.env.example

# PostgreSQL
POSTGRES_USER=agent
POSTGRES_PASSWORD=postgres
POSTGRES_DB=agent

# Backend
RK_DATABASE_URL=postgresql+asyncpg://agent:postgres@db:5432/agent
RK_JWT_SECRET=change-me-generate-with-openssl-rand-hex-32
RK_JWT_ALGORITHM=HS256
RK_JWT_EXPIRE_MINUTES=1440
# Required in production. The dashboard can derive a local-only fallback from
# RK_JWT_SECRET during Next.js development when this value is missing or invalid.
RK_ENCRYPTION_KEY=change-me-generate-with-python-fernet
RK_CHAT_CAPABILITY_SECRET=change-me-generate-with-openssl-rand-hex-32
RK_SDK_CLIENT_TOKEN_SECRET=change-me-generate-with-openssl-rand-hex-32
RK_SDK_CLIENT_TOKEN_TTL_SECONDS=900
RK_SDK_CLIENT_TOKEN_RATE_LIMIT_PER_MINUTE=60
RK_CORS_ORIGINS=["http://localhost:3000","http://localhost:3002","http://localhost:5173"]
RK_CORS_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:3002
RK_DEBUG=false
RK_ALLOW_LEGACY_WS_API_KEY=true
RK_REDIS_URL=redis://redis:6379/0
RK_WS_OWNER_TTL_SECONDS=120
RK_WS_OUTBOX_TTL_SECONDS=300
RK_WS_TOOL_RESULT_TTL_SECONDS=300
RK_KNOWLEDGE_BASES_BASE_URL=http://kb-service:8100
RK_KNOWLEDGE_BASES_SIGNING_KEY=change-me-kb-service-signing-key
RK_KNOWLEDGE_BASES_AUDIENCE=kb-service
RK_KNOWLEDGE_BASES_JWT_ALGORITHM=HS256
RK_KNOWLEDGE_BASES_TIMEOUT_SECONDS=20
RK_KNOWLEDGE_BASES_CONNECT_TIMEOUT_SECONDS=5

# Frontend
NEXT_PUBLIC_API_BASE_URL=http://localhost:3002
NEXT_PUBLIC_DASHBOARD_URL=http://localhost:3000
NEXT_PUBLIC_IOS_SDK_REPO_URL=https://github.com/your-org/resolvekit-ios-sdk
# Optional server-side agent URL used by dashboard server lookups such as
# runtime pricing enrichment. In docker compose this can stay on the default
# internal backend service URL.
RESOLVEKIT_SERVER_AGENT_BASE_URL=http://localhost:8000
DATABASE_URL=postgresql://agent:postgres@db:5432/agent

# Knowledge base service
KBS_DATABASE_URL=postgresql+asyncpg://agent:postgres@kb-db:5432/knowledge_bases
KBS_POSTGRES_DB=knowledge_bases
# Required. Must match RK_KNOWLEDGE_BASES_SIGNING_KEY.
KBS_SERVICE_JWT_SIGNING_KEY=change-me-kb-service-signing-key
KBS_SERVICE_JWT_AUDIENCE=kb-service
KBS_ENCRYPTION_KEY=change-me-generate-with-python-fernet
KBS_USE_CRAWL4AI=true
KBS_CRAWL4AI_HEADLESS=true
KBS_CRAWL4AI_BASE_DIRECTORY=/tmp/crawl4ai
KBS_UPLOAD_MAX_FILE_BYTES=26214400
KBS_UPLOAD_ALLOWED_EXTENSIONS=.txt,.md,.markdown,.pdf,.doc,.docx,.ppt,.pptx,.rtf,.odt,.html,.htm,.csv,.tsv,.xlsx,.xls,.json,.xml,.yaml,.yml
KBS_UPLOAD_OCR_ENABLED=false

# Public gateway / Caddy
# If another reverse proxy already owns :80/:443 on the VPS, bind ResolveKit's
# Caddy to loopback/high ports instead and proxy your chosen public host to the
# `resolvekit_prod_caddy` service on the shared Docker network.
GATEWAY_HTTP_BIND_ADDR=0.0.0.0
GATEWAY_HTTP_BIND_PORT=80
GATEWAY_HTTPS_BIND_ADDR=0.0.0.0
GATEWAY_HTTPS_BIND_PORT=443
RESOLVEKIT_PUBLIC_HOST=support.example.com
LETSENCRYPT_EMAIL=devops@example.com

# Optional: dedicated Dockerized Caddy gateway (`infra/caddy`).
# This mode supports one main host + explicit `www`/`dash` + `api` hosts,
# while keeping path routing (`/agent/*`, `/v1/*`) available on the main host.
CADDY_DOCKER_NETWORK=resolvekit_default
CADDY_HTTP_BIND=0.0.0.0:80
CADDY_HTTPS_BIND=0.0.0.0:443
CADDY_LOCAL_BIND=127.0.0.1:8080

# Public domains served by infra/caddy/Caddyfile
CADDY_PRIMARY_HOST=support.example.com
CADDY_WWW_HOST=www.support.example.com
CADDY_DASH_HOST=dash.support.example.com
CADDY_API_HOST=api.support.example.com

# Internal upstream targets (override only if your service/container names differ)
CADDY_DASHBOARD_UPSTREAM=resolvekit_dashboard:3000
CADDY_API_UPSTREAM=resolvekit_api:3002
CADDY_BACKEND_UPSTREAM=resolvekit_backend:8000
CADDY_KB_UPSTREAM=resolvekit_kb_service:8100