antoine
041fa054b3
The stack now refuses to create new organizations, users or agents without `JARVIS_LICENSE_KEY`. Everything already set up keeps running, and an instance with no key contacts nobody at all — but a fresh install gets as far as its first administrator account and then needs a key, and that was documented nowhere here. The README now lists, in full and field by field, everything a licensed instance sends: counts and a version string, no names, no addresses, no conversation text, no asset inventory, no credentials. The only field that identifies your network rather than measuring something is the public URL, and it can be switched off.
126 lines
6.1 KiB
Bash
126 lines
6.1 KiB
Bash
# Jarvis — configuration. Copy to `.env` beside the compose file and fill in.
|
|
#
|
|
# cp .env.example .env
|
|
#
|
|
# Nothing here has a safe placeholder value: the four secrets must be generated, and the two URLs
|
|
# must be yours. The compose file refuses to start rather than booting with something wrong.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Where your instance lives
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# The address a browser reaches Jarvis on, scheme included and no trailing slash.
|
|
#
|
|
# This is the CORS decision. It accepts exactly ONE origin — not a list — and every request from
|
|
# anywhere else is refused, which presents as a sign-in page that cannot sign in.
|
|
WEB_ORIGIN=https://jarvis.example.com
|
|
|
|
# The address enrolled machines dial. Defaults to WEB_ORIGIN, which is right for a single-origin
|
|
# deployment. Set it separately only if the app and the API answer on different hostnames.
|
|
#PUBLIC_URL=https://jarvis.example.com
|
|
|
|
# Host port the web container publishes. Put your TLS terminator in front of it.
|
|
JARVIS_PORT=8080
|
|
|
|
# How many proxies rewrite X-Forwarded-For before a request reaches the API.
|
|
#
|
|
# One is the web container's own nginx, which is always there. So: 1 if nothing else fronts it, 2 if
|
|
# your own reverse proxy does — which is the usual case and the default. Raising it is the dangerous
|
|
# direction, because the API then trusts that many hops of a header the client can forge, and a caller
|
|
# can choose the address that lands in the audit log and in the session list.
|
|
TRUST_PROXY_HOPS=2
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Secrets — generate every one of these, never copy them from anywhere
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Postgres. Only ever used inside the compose network.
|
|
# openssl rand -base64 24
|
|
POSTGRES_PASSWORD=
|
|
|
|
# Session signing. Two different values, at least 16 characters each.
|
|
# openssl rand -base64 48
|
|
JWT_ACCESS_SECRET=
|
|
JWT_REFRESH_SECRET=
|
|
|
|
# THE ONE YOU CANNOT LOSE.
|
|
#
|
|
# Must decode to exactly 32 bytes:
|
|
# openssl rand -base64 32
|
|
#
|
|
# Every credential in the vault — SSH keys, API secrets, Microsoft 365 client secrets, the outbound
|
|
# mail password — is encrypted under this key with AES-256-GCM. It is not stored anywhere but here.
|
|
#
|
|
# Change it or lose it and none of that data can be read again, by you or by anyone. A database backup
|
|
# does not save you: the backup holds the ciphertext. Back this value up separately from the database,
|
|
# somewhere you would still have it if this host were gone. An instance whose key has changed keeps
|
|
# LOOKING configured — the rows are all there — and fails on every reveal.
|
|
VAULT_MASTER_KEY=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# The model
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Any OpenAI-compatible endpoint: OpenAI, a self-hosted gateway, a local server.
|
|
#OPENAI_BASE_URL=https://api.openai.com/v1
|
|
|
|
# Required. Jarvis will not start without it.
|
|
OPENAI_API_KEY=
|
|
|
|
# Must be a model your endpoint actually serves, and it should be a good one — this model is deciding
|
|
# what to run on production infrastructure.
|
|
#OPENAI_MODEL=gpt-4o
|
|
|
|
# minimal | low | medium | high. Higher costs latency and tokens and is worth it for real work.
|
|
#OPENAI_THINKING_LEVEL=medium
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Pinning (optional, recommended in production)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Both services track `latest` unless you set these, so `docker compose pull && up -d` upgrades you.
|
|
# Pinning makes an upgrade a decision instead of a side effect of pulling. The app reports its real
|
|
# version either way — `latest` is a second name on the same image, not a build that forgot its number.
|
|
#JARVIS_IMAGE_API=git.luxit.be/luxit/jarvis-api:0.59.1
|
|
#JARVIS_IMAGE_WEB=git.luxit.be/luxit/jarvis-web:0.74.2
|
|
# Only read when the agent overlay is enabled, just below. Its version is the AGENT's, and moves
|
|
# independently of the two above — a Jarvis release usually does not change the agent at all.
|
|
#JARVIS_IMAGE_AGENT=git.luxit.be/luxit/jarvis-agent-dist:0.20.0
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# The Jarvis agent (optional)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Enrolling a machine downloads a compiled binary, which the api serves from a directory it can
|
|
# only read. `docker-compose.agent.yml` supplies that directory as a pullable image, so the release
|
|
# arrives the same way the rest of the stack does. Uncomment this and every later `docker compose`
|
|
# command picks up both files with no extra flags:
|
|
#
|
|
#COMPOSE_FILE=docker-compose.yml:docker-compose.agent.yml
|
|
#
|
|
# Leaving it off is a supported state, not a broken one: everything except the agent works, and the
|
|
# installer answers 503 saying no build is published. The SSH, Proxmox, Microsoft 365 and MikroTik
|
|
# connectors all reach machines without it.
|
|
#
|
|
# AGENT_RELEASE_DIR is set by that overlay and should NOT be set here — a value in this file would
|
|
# point the api at a path nothing populates, turning the honest 503 into a 404 per platform.
|
|
|
|
#AGENT_HEARTBEAT_INTERVAL_SEC=30
|
|
#RUN_SHUTDOWN_GRACE_SEC=25
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Licence (required to create anything)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# The key your provider gave you. REQUIRED to create anything new.
|
|
#
|
|
# Without it, an instance keeps running everything already set up and refuses to create new
|
|
# organizations, users and agents — so an existing deployment does not stop working when this
|
|
# reaches it, and a fresh install gets as far as its first administrator and then needs a key. An
|
|
# unlicensed instance also contacts nobody at all. See the README for exactly what a licensed one
|
|
# reports.
|
|
#
|
|
# This value SEEDS the database on first boot and does not govern it afterwards: a renewal arrives
|
|
# through the check-in and is stored, so leaving an old key here cannot roll you back.
|
|
#JARVIS_LICENSE_KEY=
|