m4
c8e8305107
Matches the backend split: usage attribution no longer shares EVOSCIENTIST_DEPLOYMENT_ID with workspace scope partitioning. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
78 lines
4.2 KiB
Bash
78 lines
4.2 KiB
Bash
# Set to true to require the single-user login screen for every page and API.
|
|
WEBUI_AUTH_ENABLED=true
|
|
|
|
# These values are read only on the server. Keep .env private and never commit it.
|
|
WEBUI_AUTH_USERNAME=admin
|
|
WEBUI_AUTH_PASSWORD=replace-with-a-long-unique-password
|
|
|
|
# Generate with: openssl rand -hex 32
|
|
WEBUI_AUTH_SECRET=replace-with-at-least-32-random-characters
|
|
|
|
# Optional. Defaults to 12 hours.
|
|
WEBUI_AUTH_SESSION_TTL_HOURS=12
|
|
|
|
# Provider editor. Integrated `EvoSci` WebUI mode sets these automatically.
|
|
# For a standalone or remote WebUI, point at the trusted EvoScientist backend
|
|
# and use the same random token configured on that backend.
|
|
EVOSCIENTIST_BACKEND_URL=http://127.0.0.1:6174
|
|
# Deployment workspace root. This is not a browser-selectable directory and is
|
|
# shared with the trusted EvoScientist backend. Defaults to ~/.evoscientist/workspace.
|
|
EVOSCIENTIST_WORKSPACE_DIR=
|
|
# Deployment id, matching the backend's EVOSCIENTIST_DEPLOYMENT_ID. Only needed
|
|
# when the backend was started manually (no deploy sidecar); otherwise the
|
|
# sidecar value wins. Defaults to a uuid derived from the workspace root.
|
|
EVOSCIENTIST_DEPLOYMENT_ID=
|
|
# Usage-attribution deployment id, matching the backend's
|
|
# EVOSCIENTIST_USAGE_DEPLOYMENT_ID (stored in <data-dir>/deployment-id). This is
|
|
# intentionally separate from the scope deployment id above so the usage
|
|
# identity cannot repartition workspace scopes.
|
|
EVOSCIENTIST_USAGE_DEPLOYMENT_ID=
|
|
# Optional for local processes running as the same OS user: both sides share
|
|
# ~/.config/evoscientist/provider-admin-token automatically. Set this explicitly
|
|
# when the WebUI and backend run on different hosts, users, or containers.
|
|
EVOSCIENTIST_PROVIDER_ADMIN_TOKEN=
|
|
|
|
# Conversation workspace policy. This value must match the trusted backend and
|
|
# is read by the BFF only; never expose it as a browser-provided path or scope.
|
|
#
|
|
# - legacy: every WebUI conversation uses the deployment root. It is an explicit
|
|
# compatibility rollback and shared files are visible across conversations.
|
|
# - optional: default. Each new conversation receives an isolated scope folder;
|
|
# a missing Registry, token, or scope rejects the operation rather than falling
|
|
# back to the shared root.
|
|
# - required: isolated scopes plus strict server-side validation. Shared legacy
|
|
# workspaces are unavailable; backend startup also requires cutover and its
|
|
# pinned OCI executor configuration.
|
|
#
|
|
# Change this deployment-level setting only in a maintenance window, restart
|
|
# both backend and WebUI, and do not use it to move an existing conversation.
|
|
# For a same-host standalone WebUI, the BFF reads the server-only token from
|
|
# <workspace>/.evoscientist/control automatically. Set the token below only
|
|
# when the WebUI and trusted backend cannot share that control-plane directory;
|
|
# it is never exposed to the browser.
|
|
EVOSCIENTIST_WORKSPACE_ISOLATION=optional
|
|
EVOSCIENTIST_BACKEND_SERVICE_TOKEN=
|
|
# Required mode is validated by the backend and must use an immutable image
|
|
# digest, never a mutable tag. Keep this aligned with the backend .env.
|
|
EVOSCIENTIST_STRICT_EXECUTOR_IMAGE=registry.example/evoscientist-runtime@sha256:replace-with-verified-digest
|
|
|
|
# Token statistics for a local `EvoSci deploy` need no explicit secret here:
|
|
# both processes dynamically share <data-dir>/usage-sink-token. Set the same
|
|
# absolute data directory on both sides only when overriding the default.
|
|
EVOSCIENTIST_DATA_DIR=
|
|
|
|
# Office document preview. DOCX and supported Excel Open XML files render in
|
|
# the browser. Other Office formats, and DOCX rendering failures, convert to a
|
|
# private PDF cache. Leave enabled to auto-detect `soffice`; set to false to
|
|
# keep browser-side DOCX and SpreadJS Excel previews only.
|
|
# In production, point COMMAND to a sandboxed, no-network converter wrapper.
|
|
EVOSCIENTIST_OFFICE_PREVIEW_ENABLED=true
|
|
EVOSCIENTIST_OFFICE_PREVIEW_COMMAND=soffice
|
|
# Concurrent conversions per WebUI process (1-8; default 2).
|
|
EVOSCIENTIST_OFFICE_PREVIEW_CONCURRENCY=2
|
|
|
|
# SpreadJS renders supported Excel files in the browser. The key is delivered
|
|
# to the browser by design, so use only a web deployment license. Omit it for
|
|
# local evaluation; production deployments must provide a valid license.
|
|
NEXT_PUBLIC_SPREADJS_LICENSE_KEY=
|