Repository navigation
Expand file tree
/
Copy path.env.example
More file actions
224 lines (203 loc) · 16.6 KB
/
Copy path.env.example
File metadata and controls
224 lines (203 loc) · 16.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
# Database (Required)
DATABASE_URL="postgresql://postgres:your_password@localhost:5432/simstudio"
# Optional read-replica connection string for offloading heavy read paths
# (logs listing, audit logs, dashboard aggregations). Reads fall back to
# DATABASE_URL when unset.
# DATABASE_REPLICA_URL=""
# Authentication (Required unless DISABLE_AUTH=true)
BETTER_AUTH_SECRET=your_secret_key # Use `openssl rand -hex 32` to generate, or visit https://www.better-auth.com/docs/installation
BETTER_AUTH_URL=http://localhost:3000
# Authentication Bypass (Optional - for self-hosted deployments behind private networks)
# DISABLE_AUTH=true # Uncomment to bypass authentication entirely. Creates an anonymous session for all requests.
# Private Database Hosts (Optional - for self-hosted deployments only)
# ALLOW_PRIVATE_DATABASE_HOSTS=true # Uncomment to let database/connector tools reach private/reserved/loopback hosts (e.g. Docker/K8s service names, localhost). Loosens the SSRF boundary; only enable on a trusted private network.
# NextJS (Required)
NEXT_PUBLIC_APP_URL=http://localhost:3000
# INTERNAL_API_BASE_URL=http://sim-app.default.svc.cluster.local:3000 # Optional: internal URL for server-side /api self-calls; defaults to NEXT_PUBLIC_APP_URL
# TRUSTED_ORIGINS=https://www.example.com,https://app.example.com # Optional: comma-separated additional public origins to trust for auth (apex+www, alias domains). Merged into Better Auth trustedOrigins.
# AUTH_TRUSTED_PROXIES=10.0.0.0/24,192.0.2.10 # Optional: reverse-proxy IPs/CIDRs in front of the app. Better Auth walks x-forwarded-for right to left, skips these hops, and uses the first untrusted address as the client IP (prevents forwarded-header spoofing). Use your proxies' actual addresses, not broad private ranges that also cover clients.
# Chat (Optional)
# COPILOT_API_KEY= # Mint one at https://sim.ai. Without it the Sim Chat block, prompt jobs, and Inbox cannot run
# MSHIP_SYSPROMPT_OVERRIDE= # Highest-priority instructions for Mothership; honored only when the validated API key owner is enterprise
# NEXT_PUBLIC_CHAT_DISABLED=true # Hides the Chat module: the workspace lands on your first workflow, and the chats list, scheduled tasks, and editor Chat panel are absent. Chat is shown when unset; `bun run setup` sets this for you if you skip the chat key
# Remote Function sandboxes (Optional)
# Build a dedicated Function base before enabling JavaScript imports, Python, or Shell.
# Copilot/Mothership code tools use a separate shell image. It is selected only
# for those code-tool calls and is never a fallback for Function blocks.
# SANDBOXES_ENABLED=true # Enables custom sandboxes for self-hosted workspaces
# NEXT_PUBLIC_SANDBOXES_ENABLED=true # Shows remote Function languages and custom sandbox settings; set only after the provider/base is ready
#
# E2B (default provider)
# After exporting E2B_API_KEY, build with: bun run apps/sim/scripts/build-function-e2b-template.ts
# SANDBOX_PROVIDER=e2b
# E2B_ENABLED=true
# E2B_API_KEY=
# E2B_FUNCTION_TEMPLATE_ID=<sim-function-template>:<sim-function-build-id> # Copy the exact ref printed by the builder
# E2B_FUNCTION_TEMPLATE_GENERATION=<release-epoch-ms> # Copy the monotonic generation printed by the builder
# MOTHERSHIP_E2B_TEMPLATE_ID= # Mothership shell template ref, required when Mothership runs code on E2B
#
# Daytona
# Build from an accepted E2B parity manifest with: bun run apps/sim/scripts/build-function-daytona-snapshot.ts --name <name> --parity-manifest <path>
# SANDBOX_PROVIDER=daytona
# DAYTONA_API_KEY=
# DAYTONA_FUNCTION_SNAPSHOT_ID=<snapshot-uuid> # Copy the immutable ID printed by the Daytona builder
# DAYTONA_SHELL_SNAPSHOT_ID= # Mothership shell snapshot ref, required when Mothership runs code on Daytona
# Security (Required)
ENCRYPTION_KEY=your_encryption_key # Use `openssl rand -hex 32` to generate, used to encrypt environment variables
INTERNAL_API_SECRET=your_internal_api_secret # Use `openssl rand -hex 32` to generate, used to encrypt internal api routes
API_ENCRYPTION_KEY=your_api_encryption_key # Use `openssl rand -hex 32` to generate, used to encrypt api keys
CRON_SECRET=your_cron_secret # Use `openssl rand -hex 32` to generate. Authenticates the scheduler against the background job endpoints (scheduled workflows, polling triggers, connector syncs)
# Email Provider (Optional)
# Configure one or more providers. Every configured provider stays active and is
# tried in order: Resend → AWS SES → SMTP → Azure Communication Services → Gmail.
# If none are configured, emails are logged to console instead.
#
# Resend
# RESEND_API_KEY= # API key from https://resend.com
#
# AWS SES (credentials resolved via the standard AWS provider chain:
# env vars, shared config, ECS/EKS task role, EC2 instance profile, SSO)
# AWS_SES_REGION=us-east-1
#
# SMTP (works with MailHog locally: host=localhost port=1025, no auth)
# SMTP_HOST=smtp.example.com
# SMTP_PORT=587 # 465 = implicit TLS, 587 = STARTTLS, 25 = plain
# SMTP_USER= # Optional — omit for unauthenticated relays
# SMTP_PASS= # Optional — omit for unauthenticated relays
# SMTP_SECURE= # Set "true" to force TLS on connect; auto-true on port 465
# SMTP_EHLO_NAME= # EHLO hostname; defaults to the app's own domain. Set only if the relay expects a different one
#
# Azure Communication Services
# AZURE_ACS_CONNECTION_STRING=
#
# Gmail API (Google-native — service account with domain-wide delegation for
# the gmail.send scope; the Google Workspace SMTP relay also works via SMTP_HOST)
# GMAIL_CREDENTIALS_JSON= # Inline service-account JSON with domain-wide delegation
# GMAIL_SENDER=noreply@yourdomain.com # Workspace user the service account impersonates
#
# Shared sender configuration
# FROM_EMAIL_ADDRESS="Sim <noreply@example.com>"
# EMAIL_DOMAIN=example.com # Fallback when FROM_EMAIL_ADDRESS is unset
# Local AI Models (Optional)
# OLLAMA_URL=http://localhost:11434 # URL for local Ollama server - uncomment if using local models
# VLLM_BASE_URL=http://localhost:8000 # Base URL for your self-hosted vLLM (OpenAI-compatible)
# VLLM_API_KEY= # Optional bearer token if your vLLM instance requires auth
# LITELLM_BASE_URL=http://localhost:4000 # Base URL for your LiteLLM proxy (OpenAI-compatible)
# LITELLM_API_KEY= # Optional bearer token if your LiteLLM proxy requires auth
# OPENROUTER_API_KEY= # Optional self-hosted fallback for OpenAI knowledge-base embeddings
# NEXT_PUBLIC_FORCE_HOSTED=true # Dev only: treat this instance as hosted Sim (sim-auto pool, platform keys); ignored in production builds
# FIREWORKS_API_KEY= # Optional Fireworks AI API key for model listing and inference
# FIREWORKS_API_KEY_1= # Optional Fireworks API key for rotation (hosted deployments)
# FIREWORKS_API_KEY_2= # Additional Fireworks API key for load balancing
# FIREWORKS_API_KEY_3= # Additional Fireworks API key for load balancing
# NEXT_PUBLIC_BEDROCK_DEFAULT_CREDENTIALS=true # Set when using AWS default credential chain (IAM roles, ECS task roles, IRSA). Hides credential fields in Agent block UI.
# AZURE_OPENAI_ENDPOINT= # Azure OpenAI endpoint (hides field in UI when set alongside NEXT_PUBLIC_AZURE_CONFIGURED)
# AZURE_OPENAI_API_KEY= # Azure OpenAI API key
# AZURE_OPENAI_API_VERSION= # Azure OpenAI API version
# AZURE_ANTHROPIC_ENDPOINT= # Azure Anthropic endpoint (AI Foundry)
# AZURE_ANTHROPIC_API_KEY= # Azure Anthropic API key
# AZURE_ANTHROPIC_API_VERSION= # Azure Anthropic API version (e.g., 2023-06-01)
# NEXT_PUBLIC_AZURE_CONFIGURED=true # Set when Azure credentials are pre-configured above. Hides endpoint/key/version fields in Agent block UI.
# COHERE_API_KEY= # Cohere API key for the Knowledge block reranker (rerank-v4.0-pro/-fast, rerank-v3.5). Alternatively set COHERE_API_KEY_1/2/3 for rotation.
# NEXT_PUBLIC_COHERE_CONFIGURED=true # Set when COHERE_API_KEY (or rotation keys) are pre-configured above. Hides the Cohere API Key field on the Knowledge block UI.
# Hosted tool API keys (Optional - lets Sim supply the key so users don't have to bring their own).
# Each provider reads `{PREFIX}_COUNT` then `{PREFIX}_1..N`, distributing requests round-robin across the keys.
# HUNTER_API_KEY_COUNT=2 # Number of Hunter.io keys for hosted Hunter blocks
# HUNTER_API_KEY_1= # Hunter.io API key #1
# HUNTER_API_KEY_2= # Hunter.io API key #2
# PEOPLEDATALABS_API_KEY_COUNT=2 # Number of People Data Labs keys for hosted PDL blocks
# PEOPLEDATALABS_API_KEY_1= # People Data Labs API key #1
# PEOPLEDATALABS_API_KEY_2= # People Data Labs API key #2
# CONTEXT_DEV_API_KEY_COUNT=2 # Number of Context.dev keys for hosted Context.dev blocks
# CONTEXT_DEV_API_KEY_1= # Context.dev API key #1
# CONTEXT_DEV_API_KEY_2= # Context.dev API key #2
# PDF OCR provider (Optional - defaults to local; legacy installs infer Mistral from configured credentials)
# OCR_PROVIDER=local # One of: local, mistral, azure-mistral
# File Storage (Optional - defaults to local disk; use S3, Azure Blob, or Google Cloud Storage for production)
# STORAGE_PROVIDER=local # Optional override: local, s3, azure, or gcs. Unset preserves Azure → S3 → GCS → local precedence
# AWS_REGION=us-east-1 # Required with S3_BUCKET_NAME to enable S3. Use "auto" for Cloudflare R2
# AWS_ACCESS_KEY_ID= # Omit to use the instance/IRSA credential chain
# AWS_SECRET_ACCESS_KEY= # Omit to use the instance/IRSA credential chain
# S3_BUCKET_NAME= # General workspace files bucket (required with AWS_REGION to enable S3)
# S3_KB_BUCKET_NAME= # Knowledge base documents
# S3_EXECUTION_FILES_BUCKET_NAME= # Workflow execution files
# S3_CHAT_BUCKET_NAME= # Deployed chat assets
# S3_COPILOT_BUCKET_NAME= # Copilot attachments
# S3_PROFILE_PICTURES_BUCKET_NAME= # User profile pictures
# S3_OG_IMAGES_BUCKET_NAME= # OpenGraph preview images (falls back to S3_BUCKET_NAME)
# S3_WORKSPACE_LOGOS_BUCKET_NAME= # Workspace logos (falls back to S3_BUCKET_NAME)
# S3_ENDPOINT= # Custom endpoint for S3-compatible storage (Cloudflare R2, MinIO, Backblaze B2). Leave unset for AWS S3
# S3_FORCE_PATH_STYLE=true # Required for MinIO/Ceph RGW. Leave unset for AWS S3 and R2
# Instagram OAuth (Optional - Instagram App ID/Secret from Meta App Dashboard > Instagram > API setup with Instagram login)
# INSTAGRAM_CLIENT_ID=
# INSTAGRAM_CLIENT_SECRET=
# Instagram publish file uploads require cloud storage above — S3, Azure Blob, or GCS (Meta must fetch a public HTTPS URL).
# Gmail attachments do not need this.
# TikTok OAuth (Optional - Client Key/Secret from the TikTok for Developers app)
# TIKTOK_CLIENT_ID=
# TIKTOK_CLIENT_SECRET=
# Azure Blob Storage
# AZURE_ACCOUNT_NAME= # Azure storage account name
# AZURE_ACCOUNT_KEY= # Azure storage account key
# AZURE_CONNECTION_STRING= # Alternative to account name/key
# AZURE_STORAGE_CONTAINER_NAME= # General workspace files container
# AZURE_STORAGE_KB_CONTAINER_NAME= # Knowledge base documents
# AZURE_STORAGE_EXECUTION_FILES_CONTAINER_NAME= # Workflow execution files
# AZURE_STORAGE_CHAT_CONTAINER_NAME= # Deployed chat assets
# AZURE_STORAGE_COPILOT_CONTAINER_NAME= # Copilot attachments
# AZURE_STORAGE_PROFILE_PICTURES_CONTAINER_NAME= # User profile pictures
# AZURE_STORAGE_OG_IMAGES_CONTAINER_NAME= # OpenGraph preview images (falls back to AZURE_STORAGE_CONTAINER_NAME)
# AZURE_STORAGE_WORKSPACE_LOGOS_CONTAINER_NAME= # Workspace logos (falls back to AZURE_STORAGE_CONTAINER_NAME)
# Google Cloud Storage
# GCS_PROJECT_ID= # GCP project ID (optional — inferred from credentials/ADC when unset)
# GCS_CREDENTIALS_JSON= # Inline service-account JSON. Omit to use Application Default Credentials (Workload Identity, GOOGLE_APPLICATION_CREDENTIALS)
# GCS_BUCKET_NAME= # General workspace files bucket (enables GCS; all other buckets fall back to it)
# GCS_KB_BUCKET_NAME= # Knowledge base documents
# GCS_EXECUTION_FILES_BUCKET_NAME= # Workflow execution files
# GCS_CHAT_BUCKET_NAME= # Deployed chat assets
# GCS_COPILOT_BUCKET_NAME= # Copilot attachments
# GCS_PROFILE_PICTURES_BUCKET_NAME= # User profile pictures
# GCS_OG_IMAGES_BUCKET_NAME= # OpenGraph preview images
# GCS_WORKSPACE_LOGOS_BUCKET_NAME= # Workspace logos
# Admin API (Optional - for self-hosted GitOps)
# ADMIN_API_KEY= # Use `openssl rand -hex 32` to generate. Enables admin API for workflow export/import.
# Usage: curl -H "x-admin-key: your_key" https://your-instance/api/v1/admin/workspaces
# Enterprise Features (Optional - self-hosted). One switch enables organizations, SSO,
# permission groups, audit logs, whitelabeling, session policies, data retention, data
# drains, forks, and the inbox. Set both — the server value grants access, the
# NEXT_PUBLIC_ value decides what the settings UI shows.
# Docs: https://docs.sim.ai/platform/enterprise/self-hosted
# ENTERPRISE_ENABLED=true
# NEXT_PUBLIC_ENTERPRISE_ENABLED=true
# Per-feature overrides. An explicitly set flag wins over ENTERPRISE_ENABLED, so use these
# to enable one feature on its own or to switch a single feature back off.
# ACCESS_CONTROL_ENABLED= / NEXT_PUBLIC_ACCESS_CONTROL_ENABLED= # Permission groups
# SSO_ENABLED= / NEXT_PUBLIC_SSO_ENABLED= # SAML and OIDC sign-in
# WHITELABELING_ENABLED= / NEXT_PUBLIC_WHITELABELING_ENABLED= # Custom branding
# AUDIT_LOGS_ENABLED= / NEXT_PUBLIC_AUDIT_LOGS_ENABLED= # Audit logging
# SESSION_POLICIES_ENABLED= / NEXT_PUBLIC_SESSION_POLICIES_ENABLED=
# DATA_RETENTION_ENABLED= / NEXT_PUBLIC_DATA_RETENTION_ENABLED= # Runs retention deletion — off by default
# DATA_DRAINS_ENABLED= / NEXT_PUBLIC_DATA_DRAINS_ENABLED= # Export streams
# FORKING_ENABLED= # Workspace forks
# CREDENTIAL_GROUPS= # Enterprise managed OAuth collections
# ORGANIZATIONS_ENABLED= / NEXT_PUBLIC_ORGANIZATIONS_ENABLED= # Organizations only
# Instance organization (Optional). Most enterprise features read their settings from the
# organization that owns a workspace, so a deployment needs an organization for them to
# apply. Setting a name puts every user in one shared org at signup and makes their
# workspaces org-owned. Leave unset to manage organizations yourself via the Admin API.
# INSTANCE_ORG_NAME=Acme Inc
# INSTANCE_ORG_SLUG=acme-inc # Optional — derived from the name when unset
# INSTANCE_ORG_OWNER_EMAIL=admin@acme.com # Optional — defaults to the first user to sign up
# Limits (Optional - self-hosted). With billing disabled (BILLING_ENABLED unset), no plan
# limits are enforced. Explicitly setting a free-tier variable below opts that specific
# limit back in at the configured value.
# RATE_LIMIT_FREE_SYNC=50 # Sync executions per minute
# RATE_LIMIT_FREE_ASYNC=200 # Async executions per minute
# RATE_LIMIT_FREE_API_ENDPOINT=30 # v1 API endpoint requests per minute
# EXECUTION_TIMEOUT_FREE=300 # Sync execution timeout in seconds
# EXECUTION_TIMEOUT_ASYNC_FREE=5400 # Async execution timeout in seconds
# FREE_TABLES_LIMIT=5 # Max user tables per workspace
# FREE_TABLE_ROWS_LIMIT=50000 # Max rows per user table
# TABLE_DISPATCH_CONCURRENCY_FREE=20 # Rows one table run executes in parallel on free tier
# TABLE_DISPATCH_CONCURRENCY_PAID=50 # Rows one table run executes in parallel on paid tiers (billing disabled uses this)
# FREE_STORAGE_LIMIT_GB=5 # File storage quota in GB