.env.example

# OpenCode WebUI Configuration
# Copy this file to .env and customize as needed
# Default values are defined in: shared/src/config/defaults.ts

# ============================================
# Backend Server Configuration
# ============================================
PORT=5003
HOST=0.0.0.0
CORS_ORIGIN=http://localhost:5173
NODE_ENV=production
# LOG_LEVEL is accepted but currently unused; DEBUG controls debug output
LOG_LEVEL=info

# ============================================
# OpenCode Server
# ============================================
OPENCODE_SERVER_PORT=5551
OPENCODE_HOST=127.0.0.1

# Optional - Basic Auth password for the managed OpenCode server.
# OpenCode 2 always requires a password: when this is unset and no password is
# stored via Settings → OpenCode → Server Auth, OpenCode Manager generates one
# and persists it. DB-stored passwords override this env var.
# Docker: the default docker-compose.yml does not forward this variable from
# .env; add it to the compose environment block or set it via the UI.
# OPENCODE_SERVER_PASSWORD=

# Optional - import an existing standalone OpenCode install on first startup
# Useful for Docker when your host OpenCode data is bind-mounted into the container
# OPENCODE_IMPORT_CONFIG_PATH=/import/opencode-config/opencode.json
# OPENCODE_IMPORT_STATE_PATH=/import/opencode-state

# ============================================
# Database
# ============================================
DATABASE_PATH=./data/opencode.db

# ============================================
# Workspace Configuration
# ============================================
WORKSPACE_PATH=./workspace

# Optional - Docker: bind /workspace to a host directory instead of the named
# volume, and run the container as your host user so the files stay usable from
# the host without root. Set PUID/PGID to the output of `id -u` / `id -g`.
# OCM_WORKSPACE_HOST_PATH=/absolute/path/to/opencode-workspace
# PUID=1000
# PGID=1000

# Optional - convenience vars for Docker bind mounts documented at https://opencodemanager.app/docs/configuration/docker
# OCM_REPOS_HOST_PATH=/Users/you/Development
# OCM_OPENCODE_CONFIG_HOST_PATH=/Users/you/.config/opencode
# OCM_OPENCODE_STATE_HOST_PATH=/Users/you/.local/share/opencode

# ============================================
# Timeouts (milliseconds)
# ============================================
PROCESS_START_WAIT_MS=2000
PROCESS_VERIFY_WAIT_MS=1000
HEALTH_CHECK_TIMEOUT_MS=30000

# ============================================
# File Limits (MB)
# ============================================
MAX_FILE_SIZE_MB=50
MAX_UPLOAD_SIZE_MB=50

# ============================================
# Logging
# ============================================
DEBUG=false

# ============================================
# Authentication (Better Auth)
# ============================================
# Docker: optional. When unset, the container generates one on first start and
# persists it in the data volume (/app/data/.auth-secret).
# Outside Docker: required in production - generate with: openssl rand -base64 32
# Changing it later invalidates sessions and stored encrypted credentials.
# AUTH_SECRET=

# Trusted origins for authentication (comma-separated)
# Add your server's external URL when accessing remotely. localhost and
# 127.0.0.1 are distinct browser origins, so both are listed.
# AUTH_TRUSTED_ORIGINS=http://localhost:5173,http://localhost:5003,http://127.0.0.1:5173,http://127.0.0.1:5003

# Admin Account (optional - for pre-configured single-user mode)
# When set, admin user is created on first startup and self-registration is disabled
# ADMIN_EMAIL=admin@example.com
# ADMIN_PASSWORD=your-secure-password

# Password Reset (set to true to force password update from ADMIN_PASSWORD)
# Remove after resetting password
# ADMIN_PASSWORD_RESET=false

# Secure Cookies (set to false when running HTTP without a reverse proxy)
# Runtime default: true when NODE_ENV=production, false otherwise.
# Docker Compose default: false (docker-compose.yml forwards AUTH_SECURE_COOKIES:-false),
# so set true explicitly for HTTPS.
# AUTH_SECURE_COOKIES=true

# OAuth Providers (optional - enable by providing client ID and secret)
# GITHUB_CLIENT_ID=
# GITHUB_CLIENT_SECRET=
# GOOGLE_CLIENT_ID=
# GOOGLE_CLIENT_SECRET=
# DISCORD_CLIENT_ID=
# DISCORD_CLIENT_SECRET=

# Passkey/WebAuthn Configuration
PASSKEY_RP_ID=localhost
PASSKEY_RP_NAME=OpenCode Manager
PASSKEY_ORIGIN=http://localhost:5003

# ============================================
# Preview Gateway
# ============================================
# Public HTTPS origin of the preview gateway (port 5004). Required when the
# Manager is served over HTTPS, for example through a Cloudflare Tunnel.
# Use a separate hostname on the same domain as the Manager, and never add it
# to AUTH_TRUSTED_ORIGINS.
# PREVIEW_PUBLIC_URL=https://preview.example.com

# ============================================
# Push Notifications (VAPID)
# Enables push notifications for the PWA (background alerts for agent
# questions, permission requests, errors, and session completions).
#
# Setup:
#   1. Generate keys:  pnpm dlx web-push generate-vapid-keys
#   2. Set VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY from the output
#   3. Set VAPID_SUBJECT to a mailto: address (REQUIRED for iOS/Safari)
#
# IMPORTANT: VAPID_SUBJECT MUST use the mailto: format for iOS/Safari
# push notifications to work. Apple's push service rejects https:// subjects.
# Example: mailto:you@yourdomain.com
#
# Browser requirements:
# - HTTPS required (except localhost)
# - Safari/iOS: Requires mailto: VAPID_SUBJECT and HTTPS
# ============================================
# VAPID_PUBLIC_KEY=
# VAPID_PRIVATE_KEY=
# VAPID_SUBJECT=mailto:you@yourdomain.com

# ============================================
# Agent Sandboxing (microsandbox)
# Sandboxed agent commands run inside a microVM managed by msb. Linux host
# with /dev/kvm is required; enable the sandbox overlay to grant the container
# KVM access and persist sandbox state:
#   docker compose -f docker-compose.yml -f docker-compose.sandbox.yml up -d
# ============================================
# OCI image the microVM boots from. The default ships gh, a Playwright Chromium,
# and the node:24 toolchain; any image you point this at must contain every tool
# the agent expects to run and a shell at /bin/sh.
# SANDBOX_IMAGE=docker.io/cstechdev/ocm-sandbox:latest
# MicroVM memory (e.g. 4G)
# SANDBOX_MEMORY=4G
# MicroVM CPU count
# SANDBOX_CPUS=2
# Guest identity sandboxed commands run as: a numeric uid, a numeric uid:gid,
# or a guest username. Defaults to PUID so the guest identity always matches
# the workspace owner; a guest username is resolved to the Manager's uid:gid.
# When a configured numeric identity cannot match the workspace owner,
# enforcement is reported unavailable.
# SANDBOX_EXEC_USER=${PUID:-1000}
# Network mode for the microVM: public, private, or host, or a comma-separated
# composition (for example public,host)
# SANDBOX_NET=public
# Timeout for microVM startup, in milliseconds
# SANDBOX_START_TIMEOUT_MS=300000
# Timeout for a single sandboxed command, in milliseconds
# SANDBOX_EXEC_TIMEOUT_MS=600000

# ============================================
# Frontend Configuration (Vite)
# These are optional - frontend uses defaults if not set
# ============================================
# VITE_API_URL is unset by default: requests are same-origin and the Vite dev
# server proxies /api to the backend. Set only for a split frontend/backend origin.
# VITE_API_URL=http://localhost:5003
# VITE_SERVER_PORT=5003
# VITE_OPENCODE_PORT=5551
# VITE_MAX_FILE_SIZE_MB=50
# VITE_MAX_UPLOAD_SIZE_MB=50