sure/.env.test.example at main · we-promise/sure · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
# To enable / disable self-hosting features.
SELF_HOSTED=false

# Custom port config
# For users who have other applications listening at 3000, this allows them to set a value puma will listen to.
PORT=3000

# SimpleFIN runtime flags (default-off)
# Accepted truthy values: 1, true, yes, on
# SIMPLEFIN_DEBUG_RAW: when truthy, logs the raw payload returned by SimpleFIN (debug-only; can be noisy)
SIMPLEFIN_DEBUG_RAW=false
# SIMPLEFIN_INCLUDE_PENDING: when truthy, forces `pending=1` on SimpleFIN fetches when caller doesn't specify `pending:`
SIMPLEFIN_INCLUDE_PENDING=false

# SnapTrade OAuth app (register one at https://dashboard.snaptrade.com).
# The client ID on its own enables the device code flow: users confirm a short
# code on SnapTrade, no redirect URI needed.
SNAPTRADE_OAUTH_CLIENT_ID=
# Only needed for the browser redirect flow (authorization code + PKCE), which
# also requires https://<your-host>/snaptrade_items/oauth_callback to be
# registered as a redirect URI on the OAuth app.
SNAPTRADE_OAUTH_CLIENT_SECRET=

# Lunchflow runtime flags (default-off)
# LUNCHFLOW_DEBUG_RAW: when truthy, logs the raw payload returned by Lunchflow (debug-only; can be noisy)
LUNCHFLOW_DEBUG_RAW=false
# LUNCHFLOW_INCLUDE_PENDING: when truthy, adds `include_pending=true` to Lunchflow transaction fetch requests
LUNCHFLOW_INCLUDE_PENDING=false

# Controls onboarding flow (valid: open, closed, invite_only)
ONBOARDING_STATE=open

# Enable Twelve market data (careful, this will use your API credits)
TWELVE_DATA_API_KEY =

# OpenAI-compatible API endpoint config
OPENAI_ACCESS_TOKEN =
OPENAI_URI_BASE =
OPENAI_MODEL =

# LLM token budget. Applies to ALL outbound LLM calls: chat history,
# auto-categorize, merchant detection, provider enhancer, PDF processing.
# Defaults to Ollama's historical 2048-token baseline so small local models
# work out of the box — raise explicitly for cloud or larger-context models.
# LLM_CONTEXT_WINDOW = 2048          # Total tokens the model will accept
# LLM_MAX_RESPONSE_TOKENS = 512      # Reserved for the model's reply
# LLM_MAX_HISTORY_TOKENS =           # Derived if unset (context - response - system_reserve)
# LLM_SYSTEM_PROMPT_RESERVE = 256    # Tokens reserved for the system prompt
# LLM_MAX_ITEMS_PER_CALL = 25        # Upper bound on auto-categorize / merchant batches

# OpenAI-compatible capability flags (custom/self-hosted providers)
# OPENAI_REQUEST_TIMEOUT = 60                # HTTP timeout in seconds; raise for slow local models
# OPENAI_EXTRA_HEADERS = '{"x-opencode-session":"{session_id}"}'  # Extra JSON headers for chat requests; value containing {session_id} becomes the chat UUID
# AI_RESPONSE_TIMEOUT = 90                   # Whole-turn budget: (1 + iterations) * OPENAI_REQUEST_TIMEOUT + tool time + queue wait
# ASSISTANT_MAX_TOOL_CALL_ITERATIONS = 5     # Chained tool calls per turn; a turn costs up to (1 + this) model calls
# OPENAI_SUPPORTS_PDF_PROCESSING = true      # Set to false for endpoints without vision support
# OPENAI_SUPPORTS_RESPONSES_ENDPOINT =       # true to force Responses API on custom providers
# LLM_JSON_MODE =                            # auto | strict | json_object | none

# Document-search vector store. Local OpenAI-compatible chat endpoints usually
# do not implement OpenAI's hosted /v1/vector_stores API, so use pgvector and a
# separate embeddings endpoint when testing local AI.
# VECTOR_STORE_PROVIDER = pgvector
# EMBEDDING_URI_BASE = http://host.docker.internal:11434/v1
# EMBEDDING_MODEL = mxbai-embed-large
# EMBEDDING_DIMENSIONS = 1024                # Must match the embedding model
# EMBEDDING_ACCESS_TOKEN =                   # Optional; falls back to OPENAI_ACCESS_TOKEN
# AI_HEALTH_PROBE_TIMEOUT = 5                # Per-request timeout for admin live checks
# AI_HEALTH_PROBE_CACHE_TTL = 60             # Cache live results and deduplicate failure logs

# (example: LM Studio/Docker config) OpenAI-compatible API endpoint config
# OPENAI_URI_BASE = http://host.docker.internal:1234/
# OPENAI_MODEL = qwen/qwen3-vl-4b

# OpenID Connect for development
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_ISSUER=
OIDC_REDIRECT_URI=http://localhost:3000/auth/openid_connect/callback

# WebAuthn / passkey MFA test defaults
# RP ID must match the domain where credentials are registered.
WEBAUTHN_RP_ID=www.example.com
WEBAUTHN_ALLOWED_ORIGINS=http://www.example.com

# Langfuse config
LANGFUSE_PUBLIC_KEY =
LANGFUSE_SECRET_KEY =
LANGFUSE_HOST = https://cloud.langfuse.com

# Set to `true` to get error messages rendered in the /chats UI
AI_DEBUG_MODE =

# Apple Push Notification service (AI insight notifications)
# APNS_PRIVATE_KEY_BASE64 is the base64-encoded contents of the Apple .p8 key.
APNS_KEY_ID=
APNS_TEAM_ID=
APNS_BUNDLE_ID=
APNS_PRIVATE_KEY_BASE64=

# =============================================================================
# SSL/TLS Configuration for Self-Signed Certificates
# =============================================================================
# Use these settings when connecting to services with self-signed or internal
# CA certificates (e.g., self-hosted Keycloak, Authentik, or AI endpoints).
#
# SSL_CA_FILE: Path to custom CA certificate file (PEM format)
#   - The certificate that signed your server's SSL certificate
#   - Must be readable by the application
#   - Will be validated at startup
# SSL_CA_FILE = /certs/my-ca.crt
#
# SSL_VERIFY: Enable/disable SSL certificate verification
#   - Default: true (verification enabled)
#   - Set to "false" ONLY for development/testing
#   - WARNING: Disabling removes protection against man-in-the-middle attacks
# SSL_VERIFY = true
#
# SSL_DEBUG: Enable verbose SSL logging for troubleshooting
#   - Default: false
#   - When enabled, logs detailed SSL connection information
#   - Useful for diagnosing certificate issues
# SSL_DEBUG = false
#
# Example docker-compose.yml configuration:
#   services:
#     app:
#       environment:
#         SSL_CA_FILE: /certs/my-ca.crt
#         SSL_DEBUG: "true"
#       volumes:
#         - ./my-ca.crt:/certs/my-ca.crt:ro

# Active Storage Configuration
# ACTIVE_STORAGE_SERVICE=google
# GCS_PROJECT=
# GCS_BUCKET=
# GCS_KEYFILE_JSON=
# GCS_KEYFILE=

# Skylight
# ========
SKYLIGHT_AUTHENTICATION=
SKYLIGHT_ENABLED=

# PostHog
# ========
# Managed app/demo only: API survey in the existing PostHog project.
# Self-hosted previews use bundled public configuration and need no keys.
# See docs/hosting/preview-feedback.md.
# POSTHOG_SANKEY_SURVEY_ID=
#
# Optional self-hosted opt-out (enabled by default, preview users only).
# POSTHOG_FEEDBACK_ENABLED=false
#
# Temporary local PostHog testing only; off by default. Restart after changing.
# Uses live projects and sends real survey responses.
# POSTHOG_DEVELOPMENT_ENABLED=true


# ================
# Data Providers
# ---------------------------------------------------------------------------------
# Uncomment and fill in live keys when you need to generate a VCR cassette fixture
# ================


# ================
# Miscellaneous
# ================

# Set to true if you want SimpleCov reports generated
COVERAGE=false

# Set to true to run test suite serially
DISABLE_PARALLELIZATION=false