story/.env.example

# 仅用于本地合成数据。不要填入生产密钥或真实个人数据。
# 敏感配置同时支持NAME_FILE=/容器内绝对路径；NAME与NAME_FILE只能设置一个。
APP_ENV=local
LOG_LEVEL=debug
PLATFORM_BUILD_VERSION=dev
PLATFORM_BUILD_COMMIT=unknown
PLATFORM_BUILD_TIME=unknown
HTTP_ADDR=0.0.0.0:58080
API_PORT=58080
CALLBACKS_PORT=58081
WORKER_PORT=58082
WEB_PORT=3100
OTEL_GRPC_PORT=54317
PROMETHEUS_PORT=59190
MOCK_PROVIDER_PORT=59200
POSTGRES_PORT=55432
REDIS_PORT=56379
MINIO_API_PORT=59000
MINIO_CONSOLE_PORT=59001
DATABASE_URL=postgres://voice:voice_dev_only@localhost:55432/voice_platform?sslmode=disable
DATABASE_URL_FILE=
REDIS_ADDR=localhost:56379
REDIS_PASSWORD=
REDIS_PASSWORD_FILE=
REDIS_DB=0
DEPENDENCY_TIMEOUT=2s
EXTERNAL_PROBE_INTERVAL=30s
SHUTDOWN_TIMEOUT=10s
WORKER_POLL_INTERVAL=2s
WEB_OIDC_AUTHORITY=http://localhost:58180/realms/voice-local
WEB_OIDC_CLIENT_ID=voice-platform-web
AUTH_ISSUER_URL=http://localhost:58180/realms/voice-local
AUTH_JWKS_URL=http://localhost:58180/realms/voice-local/protocol/openid-connect/certs
AUTH_AUDIENCE=voice-platform-web
OTEL_EXPORTER_OTLP_ENDPOINT=localhost:54317
RATE_LIMIT_RPS=50
RATE_LIMIT_BURST=100
RATE_LIMIT_USER_RPS=20
RATE_LIMIT_USER_BURST=40
RATE_LIMIT_TENANT_RPS=200
RATE_LIMIT_TENANT_BURST=400
RATE_LIMIT_DEVICE_RPS=10
RATE_LIMIT_DEVICE_BURST=20
PROVIDER_START_RPS=20
PROVIDER_START_BURST=40
PROVIDER_MAX_ACTIVE_TASKS=100
DEVICE_LOCAL_SECRET=local-simulated-device-secret-32-bytes-minimum
DEVICE_SECRET_DIRECTORY=
DEVICE_CLOCK_SKEW=5m
RTC_APP_ID=local-public-rtc-app
RTC_APP_KEY=
RTC_APP_KEY_FILE=
RTC_TOKEN_ISSUER=local
RTC_TOKEN_SIGNING_SECRET=local-simulated-rtc-token-secret-32-bytes-minimum
CURSOR_SIGNING_SECRET=local-signed-pagination-cursor-secret-32-bytes-minimum
SHARE_TOKEN_SIGNING_SECRET=local-share-token-signing-secret-32-bytes-minimum
RTC_TOKEN_TTL=5m
CONVERSATION_ALLOCATION_TTL=30s
HEARTBEAT_INTERVAL_SECONDS=15
MOCK_PROVIDER_BASE_URL=http://localhost:59200
MOCK_PROVIDER_API_KEY=local-mock-provider-key
VOICE_PROVIDER=mock
VOLC_RTC_BASE_URL=https://rtc.volcengineapi.com
VOLC_ACCESS_KEY_ID=
VOLC_SECRET_ACCESS_KEY=
VOLC_SESSION_TOKEN=
VOLC_ACCESS_KEY_ID_FILE=
VOLC_SECRET_ACCESS_KEY_FILE=
VOLC_SESSION_TOKEN_FILE=
VOLC_RTC_REGION=cn-north-1
VOLC_RTC_API_VERSION=2024-12-01
VOLC_VOICE_CHAT_TEMPLATE_FILE=
PROVIDER_CALLBACK_SECRET=local-provider-callback-secret-32-bytes-minimum
PROVIDER_CALLBACK_CLOCK_SKEW=5m
PLATFORM_HEALTH_CALLBACK_SECRET=local-platform-health-callback-secret-32-bytes-minimum
PLATFORM_HEALTH_CALLBACK_CLOCK_SKEW=5m
PROVIDER_REQUEST_TIMEOUT=5s
PROVIDER_FAILURE_THRESHOLD=3
PROVIDER_CIRCUIT_COOLDOWN=1m
RECOVERY_SCAN_INTERVAL=5s
RECOVERY_STARTING_AFTER=20s
RECOVERY_STOPPING_AFTER=20s
OBJECT_STORE_ENDPOINT=localhost:59000
OBJECT_STORE_PUBLIC_ENDPOINT=localhost:59000
OBJECT_STORE_ACCESS_KEY=local_minio
OBJECT_STORE_SECRET_KEY=local_minio_password
OBJECT_STORE_EXPORT_BUCKET=private-exports
OBJECT_STORE_REGION=us-east-1
OBJECT_STORE_SECURE=false
FIRMWARE_DOWNLOAD_BASE_URL=http://localhost:58180
EXPORT_DOWNLOAD_TTL=10m
EXPORT_OBJECT_TTL=24h
ALERT_WEBHOOK_URL=
ALERT_WEBHOOK_SECRET=
ALERT_WEBHOOK_TIMEOUT=5s
CONTENT_GENERATOR=local
# Optional self-hosted Dify workflows; use private service API keys.
DIFY_ENABLED=false
DIFY_BASE_URL=http://story-dify-nginx/v1
DIFY_BRIDGE_URL=http://model-bridge:8188
DIFY_BRIDGE_SECRET=
DIFY_EXTRACTION_API_KEY=
DIFY_MEMOIR_API_KEY=
CONTENT_SAFETY_PROVIDER=local
CONTENT_SAFETY_ENDPOINT=
CONTENT_SAFETY_API_KEY=
CONTENT_SAFETY_API_KEY_FILE=
CONTENT_SAFETY_POLICY_REF=
CONTENT_SAFETY_TIMEOUT=5s
ARK_BASE_URL=https://ark.cn-beijing.volces.com/api/v3
ARK_API_KEY=
ARK_API_KEY_FILE=
ARK_CONTENT_MODEL=deepseek-v4-1-flash-260910
ARK_MEMOIR_MODEL=doubao-seed-evolving
ARK_MEMOIR_IMAGE_MODEL=doubao-seedream-5-0-pro-260628
ARK_REQUEST_TIMEOUT=30s
EMBEDDING_PROVIDER=local
ARK_EMBEDDING_MODEL=

# 首次认证与绑定（默认关闭；详见docs/onboarding-implementation.md）
ONBOARDING_ENABLED=false
ONBOARDING_PAUSE_CLAIMS=false
ONBOARDING_ACTIVATION_ENABLED=false
ONBOARDING_SMS_LOGIN_ENABLED=false
# Also enables the customer portal SMS login; see docs/customer-sms-login.md.
# Exactly one SELF_SIGNUP_TENANT_IDS value enables automatic customer signup.
# Required for first-time WeChat-authorized phone login as well as SMS signup.
# Use the deployment's customer tenant public_id; do not select a tenant from the client.
# Multiple/empty values allow existing SMS accounts to sign in, without default signup.
ONBOARDING_ALLOW_LOCAL_HTTP=false
ONBOARDING_MASTER_KEY=
ONBOARDING_MASTER_KEY_FILE=
ONBOARDING_ENTRY_URL=
ONBOARDING_TRUSTED_PROXY_CIDRS=
ONBOARDING_SELF_SIGNUP_TENANT_IDS=
ONBOARDING_SMS_GATEWAY_URL=
ONBOARDING_SMS_GATEWAY_TOKEN=
ONBOARDING_SMS_GATEWAY_TOKEN_FILE=
# Use "tencent" to send the same SaaS, management and mini-program login OTPs
# directly through Tencent Cloud SMS. Leave as gateway for the legacy adapter.
ONBOARDING_SMS_PROVIDER=gateway
# 可选；API/worker 默认自动读取 /run/secrets/voice-runtime/tencent-sms.json（存在时）。
# 单文件里的 enabled、密钥和四种模板优先于下方旧版逐项配置。
TENCENT_SMS_CONFIG_FILE=
# Optional server-only file for SaaS and mini-program CAPTCHA credentials.
# Set true to temporarily disable human verification for website login/SMS only.
ONBOARDING_SAAS_CAPTCHA_DISABLED=false
# Defaults to /run/secrets/voice-runtime/tencent-captcha.json when present.
TENCENT_CAPTCHA_CONFIG_FILE=
TENCENT_SMS_SECRET_ID=
TENCENT_SMS_SECRET_ID_FILE=
TENCENT_SMS_SECRET_KEY=
TENCENT_SMS_SECRET_KEY_FILE=
TENCENT_SMS_SDK_APP_ID=
TENCENT_SMS_SIGN_NAME=
TENCENT_SMS_TEMPLATE_ID=