URL=

GLOBAL_PROBE_2_NAME="Probe-2"
GLOBAL_PROBE_2_DESCRIPTION="Global probe to monitor oneuptime resources"
GLOBAL_PROBE_2_MONITORING_WORKERS=5
GLOBAL_PROBE_2_MONITOR_FETCH_LIMIT=10
GLOBAL_PROBE_2_ONEUPTIME_URL=http://localhost
GLOBAL_PROBE_2_SYNTHETIC_MONITOR_SCRIPT_TIMEOUT_IN_MS=60000
GLOBAL_PROBE_2_CUSTOM_CODE_MONITOR_SCRIPT_TIMEOUT_IN_MS=60000
GLOBAL_PROBE_2_PORT=3875
# (Optional) If you want to use a proxy for the probe, then you can set the proxy URL here. For example, if you're using a proxy server like Caddy or Nginx, then you can set the proxy URL here.
GLOBAL_PROBE_2_PROXY_URL=

SMS_DEFAULT_COST_IN_CENTS=
CALL_DEFAULT_COST_IN_CENTS_PER_MINUTE=

SMS_HIGH_RISK_COST_IN_CENTS=
WHATSAPP_TEXT_DEFAULT_COST_IN_CENTS=
CALL_HIGH_RISK_COST_IN_CENTS_PER_MINUTE=

# IS BILLING ENABLED for this installer.
BILLING_ENABLED=false
# Public and private key for billing provider, usually stripe.
BILLING_PUBLIC_KEY=
BILLING_PRIVATE_KEY=
# Webhook secret for verifying Stripe webhook events (for automatic invoice emails)
# Get this from Stripe Dashboard > Developers > Webhooks > Your endpoint > Signing secret
BILLING_WEBHOOK_SECRET=

# Average telemetry row sizes in bytes used to estimate usage when reporting to the billing provider.
AVERAGE_SPAN_ROW_SIZE_IN_BYTES=1024
AVERAGE_LOG_ROW_SIZE_IN_BYTES=1024
AVERAGE_METRIC_ROW_SIZE_IN_BYTES=1024
AVERAGE_EXCEPTION_ROW_SIZE_IN_BYTES=1024

# Use this when you want to disable incident creation.
DISABLE_AUTOMATIC_INCIDENT_CREATION=false

# Use this when you want to disable incident creation.
DISABLE_AUTOMATIC_ALERT_CREATION=false

# When set to true, OneUptime will reject all incoming telemetry ingestion
# (OpenTelemetry traces / metrics / logs / profiles over HTTP and gRPC,
# Fluentd logs, Syslog logs, and Pyroscope profiles). The ingestion endpoints
# stay reachable and return success quickly so clients don't retry, but no
# data is queued or persisted.
DISABLE_TELEMETRY_INGESTION=false

# Once a day this installation asks the GitHub API which OneUptime version is
# the latest release, so admins are told when an upgrade is available. The
# request sends no usage data — GitHub sees your public IP and a User-Agent
# naming OneUptime and the version you run, as with any outbound HTTP request.
# Set to true to make no outbound call at all (air-gapped deployments can also
# leave it false — the failed request is logged and ignored).
DISABLE_UPDATE_CHECK=false

# Point the update check at an internal mirror instead of GitHub. The mirror
# must answer with GitHub's release shape (tag_name, html_url, published_at).
# Leave blank to use https://api.github.com/repos/OneUptime/oneuptime/releases/latest
LATEST_RELEASE_CHECK_URL=

# If you're using an extrenal open telemetry collector, you can set the endpoint here - both server and client endpoint can be the same in this case. 

# You can set the env var to an OTLP endpoint if you want instrumentation to be exported.
OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT=

# You can set the env var to "x-oneuptime-token=<YOUR_ONEUPTIME_TELEMETRY_INGEST_TOKEN>"
OPENTELEMETRY_EXPORTER_OTLP_HEADERS=

# This can be one of ERROR, WARN, INFO, DEBUG
LOG_LEVEL=ERROR

# Thse env vars are for E2E tests
E2E_TEST_IS_USER_REGISTERED=false
E2E_TEST_REGISTERED_USER_EMAIL=
E2E_TEST_REGISTERED_USER_PASSWORD=
# If you want to run the E2E tests on a status page, then you need to fill in the URL. 
E2E_TEST_STATUS_PAGE_URL=

# This URL will be called when the E2E tests fail. This should be a GET endpoint.
E2E_TESTS_FAILED_WEBHOOK_URL=


# This is the timeout for the workflow script in milliseconds.
# How long do we wait for "Scripts" (like Custom Code Components) running in workflow to complete.
WORKFLOW_SCRIPT_TIMEOUT_IN_MS=5000
# How long do we wait for entire workflow to complete.
WORKFLOW_TIMEOUT_IN_MS=120000


# Concurrency settings
# Max number of telemetry jobs processed concurrently by OpenTelemetry Ingest worker
TELEMETRY_CONCURRENCY=100

# Fan-in telemetry writer (per container). Batches all telemetry ClickHouse
# inserts into a handful of large INSERTs so ingestion can scale without
# exploding ClickHouse insert concurrency. Defaults shown below match the code.
# Rows buffered per table before a flush is forced.
TELEMETRY_FANIN_MAX_BATCH_ROWS=100000
# Per-table override for session replay chunks. The batcher counts rows, not
# bytes, and a replay row carries the whole decompressed rrweb payload in one
# column, so the global 100000 above would attempt a multi-hundred-MB insert.
TELEMETRY_FANIN_MAX_BATCH_ROWS_SESSION_REPLAY=2000
# Longest a buffered row waits (in ms) before its table is flushed anyway.
TELEMETRY_FANIN_MAX_WAIT_MS=5000
# Max simultaneous ClickHouse INSERTs per container. Total insert concurrency
# across all containers should stay under ~60% of ClickHouse
# max_concurrent_queries.
TELEMETRY_FANIN_MAX_CONCURRENT_INSERTS=4
# Backpressure cap: ingestion jobs block once this many rows are queued.
TELEMETRY_FANIN_MAX_PENDING_ROWS=200000
# Retry budget for failed inserts: attempts + exponential backoff bounds (ms).
TELEMETRY_FANIN_RETRY_MAX_ATTEMPTS=6
TELEMETRY_FANIN_RETRY_BASE_DELAY_MS=250
TELEMETRY_FANIN_RETRY_MAX_DELAY_MS=10000

# Ack mode for telemetry ClickHouse inserts. Default false = fire-and-forget
# async inserts: ClickHouse acks once a batch is accepted into its
# async-insert buffer and owns flushing it (flush errors surface only in
# ClickHouse server logs; a crash between accept and flush loses that
# buffer). Set true to make acks wait for the durable flush — each waiting
# insert then holds a ClickHouse query slot until its buffer flushes.
TELEMETRY_WAIT_FOR_ASYNC_INSERT=false

# Dedicated telemetry-writer tier (advanced; normally left empty in compose —
# the Helm chart wires this via telemetryWriter.enabled). When set on a
# container that processes telemetry ingest, its fan-in writer ships batched
# ClickHouse inserts to this URL (cluster-key authenticated) instead of
# inserting directly, so ingestion containers scale without adding ClickHouse
# insert concurrency. The container SERVING that URL must NOT have this set.
# Example: TELEMETRY_WRITER_URL=http://telemetry-writer:3002
TELEMETRY_WRITER_URL=
# How long a shipped insert may take end-to-end (writer batching + retries).
# Keep 6 x this + backoff under the 10-minute telemetry job lock.
TELEMETRY_WRITER_REQUEST_TIMEOUT_MS=90000
# Split shipped batches whose JSON body would exceed this many bytes (stay
# under the 50 MB internal request-body limit; oversized posts are dropped).
TELEMETRY_WRITER_MAX_BODY_BYTES=30000000
# Writer-side admission cap: concurrently-served insert requests per
# container before shedding with 429 (callers retry with the same
# idempotent dedup token).
TELEMETRY_WRITER_MAX_INFLIGHT_REQUESTS=100

# Session replay ingest.
# Instance-level kill switch for accepting session replay chunks. Independent
# of the per-project and per-application toggles: set false to stop accepting
# recordings fleet-wide without a deploy.
SESSION_REPLAY_INGEST_ENABLED=true
# Whether this deployment offers session replay at all. TRUE by default.
#
# On a self-hosted install, set this to false unless you have also set a byte
# budget below. Plan gating is a no-op when BILLING_ENABLED=false, so nothing
# else stops 100% sampling at 90-day retention on a single ClickHouse node —
# and because replay is the fattest table, the capacity pruner would then start
# dropping partitions, potentially destroying the install's logs and traces to
# make room.
SESSION_REPLAY_ENABLED_BY_DEFAULT=true
# Per-project chunk ceiling per minute, counted in Redis so it holds across
# every app pod. Exceeding it answers 429 with Retry-After.
SESSION_REPLAY_MAX_CHUNKS_PER_PROJECT_PER_MINUTE=20000
# Per-project daily byte budget (default 1 GiB). This is the disk-protection
# control that works regardless of billing. Exceeding it answers 204 and tells
# live recorders to stand down for the rest of the day.
SESSION_REPLAY_MAX_BYTES_PER_PROJECT_PER_DAY=1073741824
# Chunks at or under this size ride inline in the queue job as base64 instead
# of being staged in Redis. A typical chunk is ~7 KB, so this keeps ~99% of
# chunks out of Redis entirely — which matters because compose runs Redis with
# persistence off and no configured maxmemory.
SESSION_REPLAY_INLINE_STAGING_MAX_BYTES=65536
# Replay's share of the shared telemetry worker's concurrency slots, per pod.
# Caps a replay backlog so it cannot starve trace and log ingest.
SESSION_REPLAY_WORKER_CONCURRENCY=20
# Pinned recorder artifact the loader stub imports. Changing this one value is
# the staged-rollout and instant-rollback mechanism for the browser recorder.
SESSION_REPLAY_RECORDER_VERSION=1.0.0
# The ONE request header whose country code replay ingest is allowed to trust,
# lowercased (cf-ipcountry behind Cloudflare, x-vercel-ip-country behind
# Vercel). Empty means no country is recorded at all, which is the default:
# nothing in the Nginx config strips these headers, so honouring one on a
# deployment that is not actually behind that CDN lets any client stamp
# arbitrary countries onto session rows.
SESSION_REPLAY_TRUSTED_GEO_HEADER=

# MQTT ingest for IoT devices. Devices connect over MQTT-over-WebSocket at
# ws(s)://<your-host>/mqtt (rides the normal HTTP/HTTPS ports), or over raw
# MQTT TCP on MQTT_INGEST_PORT inside the compose network. Set
# MQTT_INGEST_ENABLED=false to turn the listeners off.
MQTT_INGEST_ENABLED=true
MQTT_INGEST_PORT=1883

# Max number of jobs processed concurrently by Fluent Logs worker
FLUENT_LOGS_CONCURRENCY=100


# Max number of jobs processed concurrently by Worker service
WORKER_CONCURRENCY=100

# Role split (advanced, mainly for Kubernetes). When true, this process does
# NOT consume BullMQ queues — it only serves the API + ingest endpoints and
# enqueues jobs. A separate "worker" deployment (with DISABLE_QUEUE_WORKERS
# unset/false) then drains the queues, so heavy telemetry/background processing
# can't stall API requests. Default false: this process both serves the API and
# processes all background + telemetry jobs (single-container behavior).
DISABLE_QUEUE_WORKERS=false



# Lets encrypt notification email. This email will be used when certs are about to expire
LETS_ENCRYPT_NOTIFICATION_EMAIL=
# Generate a private key via openssl, encode it to base64 and paste it here.
# Example: "LS0tLS....1cbg=="
LETS_ENCRYPT_ACCOUNT_KEY=

# This is the number of active monitors allowed in the free plan.
ALLOWED_ACTIVE_MONITOR_COUNT_IN_FREE_PLAN=10

# Open Source Deployment Webhook
# This webhook is called when a new self-hosted open source deployment registers.
OPEN_SOURCE_DEPLOYMENT_WEBHOOK_URL=

# Notifications Webhook (Slack)

# This webhook notifies slack when the new user signs up or is created.
NOTIFICATION_SLACK_WEBHOOK_ON_CREATED_USER=
# This webhook notifies slack when the new project is created.
NOTIFICATION_SLACK_WEBHOOK_ON_CREATED_PROJECT=
# This webhook notifies slack when the project is deleted.
NOTIFICATION_SLACK_WEBHOOK_ON_DELETED_PROJECT=
# This webhook notifies slack when the subscription is updated.
NOTIFICATION_SLACK_WEBHOOK_ON_SUBSCRIPTION_UPDATE=

# VAPID keys for Web Push Notifications
# Generate using: npx web-push generate-vapid-keys
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=
VAPID_SUBJECT=mailto:support@oneuptime.com

# Expo access token for sending mobile push notifications directly via Expo SDK.
# If not set, push notifications are relayed through the push notification relay URL below.
EXPO_ACCESS_TOKEN=

# Push notification relay URL for self-hosted instances without Expo credentials.
# Self-hosted servers relay push notifications through this gateway.
PUSH_NOTIFICATION_RELAY_URL=https://oneuptime.com/api/notification/push-relay/send

# AI Agent Configuration
ONEUPTIME_RUNNER_KEY=please-change-this-to-random-value
ONEUPTIME_RUNNER_ONEUPTIME_URL=http://localhost
ONEUPTIME_RUNNER_PORT=3876

# By default telemetry is disabled for all services in docker compose. If you want to enable telemetry for a service, then set the env var to false.
DISABLE_TELEMETRY_FOR_APP=true
DISABLE_TELEMETRY_FOR_TEST_SERVER=true
DISABLE_TELEMETRY_FOR_PROBE=true
DISABLE_TELEMETRY_FOR_INGRESS=true
DISABLE_TELEMETRY_FOR_RUNNER=true

# By default profiling is disabled for all services. Set to true to enable CPU profiling for a service.
ENABLE_PROFILING_FOR_APP=false
ENABLE_PROFILING_FOR_TEST_SERVER=false
ENABLE_PROFILING_FOR_PROBE=false
ENABLE_PROFILING_FOR_RUNNER=false


# Connect OneUptime with Slack App
SLACK_APP_CLIENT_ID=
SLACK_APP_CLIENT_SECRET=
SLACK_APP_SIGNING_SECRET=

# Example - 
# IPv6 only:
# NGINX_LISTEN_ADDRESS=[::]:
# NGINX_LISTEN_OPTIONS=

# dual stack:
# NGINX_LISTEN_ADDRESS=[::]:
# NGINX_LISTEN_OPTIONS=ipv6only=off
NGINX_LISTEN_ADDRESS=
NGINX_LISTEN_OPTIONS=



# Microsoft Teams / Azure AD App Configuration
# IMPORTANT: Use the SECRET VALUE, not the SECRET ID from Azure App Registration
# The secret value is typically longer and includes more characters
MICROSOFT_TEAMS_APP_CLIENT_ID=
MICROSOFT_TEAMS_APP_CLIENT_SECRET=
MICROSOFT_TEAMS_APP_TENANT_ID=

# GitHub App Configuration
# Create a GitHub App at https://github.com/settings/apps
# Required for connecting GitHub repositories to OneUptime
#
# The GitHub App must have "Request user authorization (OAuth) during
# installation" enabled. OneUptime exchanges the OAuth code GitHub returns to
# confirm the person installing the app actually controls the installation
# before connecting it to their project; without it, connecting is refused.
# CLIENT_ID and CLIENT_SECRET are required for that exchange.
#
# GITHUB_APP_WEBHOOK_SECRET is also required: webhooks whose signature cannot
# be verified are rejected rather than trusted.
# See: https://oneuptime.com/docs/self-hosted/github-integration
GITHUB_APP_ID=
GITHUB_APP_NAME=
GITHUB_APP_CLIENT_ID=
GITHUB_APP_CLIENT_SECRET=
GITHUB_APP_PRIVATE_KEY=
GITHUB_APP_WEBHOOK_SECRET=

# Inbound Email Configuration
# Required for Incoming Email Monitor feature
# See documentation: https://oneuptime.com/docs/self-hosted/sendgrid-inbound-email
INBOUND_EMAIL_PROVIDER=SendGrid
# The domain configured for inbound email (e.g., inbound.yourdomain.com)
INBOUND_EMAIL_DOMAIN=
# Optional webhook secret for validating incoming webhooks
INBOUND_EMAIL_WEBHOOK_SECRET=

# BullMQ Queue Dashboard (Bull Board)
# When enabled, exposes the queue inspector UI at /worker/inspect/queue/<QUEUE_DASHBOARD_SECRET>.
# Both must be set for the dashboard to be mounted. The secret acts as the URL path segment that
# operators must know to reach the UI.
ENABLE_QUEUE_DASHBOARD=false
QUEUE_DASHBOARD_SECRET=

# Global LLM Provider (optional)
# Declaratively registers a Global LLM Provider at startup so AI features work
# for all projects without dashboard setup — including AI Agent fix tasks on
# self-hosted instances. Set GLOBAL_LLM_PROVIDER_TYPE to enable (one of:
# OpenAI, AzureOpenAI, Anthropic, Groq, Mistral, Ollama, OpenAICompatible);
# unset it to remove the seeded provider on the next restart.
# An API key is required for OpenAI, AzureOpenAI, Anthropic, Groq and Mistral.
# Ollama and OpenAICompatible (vLLM, LocalAI, LM Studio, etc.) are keyless and
# need GLOBAL_LLM_PROVIDER_BASE_URL instead; OpenAICompatible also requires
# GLOBAL_LLM_PROVIDER_MODEL_NAME.
GLOBAL_LLM_PROVIDER_TYPE=
GLOBAL_LLM_PROVIDER_NAME=
GLOBAL_LLM_PROVIDER_DESCRIPTION=
# e.g. http://localhost:11434 for Ollama, or http://my-vllm:8000/v1 for vLLM
GLOBAL_LLM_PROVIDER_BASE_URL=
GLOBAL_LLM_PROVIDER_MODEL_NAME=
GLOBAL_LLM_PROVIDER_API_KEY=