Environment variables

Each application has an .env.example; production Compose also uses docker/.env for substitution. Values in frontend/launcher builds are public once shipped, so never place secrets in VITE_* or browser bundle variables.

Gateway

Group	Variables
Runtime	`NODE_ENV`, `CLIENT_URL`, `PUBLIC_API_URL`, `SERVICE_NAME`, `LOG_LEVEL`
MongoDB	`MONGODB_URI`
Redis	`REDIS_HOST`, `REDIS_PORT`, `REDIS_PASSWORD`
JWT	`JWT_SECRET`, `JWT_EXPIRES_IN`, `JWT_REFRESH_SECRET`, `JWT_REFRESH_EXPIRES_IN`
Email/AWS	`EMAIL_PROVIDER`, `EMAIL_FROM_NAME`, `EMAIL_FROM_EMAIL`, `AWS_REGION`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`
MinIO	`MINIO_ENDPOINT`, `MINIO_PORT`, `MINIO_USE_SSL`, `MINIO_ACCESS_KEY`, `MINIO_SECRET_KEY`, `MINIO_BUCKET_NAME`, `MINIO_PUBLIC_URL`
Security	`RATE_LIMIT_WINDOW_MS`, `RATE_LIMIT_MAX_REQUESTS`, `AI_TOOL_SECRET`, `ALLOWED_DOMAINS`

PUBLIC_API_URL must be the external origin providers use for Telegram and other callbacks. CLIENT_URL is the public console origin. Use different random values for both JWT secrets and for AI_TOOL_SECRET.

Agent

Group	Variables
Connectivity	`REDIS_HOST`, `REDIS_PORT`, `REDIS_PASSWORD`, `API_URL`, `AI_TOOL_SECRET`
Storage/vector	`MINIO_*`, `QDRANT_URL`, optional `QDRANT_API_KEY`
Provider selection	`LLM_PROVIDER`, `EMBEDDING_PROVIDER`
Provider credentials/models	`HF_`, `AWS_`, `BEDROCK_`, `OLLAMA_`, `OPENAI_*`
Retrieval/context	`RAG_TOP_K`, `CHAT_HISTORY_LIMIT`
Concurrency/health	`WORKER_CONCURRENCY`, `INGESTION_CONCURRENCY`, `AI_HEALTH_PORT`
Advanced ingestion	`INGEST_BATCH_SIZE`, `INGEST_FLUSH_MS`, `INGEST_EMBED_CONCURRENCY`, `INGEST_EMBED_RETRIES`, `INGEST_RETRY_BASE_MS`, `URL_INGEST_LOCK_TTL_SECONDS`
Observability/streaming	`AI_OBS_BATCH_SIZE`, `AI_OBS_FLUSH_MS`, `AI_STREAM_SEQ_TTL_SECONDS`

See model providers before changing provider or embedding dimension.

Console and launcher

Application	Variables
Console	`VITE_API_URL`, `VITE_SOCKET_URL`, `VITE_WIDGET_URL`, `VITE_PUBLIC_ENV`, `VITE_INTERAONE_MODE`
Launcher	`MINIO_ENDPOINT`, `MINIO_PORT`, `MINIO_USE_SSL`, `MINIO_ACCESS_KEY`, `MINIO_SECRET_KEY`, `API_URL_PRODUCTION`, `CDN_URL_PRODUCTION`

Launcher MinIO credentials belong only in its deployment process, never in the generated browser asset.

Worker

The worker needs REDIS_HOST, REDIS_PORT, REDIS_PASSWORD, MONGODB_URI, EMAIL_PROVIDER, sender values, MailHog host/port when selected, AWS credentials/region for SES, and WORKER_CONCURRENCY.

Docker substitution

docker/.env supplies MongoDB, Redis, and MinIO credentials; API_HOST, WEB_HOST, CDN_HOST, and LOG_HOST; MINIO_PUBLIC_URL; API_URL_PRODUCTION; and LOG_VIEWER_PORT.

Never commit .env files, provider keys, JWT secrets, database credentials, or AI_TOOL_SECRET. Use different credentials in every environment and keep MongoDB, Redis, Qdrant, and MinIO private behind the application network.

Run docker compose --env-file docker/.env -f docker/docker-compose.yml config before deployment. It catches missing substitutions and shows the effective configuration—review output carefully because it can contain secrets.

Getting started

Self-hosting

Architecture

AI system

Knowledge base

Channels

Administration

Contributing

Environment variables

Gateway

Agent

Console and launcher

Worker

Docker substitution

​Gateway

​Agent

​Console and launcher

​Worker

​Docker substitution

Gateway

Agent

Console and launcher

Worker

Docker substitution