cesnimda
19c5251612
Run untrusted document decoders in a secret-free, resource-bounded child process and terminate its process tree on deadline. Harden the production container and enforce parser and lint gates in CI.
112 lines
4.9 KiB
Bash
112 lines
4.9 KiB
Bash
# Copy this file to `.env` (same folder as docker-compose.yml) and fill in values.
|
|
#
|
|
# Used by docker-compose.yml
|
|
#
|
|
# Database. deploy/deploy.sh REQUIRES DATABASE_PROVIDER to be set explicitly and
|
|
# refuses to deploy without it — it selects which backup to take, and guessing it
|
|
# wrong means backing up the wrong database. Use `mariadb` (or `mysql`) for a
|
|
# server deployment, `sqlite` for a single-file local one.
|
|
DATABASE_PROVIDER=sqlite
|
|
# Required when DATABASE_PROVIDER is mariadb/mysql. Ignored for sqlite, which
|
|
# stores its file in the jobtracker_data volume.
|
|
# The host resolves from INSIDE the backend container: 127.0.0.1 means the
|
|
# container, not the Docker host.
|
|
JOBTRACKER_CONNECTION_STRING=
|
|
|
|
AUTH_JWT_KEY=CHANGE_ME_LONG_RANDOM_SECRET
|
|
AUTH_ADMIN_EMAIL=admin@example.com
|
|
AUTH_ADMIN_PASSWORD=CHANGE_ME_STRONG_PASSWORD
|
|
# Public signup remains closed until explicitly enabled. Configure both Turnstile keys first.
|
|
AUTH_ALLOW_REGISTRATION=false
|
|
# Require local accounts to confirm ownership of their email address before signing in.
|
|
AUTH_REQUIRE_EMAIL_VERIFICATION=true
|
|
# Destructive account deletion stays dark-launched until the retention and restore runbook is
|
|
# approved and rehearsed. The tombstone path is mounted separately by docker-compose.yml.
|
|
ACCOUNT_DELETION_ENABLED=false
|
|
TURNSTILE_SITE_KEY=
|
|
TURNSTILE_SECRET_KEY=
|
|
# Optional hosted Stripe Checkout. Configure all three values and the customer portal before enabling billing.
|
|
STRIPE_SECRET_KEY=
|
|
STRIPE_PRICE_PREMIUM=
|
|
STRIPE_WEBHOOK_SECRET=
|
|
AUTH_GOOGLE_CLIENT_ID=CHANGE_ME_GOOGLE_CLIENT_ID
|
|
# Optional: enables the "Continue with Microsoft" sign-in tab (separate from the
|
|
# MICROSOFT_CLIENT_ID below, which is for Outlook mail linking, not sign-in).
|
|
AUTH_MICROSOFT_CLIENT_ID=
|
|
# Microsoft application sign-in tenant policy: tenant GUID, organizations, consumers, or common.
|
|
# This is separate from MICROSOFT_TENANT_ID, which configures Graph mailbox OAuth.
|
|
AUTH_MICROSOFT_TENANT=common
|
|
GOOGLE_GMAIL_CLIENT_SECRET=CHANGE_ME_GOOGLE_OAUTH_CLIENT_SECRET
|
|
# Optional. If omitted, the backend uses https://<your-domain>/api/gmail/oauth/callback
|
|
MICROSOFT_CLIENT_ID=CHANGE_ME_MICROSOFT_CLIENT_ID
|
|
MICROSOFT_CLIENT_SECRET=CHANGE_ME_MICROSOFT_OAUTH_CLIENT_SECRET
|
|
# Optional. Defaults to "common" (personal + work/school accounts).
|
|
MICROSOFT_TENANT_ID=
|
|
# Optional. If omitted, the backend uses https://<your-domain>/api/microsoft-graph/oauth/callback
|
|
AI_SERVICE_BASE_URL=http://ai-service:8001
|
|
# REQUIRED. Shared secret the backend sends to ai-service on every call except /health.
|
|
# The stack refuses to start without it. Generate with: openssl rand -hex 32
|
|
AI_SERVICE_TOKEN=
|
|
# Optional: enables hybrid CV block classification in the local AI service.
|
|
OLLAMA_BASE_URL=http://ollama:11434
|
|
OLLAMA_MODEL=qwen2.5:7b
|
|
|
|
# Optional external fallback provider for heavy /cv/* calls: ollama (none) | gemini | groq.
|
|
# Local Ollama is always attempted first unless the explicitly configured mode is
|
|
# external_only. External processing still requires the administrator gate, an
|
|
# allowed task, and the authenticated Pro user's opt-in. /summarize stays local.
|
|
# Keys are read from the environment only — never commit real keys.
|
|
AI_PROVIDER=ollama
|
|
EXTERNAL_AI_ENABLED=false
|
|
AI_ROUTING_MODE=local_first
|
|
EXTERNAL_AI_ALLOWED_TASKS=cv-normalize,cv-classify,cv-rewrite
|
|
# Per-request cost/privacy ceiling. Requests above this size remain local even after local failure.
|
|
EXTERNAL_AI_MAX_PROMPT_CHARS=24000
|
|
LOCAL_AI_CIRCUIT_FAILURE_THRESHOLD=3
|
|
LOCAL_AI_CIRCUIT_OPEN_SECONDS=30
|
|
# Isolated CV document decoder budgets. Increase only after benign-file measurement.
|
|
PARSER_TIMEOUT_SECONDS=25
|
|
PARSER_CPU_SECONDS=20
|
|
PARSER_MEMORY_MIB=512
|
|
PARSER_STALE_WORK_SECONDS=3600
|
|
GEMINI_API_KEY=
|
|
GEMINI_MODEL=gemini-2.0-flash
|
|
GROQ_API_KEY=
|
|
GROQ_MODEL=llama-3.3-70b-versatile
|
|
|
|
# Durable AI operation worker. Keep false until handlers, monitoring and rollout gates are verified.
|
|
WORKER_AI_OPERATIONS_ENABLED=false
|
|
AI_QUEUE_WORKER_CONCURRENCY=1
|
|
AI_QUEUE_GLOBAL_CAPACITY=100
|
|
AI_QUEUE_PER_USER_CAPACITY=10
|
|
AI_QUEUE_DEADLINE_MINUTES=15
|
|
AI_QUEUE_OPERATION_TIMEOUT_SECONDS=300
|
|
|
|
# Optional: only needed if you want the UI to call a non-default API base URL.
|
|
# In production the UI defaults to `/api`.
|
|
NEXT_PUBLIC_API_BASE_URL=
|
|
|
|
# Used by docker-compose.yml (email / password resets / notifications)
|
|
APP_PUBLIC_BASE_URL=https://jobs.cesnimda.uk
|
|
# Dedicated nginx-to-backend network. Confirm this CIDR does not overlap existing Docker networks.
|
|
WEB_PROXY_SUBNET=172.31.250.0/29
|
|
APP_VERSION=
|
|
APP_COMMIT_SHA=
|
|
APP_BUILD_STAMP=
|
|
EMAIL_ENABLED=false
|
|
EMAIL_SMTP_HOST=smtp.gmail.com
|
|
EMAIL_SMTP_PORT=587
|
|
EMAIL_SMTP_USER=CHANGE_ME_GMAIL_ADDRESS
|
|
EMAIL_SMTP_PASSWORD=CHANGE_ME_GOOGLE_APP_PASSWORD
|
|
EMAIL_FROM=CHANGE_ME_GMAIL_ADDRESS
|
|
EMAIL_FROM_NAME=Jobbjakt
|
|
EMAIL_FOLLOWUPREMINDERS_ENABLED=false
|
|
EMAIL_FOLLOWUPREMINDERS_UPCOMINGDAYS=2
|
|
WORKER_RULES_ENABLED=false
|
|
WORKER_FOLLOWUP_REMINDERS_ENABLED=false
|
|
WORKER_DAILY_EXPORT_ENABLED=false
|
|
WORKER_JOB_ENRICHMENT_ENABLED=false
|
|
|
|
EMAIL_SMTP_ENABLE_SSL=true
|
|
EMAIL_SMTP_TIMEOUT_MS=15000
|