parththakkar106andClaude Opus 5
b1772c6e21
Phase 17 splits the four files that hold most of the code, finishes the schema migration SP8 left half done, and stops the published guide from drifting away from its Markdown source. `plan/17-refactor.md` carries the plan and the progress table, and `plan/STATUS.md` points at it. Stage 0 is hygiene only. Both abandoned worktrees are gone, which freed about 104 MB. Removing `sp7-tree-ui` needed one extra step: a Vite dev server had been running out of it since 2026-08-18, holding `frontend/.vite` open and owning port 5173, and serving a tree 54 commits behind `main`. The three stale `.db` files are deleted; `data.db` is not. `AIDND_TRUSTED_PROXY_HOPS` is now documented. It was read at `limits.py:55` and named in no `.env.example`, README, or blueprint. It sets how many proxy hops the rate limiter trusts in `X-Forwarded-For`, so a deployment that adds a hop without setting it gets the bucket-rotation bypass back. The 19 squash-landed branches are still there. `git branch -D` is blocked by the permission classifier; the verified command is in the plan file. 549 tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014Dix4oGV3njgWRdu7P9t6r
111 lines
5.8 KiB
Bash
111 lines
5.8 KiB
Bash
# Environment variables read by the backend.
|
|
#
|
|
# NOTE: the app reads real environment variables — it does NOT auto-load this
|
|
# file. Set them in your shell, in docker-compose.yml, or in your host's
|
|
# dashboard. This file is documentation (and a template for deploy configs).
|
|
|
|
# Absolute path for the SQLite database file. Parent directory is created if
|
|
# missing. Default when unset: backend/data.db
|
|
# Docker compose sets this to /data/data.db (a named volume).
|
|
AIDND_DB_PATH=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Phase 9 — production hardening
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Switch from SQLite to a server database (hosted deploys use Neon Postgres).
|
|
# Any SQLAlchemy URL; postgres:// and postgresql:// schemes are rewritten to
|
|
# the psycopg3 driver automatically. The platform-conventional DATABASE_URL
|
|
# is honored too (AIDND_DATABASE_URL wins if both are set). Unset = SQLite.
|
|
AIDND_DATABASE_URL=
|
|
|
|
# Comma-separated list of allowed CORS origins. Only needed when the frontend
|
|
# is served from a different origin than the API; the production build is
|
|
# served same-origin by FastAPI, so hosted deploys can leave this unset.
|
|
# Default: http://localhost:5173,http://127.0.0.1:5173 (the Vite dev server).
|
|
AIDND_CORS_ORIGINS=
|
|
|
|
# How many proxy hops the rate limiter trusts in `X-Forwarded-For`. It reads
|
|
# the entry that many places from the right, because the trusted edge appends
|
|
# the real client IP last. Set this to the number of proxies in front of the
|
|
# app. Default: 1, which is correct for a single edge such as Render.
|
|
#
|
|
# Get it wrong in either direction and the rate limits weaken. Too low reads an
|
|
# entry the caller supplied, so anyone can rotate the header for a fresh
|
|
# rate-limit bucket per request and walk past the auth and guest limits. Too
|
|
# high reads past the real client. Only multi-user mode rate-limits at all, so
|
|
# local installs can ignore this.
|
|
AIDND_TRUSTED_PROXY_HOPS=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Phase 8 — optional accounts & multi-user (all optional; defaults keep the
|
|
# app in frictionless single-user "local mode")
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# "1"/"true" turns on multi-user mode: guest sessions via signed cookies,
|
|
# register/login UI, per-user data. Leave unset for local installs.
|
|
AIDND_MULTI_USER=
|
|
|
|
# Secret for signing session cookies and encrypting stored API keys at rest.
|
|
# If unset in local mode, one is auto-generated into `secret.key` next to the
|
|
# database (fine for local/docker-volume runs). REQUIRED when
|
|
# AIDND_MULTI_USER is on — the app refuses to start without it, because a
|
|
# regenerated secret on an ephemeral hosted filesystem would log out every
|
|
# user on each deploy. Generate one:
|
|
# python -c "import secrets; print(secrets.token_urlsafe(48))"
|
|
AIDND_SECRET_KEY=
|
|
|
|
# Session cookie Secure flag (HTTPS-only). Defaults to on when
|
|
# AIDND_MULTI_USER is on, off otherwise — set 0/1 only to override (e.g. 0
|
|
# when testing multi-user mode over plain http on a LAN address).
|
|
AIDND_COOKIE_SECURE=
|
|
|
|
# --- Shared demo key (BYOK fallback; only active when AIDND_MULTI_USER=1) ---
|
|
# Users with no API key of their own get this server-funded endpoint with a
|
|
# model whitelist and a per-day turn cap. Unset = no demo, users must bring
|
|
# their own key. Memory bank/auto-summarization are disabled on demo turns.
|
|
AIDND_DEMO_API_KEY=
|
|
# Default endpoint if unset: https://openrouter.ai/api/v1
|
|
AIDND_DEMO_ENDPOINT_URL=
|
|
# Comma-separated model whitelist. Default: google/gemma-4-26b-a4b-it:free
|
|
AIDND_DEMO_MODELS=
|
|
# Successful AI turns per user per day on the demo key. Default: 20
|
|
AIDND_DEMO_TURNS_PER_DAY=
|
|
# Comma-separated emails of "power users" (trusted testers) who bypass the daily
|
|
# demo cap entirely — unmetered turns on the shared demo key — and get the AI Chat
|
|
# page (a plain scratchpad for talking to a model, hidden from everyone else).
|
|
# Registered accounts only (guests have no email). Matched case-insensitively.
|
|
# Local (single-user) installs are always treated as power users.
|
|
AIDND_POWER_USERS=
|
|
|
|
# --- Visit analytics ---
|
|
# Comma-separated emails allowed to see the Visitors dashboard (/analytics) and
|
|
# its nav link. Deliberately separate from AIDND_POWER_USERS: a trusted tester
|
|
# gets unmetered turns, which is no reason to hand them the traffic numbers.
|
|
# Unset = nobody sees it in a hosted deploy. Local installs always can, and are
|
|
# the only mode where the viewer's own visits are still counted (excluding them
|
|
# would leave the page permanently empty on the machine it's developed on).
|
|
# Collection itself is always on; only the dashboard is gated.
|
|
AIDND_ANALYTICS_EMAILS=
|
|
# Days to keep the one-row-per-visitor-per-day table that makes the funnel
|
|
# count people rather than clicks. The daily counters are aggregate and kept
|
|
# forever. Default: 400. Set 0 to keep visitor-days forever.
|
|
AIDND_ANALYTICS_RETENTION_DAYS=
|
|
|
|
# --- Guest retention (only active when AIDND_MULTI_USER=1) ---
|
|
# Every first visit mints a guest account, so a public demo collects one row
|
|
# per visitor. A guest with no activity for this many days is deleted along
|
|
# with its scenarios, adventures and actions. Registered accounts are never
|
|
# touched. Default: 5. Set 0 to keep guests forever.
|
|
AIDND_GUEST_RETENTION_DAYS=
|
|
# How often a running process re-checks. The sweep also runs once at startup,
|
|
# which is what actually fires on hosts that sleep. Default: 6
|
|
AIDND_CLEANUP_INTERVAL_HOURS=
|
|
|
|
# The AI endpoint/API key/model are NOT env vars — they are configured at
|
|
# runtime in the app's Settings page and stored (encrypted) in the database.
|
|
#
|
|
# Rate limits, request size limits, and per-user row caps are hardcoded with
|
|
# generous values (see backend/app/limits.py) and active only in multi-user
|
|
# mode — local installs are never throttled.
|