copilot-swe-agent[bot]
b03ebab747
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
242 lines
10 KiB
Bash
242 lines
10 KiB
Bash
# **Core Settings**
|
|
WORKDIR=/workdir
|
|
DATABASE_URL=sqlite:///./app/database.db
|
|
REDIS_URL=redis://redis:6379/0
|
|
EXTERNAL_HOSTNAME=docuelevate.example.com
|
|
GOTENBERG_URL=http://gotenberg:3000
|
|
ALLOW_FILE_DELETE=true # Allow deletion of file records
|
|
|
|
# **Batch Processing Settings**
|
|
# Control throttling behavior for the /processall endpoint to prevent overwhelming downstream APIs
|
|
PROCESSALL_THROTTLE_THRESHOLD=20 # Number of files above which throttling is applied (default: 20)
|
|
PROCESSALL_THROTTLE_DELAY=3 # Delay in seconds between each task submission when throttling (default: 3)
|
|
|
|
# **File Upload Size Limits** (Security - see SECURITY_AUDIT.md)
|
|
# Maximum file upload size in bytes. Default: 1GB (1073741824 bytes)
|
|
# Prevents resource exhaustion attacks. Adjust based on your server capacity.
|
|
MAX_UPLOAD_SIZE=1073741824
|
|
|
|
# Maximum size for a single file chunk in bytes (optional)
|
|
# If set and a file exceeds this size, it will be split into smaller chunks for processing
|
|
# Default: None (no splitting). Example: 104857600 for 100MB chunks
|
|
# MAX_SINGLE_FILE_SIZE=104857600
|
|
|
|
# **Security Headers** (see SECURITY_AUDIT.md and docs/DeploymentGuide.md)
|
|
# Disabled by default since most deployments use a reverse proxy (Traefik, Nginx, etc.)
|
|
# that already adds these headers. Set to true only if deploying directly without a reverse proxy.
|
|
# SECURITY_HEADERS_ENABLED=false
|
|
|
|
# If you enable security headers, you can also configure individual headers:
|
|
# Strict-Transport-Security (HSTS) - Forces HTTPS connections
|
|
# Only effective when served over HTTPS. Disable if not using HTTPS or if proxy adds this header
|
|
# SECURITY_HEADER_HSTS_ENABLED=true
|
|
# SECURITY_HEADER_HSTS_VALUE="max-age=31536000; includeSubDomains"
|
|
|
|
# Content-Security-Policy (CSP) - Controls resource loading
|
|
# Customize based on your application's resource loading needs
|
|
# Default allows self-hosted resources, inline scripts/styles, and external images
|
|
# SECURITY_HEADER_CSP_ENABLED=true
|
|
# SECURITY_HEADER_CSP_VALUE="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:;"
|
|
|
|
# X-Frame-Options - Prevents clickjacking attacks
|
|
# Options: DENY (no framing), SAMEORIGIN (same origin framing only), ALLOW-FROM uri
|
|
# SECURITY_HEADER_X_FRAME_OPTIONS_ENABLED=true
|
|
# SECURITY_HEADER_X_FRAME_OPTIONS_VALUE="DENY"
|
|
|
|
# X-Content-Type-Options - Prevents MIME sniffing
|
|
# Always set to 'nosniff' when enabled
|
|
# SECURITY_HEADER_X_CONTENT_TYPE_OPTIONS_ENABLED=true
|
|
|
|
# **Rate Limiting** (see SECURITY_AUDIT.md and docs/API.md)
|
|
# Protects against DoS attacks and API abuse by limiting request rates per IP/user
|
|
# Enabled by default - highly recommended for production
|
|
RATE_LIMITING_ENABLED=true
|
|
|
|
# Default rate limit for all API endpoints (format: count/period)
|
|
# Periods can be: second, minute, hour, day
|
|
# Default: 100 requests per minute per IP/user
|
|
RATE_LIMIT_DEFAULT=100/minute
|
|
|
|
# Rate limit for file upload endpoints
|
|
# Allows faster uploads while still preventing abuse
|
|
# Default: 600 uploads per minute per IP/user
|
|
RATE_LIMIT_UPLOAD=600/minute
|
|
|
|
# Rate limit for authentication endpoints
|
|
# Strict limit to prevent brute force attacks
|
|
# Default: 10 attempts per minute per IP
|
|
RATE_LIMIT_AUTH=10/minute
|
|
|
|
# Note: Processing endpoints (OCR, metadata extraction) use built-in queue throttling
|
|
# via Celery task queue to control processing rates and prevent upstream API overloads.
|
|
# No additional API-level rate limit is needed for processing endpoints.
|
|
|
|
# **Authentication**
|
|
AUTH_ENABLED=true
|
|
# Generate a secure random string, for example:
|
|
# python -c "import secrets; print(secrets.token_hex(32))"
|
|
SESSION_SECRET=b39fd43f68d0491ca942f28a16e484b1e763fe9accf4445ca2669a5f3b179eb4
|
|
ADMIN_USERNAME=admin
|
|
ADMIN_PASSWORD=your_secure_password
|
|
ADMIN_GROUP_NAME=admin
|
|
|
|
# **OpenID Connect/Authentik Settings**
|
|
AUTHENTIK_CLIENT_ID=<yourAuthentikAppClientID>
|
|
AUTHENTIK_CLIENT_SECRET=<yourAuthentikClientSecret>
|
|
AUTHENTIK_CONFIG_URL=<ConfigUrlOfYourApp, e.g. https://authentik.example.com/application/o/docuelevate/.well-known/openid-configuration>
|
|
OAUTH_PROVIDER_NAME="Authentik SSO"
|
|
|
|
# **AI/ML Services**
|
|
# OpenAI
|
|
OPENAI_API_KEY="<OPENAI_API_KEY>"
|
|
OPENAI_BASE_URL=https://api.openai.com/v1
|
|
OPENAI_MODEL=gpt-4o-mini
|
|
|
|
# Azure AI
|
|
AZURE_REGION="eastus"
|
|
AZURE_ENDPOINT="https://<yourendpoint>.cognitiveservices.azure.com/"
|
|
AZURE_AI_KEY=<AZURE_AI_KEY>
|
|
|
|
# **Email Settings**
|
|
EMAIL_HOST=smtp.example.com
|
|
EMAIL_PORT=587
|
|
EMAIL_USERNAME=docuelevate@example.com
|
|
EMAIL_PASSWORD=your_secure_email_password
|
|
EMAIL_USE_TLS=True
|
|
EMAIL_SENDER=DocuElevate System <docuelevate@example.com>
|
|
EMAIL_DEFAULT_RECIPIENT=recipient@example.com
|
|
|
|
# **IMAP Settings**
|
|
IMAP1_HOST=mail.example.com
|
|
IMAP1_PORT=993
|
|
IMAP1_USERNAME=<IMAP1_USERNAME>
|
|
IMAP1_PASSWORD=<IMAP1_PASSWORD>
|
|
IMAP1_SSL=true
|
|
IMAP1_POLL_INTERVAL_MINUTES=5
|
|
IMAP1_DELETE_AFTER_PROCESS=false
|
|
|
|
IMAP2_HOST=imap.gmail.com
|
|
IMAP2_PORT=993
|
|
IMAP2_USERNAME=<IMAP2_USERNAME>
|
|
IMAP2_PASSWORD=<IMAP2_PASSWORD>
|
|
IMAP2_SSL=true
|
|
IMAP2_POLL_INTERVAL_MINUTES=10
|
|
IMAP2_DELETE_AFTER_PROCESS=false
|
|
|
|
# **Storage/Document Services**
|
|
# Amazon S3
|
|
AWS_REGION=us-east-1
|
|
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
|
|
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
|
|
S3_BUCKET_NAME=my-document-bucket
|
|
S3_FOLDER_PREFIX=documents/uploads/2023/ # Organizes files in this subfolder
|
|
S3_STORAGE_CLASS=STANDARD
|
|
S3_ACL=private
|
|
|
|
# NextCloud
|
|
NEXTCLOUD_UPLOAD_URL=https://nextcloud.example.com/remote.php/dav/files/<USERNAME>
|
|
NEXTCLOUD_FOLDER="<NEXTCLOUD_FOLDER_PATH>"
|
|
NEXTCLOUD_USERNAME=<NEXTCLOUD_USERNAME>
|
|
NEXTCLOUD_PASSWORD=<NEXTCLOUD_PASSWORD>
|
|
|
|
# Paperless-ngx
|
|
PAPERLESS_HOST=https://paperless.example.com
|
|
PAPERLESS_NGX_API_TOKEN=<PAPERLESS_API_TOKEN>
|
|
# Optional: Name of the custom field in Paperless-ngx to store the "absender" (sender) value
|
|
# If set, the extracted sender information will be automatically set as a custom field in Paperless
|
|
# Example: PAPERLESS_CUSTOM_FIELD_ABSENDER=Absender
|
|
# PAPERLESS_CUSTOM_FIELD_ABSENDER=
|
|
|
|
# Optional: JSON mapping of metadata fields to Paperless custom field names
|
|
# This allows you to map multiple extracted metadata fields to custom fields in Paperless
|
|
# The mapping format is: {"metadata_field_name": "PaperlessCustomFieldName", ...}
|
|
# Available metadata fields: absender, empfaenger, correspondent, document_type, language,
|
|
# kommunikationsart, kommunikationskategorie, reference_number, etc.
|
|
# Example: PAPERLESS_CUSTOM_FIELDS_MAPPING={"absender": "Sender", "empfaenger": "Recipient", "language": "Language", "correspondent": "Correspondent"}
|
|
# PAPERLESS_CUSTOM_FIELDS_MAPPING=
|
|
|
|
# Dropbox
|
|
DROPBOX_APP_KEY=<DROPBOX_APP_KEY>
|
|
DROPBOX_APP_SECRET=<DROPBOX_APP_SECRET>
|
|
DROPBOX_REFRESH_TOKEN=<DROPBOX_REFRESH_TOKEN>
|
|
DROPBOX_FOLDER="/Documents/Uploads"
|
|
|
|
# Google Drive
|
|
# Service Account Method:
|
|
GOOGLE_DRIVE_CREDENTIALS_JSON={"type":"service_account","project_id":"your-project","private_key_id":"key-id","private_key":"-----BEGIN PRIVATE KEY-----\nYOUR_PRIVATE_KEY\n-----END PRIVATE KEY-----\n","client_email":"service-account@project.iam.gserviceaccount.com","client_id":"client-id","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_x509_cert_url":"https://www.googleapis.com/robot/v1/metadata/x509/service-account%40project.iam.gserviceaccount.com"}
|
|
GOOGLE_DRIVE_FOLDER_ID=<YOUR_FOLDER_ID>
|
|
GOOGLE_DRIVE_DELEGATE_TO=<OPTIONAL_USER_EMAIL>
|
|
|
|
# OAuth Method (Alternative):
|
|
GOOGLE_DRIVE_USE_OAUTH=false # Set to true to use OAuth instead of service account
|
|
GOOGLE_DRIVE_CLIENT_ID=your-oauth-client-id # Required for OAuth method
|
|
GOOGLE_DRIVE_CLIENT_SECRET=your-oauth-client-secret # Required for OAuth method
|
|
GOOGLE_DRIVE_REFRESH_TOKEN=your-oauth-refresh-token # Required for OAuth method
|
|
|
|
# OneDrive
|
|
ONEDRIVE_CLIENT_ID=your-client-id
|
|
ONEDRIVE_CLIENT_SECRET=your-client-secret
|
|
ONEDRIVE_TENANT_ID=common
|
|
ONEDRIVE_REFRESH_TOKEN=your-refresh-token
|
|
ONEDRIVE_FOLDER_PATH=Documents/Uploads
|
|
|
|
# WebDAV
|
|
WEBDAV_URL=https://webdav.example.com/path
|
|
WEBDAV_USERNAME=webdav_user
|
|
WEBDAV_PASSWORD=your_secure_webdav_password
|
|
WEBDAV_FOLDER=/Documents/Uploads
|
|
WEBDAV_VERIFY_SSL=True
|
|
|
|
# FTP
|
|
# Security Note: FTP_USE_TLS=True is strongly recommended for secure connections
|
|
# Set FTP_ALLOW_PLAINTEXT=False in production to prevent unencrypted FTP
|
|
FTP_HOST=ftp.example.com
|
|
FTP_PORT=21
|
|
FTP_USERNAME=ftp_user
|
|
FTP_PASSWORD=your_secure_ftp_password
|
|
FTP_FOLDER=/Documents/Uploads
|
|
FTP_USE_TLS=True
|
|
FTP_ALLOW_PLAINTEXT=True
|
|
|
|
# SFTP
|
|
# Security Note: Host key verification is enabled by default (False)
|
|
# Only set to True in development/testing environments if needed
|
|
# When false, configure SSH known_hosts for proper host key verification
|
|
SFTP_HOST=sftp.example.com
|
|
SFTP_PORT=22
|
|
SFTP_USERNAME=sftp_user
|
|
SFTP_PASSWORD=your_secure_sftp_password
|
|
# SFTP_PRIVATE_KEY=/path/to/private_key.pem
|
|
# SFTP_PRIVATE_KEY_PASSPHRASE=optional_passphrase
|
|
SFTP_FOLDER=/Documents/Uploads
|
|
SFTP_DISABLE_HOST_KEY_VERIFICATION=False # Default is False (secure); set to True only for testing
|
|
|
|
# **HTTP Request Settings**
|
|
# Timeout for HTTP requests - set higher to handle large PDF files (up to 1GB)
|
|
HTTP_REQUEST_TIMEOUT=120 # Timeout in seconds (default: 120 for large file operations)
|
|
|
|
# **Notification Settings**
|
|
# Configure notification services using Apprise URL format
|
|
# See https://github.com/caronc/apprise#supported-notifications
|
|
# Examples:
|
|
# - Discord: discord://webhook_id/webhook_token
|
|
# - Telegram: tgram://bot_token/chat_id
|
|
# - Email: mailto://user:pass@example.com
|
|
# - Pushover: pover://user_key/app_token
|
|
# - Slack: slack://tokenA/tokenB/tokenC
|
|
# - Matrix: matrix://username:password@domain/#room
|
|
|
|
# You can specify multiple notification URLs by separating them with commas
|
|
NOTIFICATION_URLS=discord://webhook_id/webhook_token,mailto://user:pass@gmail.com,tgram://bot_token/chat_id
|
|
|
|
# Control when notifications are sent
|
|
NOTIFY_ON_TASK_FAILURE=True
|
|
NOTIFY_ON_CREDENTIAL_FAILURE=True
|
|
NOTIFY_ON_STARTUP=True
|
|
NOTIFY_ON_SHUTDOWN=False
|
|
NOTIFY_ON_FILE_PROCESSED=True
|
|
|
|
# Uptime Kuma
|
|
UPTIME_KUMA_URL=https://status.example.com/api/push/abcdef123456?status=up
|
|
UPTIME_KUMA_PING_INTERVAL=5
|