-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path.env.example
More file actions
201 lines (185 loc) · 6.79 KB
/
Copy path.env.example
File metadata and controls
201 lines (185 loc) · 6.79 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
#===============#
# Cache #
#===============#
# Provider: Memory or Redis. Redis requires CACHE_CONNECTION_STRING.
CACHE_PROVIDER=Memory
CACHE_CONNECTION_STRING=
CACHE_KEY_PREFIX=hsqlagent:cache:
#=====================#
# Application hosting #
#=====================#
ASPNETCORE_URLS=http://+:8080
ALLOWED_HOSTS=*
#================#
# Admin database #
#================#
# Stores accounts, roles, keys, audit records, and other control-plane data.
ADMIN_DATABASE_PROVIDER=Sqlite
ADMIN_DATABASE_CONNECTION_STRING=Data Source=/app/data/hsqlagent.db
#===============#
# MCP #
#===============#
# HMAC key used to protect issued MCP server keys. Use a unique secret of at least 32 bytes.
HMAC_KEY=YourMcpHmacSecretKeyHere-AtLeast32Bytes!
# Public URL returned in generated MCP client configuration; it must be reachable by clients.
MCP_PUBLIC_ENDPOINT=http://localhost:8080/mcp
#======================#
# DML approval #
#======================#
# McpElicitation keeps the built-in MCP approval flow. Set Webhook to use the official
# generic external approval adapter bundled with the standalone Docker image.
DML_APPROVAL_PROVIDER=McpElicitation
DML_APPROVAL_WEBHOOK_ENDPOINT=
DML_APPROVAL_WEBHOOK_CALLBACK_URL=
# Required for Webhook; use a unique secret of at least 32 UTF-8 bytes.
DML_APPROVAL_WEBHOOK_SIGNING_SECRET=
#==============================#
# Bootstrap / Auto-provisioning #
#==============================#
# Automatically provision initial database connection and MCP access key on startup if not already existing.
BOOTSTRAP_ENABLED=false
BOOTSTRAP_DB_ID=default-db
BOOTSTRAP_DB_NAME=Default DB
BOOTSTRAP_DB_PROVIDER=
BOOTSTRAP_DB_HOST=localhost
BOOTSTRAP_DB_PORT=5432
BOOTSTRAP_DB_DATABASE=mydb
BOOTSTRAP_DB_USERNAME=myuser
BOOTSTRAP_DB_PASSWORD=mypassword
BOOTSTRAP_DB_EXTRA_SETTINGS=
BOOTSTRAP_MCP_KEY_ID=default-key
BOOTSTRAP_MCP_KEY_NAME=Default MCP Key
BOOTSTRAP_MCP_KEY=hs-agent-initial-key-example-123456
BOOTSTRAP_MCP_ALLOWED_TOOLS=
#================#
# Authentication #
#================#
# JWT signing key must be unique and at least 32 bytes.
JWT_KEY=YourSuperSecretKeyHere-AtLeast32Bytes!
JWT_ISS=HS-Agent
JWT_AUD=HS-Agent-Users
JWT_ACCESS_TOKEN_EXPIRATION_MINUTES=10
JWT_REFRESH_TOKEN_EXPIRATION_DAYS=1
# Number of failed sign-ins before temporary account lockout. Values below 1 are treated as 1.
AUTH_LOCKOUT_THRESHOLD=5
AUTH_LOCKOUT_MINUTES=15
#================#
# Password reset #
#================#
# Password reset emails are disabled when SMTP_HOST or SMTP_FROM is empty.
# This URL must be the externally reachable frontend reset page. The backend appends ?token=...
PASSWORD_RESET_BASE_URL=http://localhost:3000/reset-password
# One-time reset token lifetime, in minutes.
PASSWORD_RESET_EXPIRATION_MINUTES=30
#===============#
# SMTP #
#===============#
# SMTP example below assumes STARTTLS on port 587. Set credentials to empty only for
# an SMTP relay that explicitly allows unauthenticated delivery from this service.
SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_ENABLE_SSL=true
SMTP_USERNAME=your-smtp-username
SMTP_PASSWORD=your-smtp-password
# Must be an address permitted by the SMTP provider, for example no-reply@example.com.
SMTP_FROM=no-reply@example.com
#===============#
# OIDC / SSO #
#===============#
OIDC_ENABLED=false
OIDC_AUTHORITY=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
# Keep true in production; disable only for a trusted local identity provider over HTTP.
OIDC_REQUIRE_HTTPS_METADATA=true
OIDC_EMAIL_CLAIM=email
OIDC_NAME_CLAIM=name
OIDC_ROLE_CLAIM=roles
OIDC_EMAIL_VERIFIED_CLAIM=email_verified
OIDC_REQUIRE_VERIFIED_EMAIL=true
OIDC_SCOPE_0=openid
OIDC_SCOPE_1=profile
OIDC_SCOPE_2=email
OIDC_ROLE_MAPPING_SQL_ADMINS=SuperUser
OIDC_AUTO_PROVISION=true
OIDC_FRONTEND_CALLBACK_URL=/sso-callback
OIDC_LOGIN_CODE_EXPIRATION_MINUTES=2
OIDC_TOTP_ISSUER=HS SQL Agent
# Persist this directory across restarts or protected MFA secrets and login state may become unreadable.
DATA_PROTECTION_KEY_PATH=/app/data/data-protection-keys
#===============#
# Operability #
#===============#
HEALTH_PROBE_ENABLED=false
HEALTH_PROBE_INTERVAL_SECONDS=60
HEALTH_PROBE_TIMEOUT_SECONDS=10
HEALTH_PROBE_MAX_CONCURRENCY=4
# Queries at or above this duration are recorded as slow queries.
SLOW_QUERY_THRESHOLD_MS=1000
# Optional signed delivery targets. Leave URL empty to disable the corresponding integration.
ALERT_WEBHOOK_URL=
ALERT_WEBHOOK_SECRET=
SIEM_WEBHOOK_URL=
SIEM_WEBHOOK_SECRET=
DELIVERY_MAX_ATTEMPTS=6
DELIVERY_MAX_CONCURRENCY=4
# Set AUDIT_RETENTION_DAYS=0 to disable automatic retention processing.
AUDIT_RETENTION_DAYS=90
# Archive preserves expired records before deletion; Delete removes them directly.
AUDIT_RETENTION_MODE=Archive
AUDIT_ARCHIVE_PATH=/app/data/audit-archive
AUDIT_FALLBACK_PATH=/app/data/audit-fallback.jsonl
AUDIT_RETENTION_RUN_HOUR_UTC=2
#===============#
# Rate limiting #
#===============#
# Global IP limit. Set both values to 0 for unlimited requests.
RATE_LIMITING_PERMIT_LIMIT=0
RATE_LIMITING_WINDOW_SECONDS=0
# Provider: Memory or Redis. Use Redis when limits must be shared by multiple instances.
RATE_LIMITER_PROVIDER=Memory
RATE_LIMITER_CONNECTION_STRING=
# FailClosed rejects requests when the distributed limiter is unavailable; FailOpen allows them.
RATE_LIMITER_FAILURE_MODE=FailClosed
RATE_LIMITER_KEY_PREFIX=hsqlagent:ratelimit:
#=====================#
# Security policy sync #
#=====================#
# Provider: Memory or Redis. Redis propagates runtime policy changes across instances.
SECURITY_POLICY_SYNC_PROVIDER=Memory
SECURITY_POLICY_SYNC_CONNECTION_STRING=
SECURITY_POLICY_SYNC_KEY_PREFIX=hsqlagent:security-policy:
SECURITY_POLICY_SYNC_REFRESH_INTERVAL_SECONDS=30
#========================#
# Outbound delivery sync #
#========================#
# Provider: Memory or Redis. Redis broadcasts webhook delivery signals across instances.
OUTBOUND_DELIVERY_SYNC_PROVIDER=Memory
OUTBOUND_DELIVERY_SYNC_CONNECTION_STRING=
OUTBOUND_DELIVERY_SYNC_KEY_PREFIX=hsqlagent:outbound-delivery:
#=================#
# SQL concurrency #
#=================#
# Provider: Memory or Redis. Redis coordinates concurrency across instances.
SQL_CONCURRENCY_PROVIDER=Memory
SQL_CONCURRENCY_CONNECTION_STRING=
SQL_CONCURRENCY_FAILURE_MODE=FailClosed
SQL_CONCURRENCY_KEY=hsqlagent:sql-concurrency
SQL_CONCURRENCY_LEASE_SECONDS=30
#===============#
# Observability #
#===============#
# Prometheus metrics are served on a separate listener, not the application API port.
PROMETHEUS_ENABLED=false
PROMETHEUS_HOST=0.0.0.0
PROMETHEUS_PORT=9000
# Optional OTLP collector endpoint, for example http://otel-collector:4317.
OTLP_ENDPOINT=
OTEL_SERVICE_NAME=hs-sql-agent
#===============#
# Logging #
#===============#
# Log level for EF Core SQL command execution (Warning suppresses routine SQL command tracing).
LOGGING_EFCORE_COMMAND_LOGLEVEL=Warning
LOGGING_DEFAULT_LOGLEVEL=Information
LOGGING_ASPNETCORE_LOGLEVEL=Warning