mirror of
https://github.com/nearai/ironclaw.git
synced 2026-09-02 23:56:24 +08:00
293 lines
13 KiB
Plaintext
293 lines
13 KiB
Plaintext
# Database Configuration
|
||
DATABASE_URL=postgres://localhost/ironclaw
|
||
DATABASE_POOL_SIZE=30 # multi-tenant default; reduce to 5-10 for single-user or low-resource deployments
|
||
|
||
# LLM Provider
|
||
# LLM_BACKEND=nearai # default
|
||
# Possible values: nearai, ollama, openai_compatible, openai, anthropic, github_copilot, tinfoil, openai_codex, gemini_oauth
|
||
# LLM_REQUEST_TIMEOUT_SECS=120 # Increase for local LLMs (Ollama, vLLM, LM Studio)
|
||
|
||
# === Anthropic Direct ===
|
||
# Two auth modes:
|
||
# 1. API key: Set ANTHROPIC_API_KEY (from console.anthropic.com/settings/keys)
|
||
# 2. OAuth token: Set ANTHROPIC_OAUTH_TOKEN (from `claude login`)
|
||
# OAuth tokens use Authorization: Bearer instead of x-api-key header.
|
||
# ANTHROPIC_API_KEY=sk-ant-...
|
||
# ANTHROPIC_OAUTH_TOKEN=sk-ant-oat01-... # from `claude login` credentials
|
||
# ANTHROPIC_MODEL=claude-sonnet-4-20250514
|
||
|
||
# === OpenAI Direct ===
|
||
# OPENAI_API_KEY=sk-...
|
||
# Reuse Codex CLI auth.json instead of setting OPENAI_API_KEY manually.
|
||
# Works with both OpenAI API-key mode and Codex ChatGPT OAuth mode.
|
||
# In ChatGPT mode this uses the private `chatgpt.com/backend-api/codex` endpoint.
|
||
# LLM_USE_CODEX_AUTH=true
|
||
# CODEX_AUTH_PATH=~/.codex/auth.json
|
||
|
||
# === GitHub Copilot ===
|
||
# Uses the OAuth token from your Copilot IDE sign-in (for example
|
||
# ~/.config/github-copilot/apps.json on Linux/macOS), or run `ironclaw onboard`
|
||
# and choose the GitHub device login flow.
|
||
# LLM_BACKEND=github_copilot
|
||
# GITHUB_COPILOT_TOKEN=gho_...
|
||
# GITHUB_COPILOT_MODEL=gpt-4o
|
||
# IronClaw injects standard VS Code Copilot headers automatically.
|
||
# Optional advanced headers for custom overrides:
|
||
# GITHUB_COPILOT_EXTRA_HEADERS=Copilot-Integration-Id:vscode-chat
|
||
|
||
# === NEAR AI (Chat Completions API) ===
|
||
# Two auth modes:
|
||
# 1. Session token (default): Uses browser OAuth (GitHub/Google) on first run.
|
||
# Session token stored in ~/.ironclaw/session.json automatically.
|
||
# Base URL defaults to https://private.near.ai
|
||
# 2. API key: Set NEARAI_API_KEY to use API key auth from cloud.near.ai.
|
||
# Base URL defaults to https://cloud-api.near.ai
|
||
# When both NEARAI_BASE_URL and NEARAI_API_KEY are set at startup,
|
||
# IronClaw also bootstraps a persisted `nearai` MCP server using the
|
||
# same base URL and Authorization header.
|
||
NEARAI_MODEL=Qwen/Qwen3.5-122B-A10B
|
||
NEARAI_BASE_URL=https://private.near.ai
|
||
NEARAI_AUTH_URL=https://private.near.ai
|
||
# NEARAI_SESSION_TOKEN=sess_... # hosting providers: set this
|
||
# NEARAI_SESSION_PATH=~/.ironclaw/session.json # optional, default shown
|
||
# NEARAI_API_KEY=... # API key from cloud.near.ai
|
||
|
||
# Local LLM Providers (Ollama, LM Studio, vLLM, LiteLLM)
|
||
|
||
# === Ollama ===
|
||
# OLLAMA_MODEL=llama3.2
|
||
# LLM_BACKEND=ollama
|
||
# OLLAMA_BASE_URL=http://localhost:11434 # default
|
||
|
||
# === OpenAI-compatible (LM Studio, vLLM, Anything-LLM) ===
|
||
# LLM_MODEL=llama-3.2-3b-instruct-q4_K_M
|
||
# LLM_BACKEND=openai_compatible
|
||
# LLM_BASE_URL=http://localhost:1234/v1
|
||
# LLM_API_KEY=sk-... # optional for local servers
|
||
# Custom HTTP headers for OpenAI-compatible providers
|
||
# Format: comma-separated key:value pairs
|
||
# LLM_EXTRA_HEADERS=HTTP-Referer:https://github.com/nearai/ironclaw,X-Title:ironclaw
|
||
|
||
# === OpenRouter (300+ models via OpenAI-compatible) ===
|
||
# LLM_MODEL=anthropic/claude-sonnet-4 # see openrouter.ai/models for IDs
|
||
# LLM_BACKEND=openai_compatible
|
||
# LLM_BASE_URL=https://openrouter.ai/api/v1
|
||
# LLM_API_KEY=sk-or-...
|
||
|
||
# LLM_EXTRA_HEADERS=HTTP-Referer:https://myapp.com,X-Title:MyApp
|
||
|
||
|
||
# === Together AI (via OpenAI-compatible) ===
|
||
# LLM_MODEL=meta-llama/Llama-3.3-70B-Instruct-Turbo
|
||
# LLM_BACKEND=openai_compatible
|
||
# LLM_BASE_URL=https://api.together.xyz/v1
|
||
# LLM_API_KEY=...
|
||
|
||
# === Fireworks AI (via OpenAI-compatible) ===
|
||
# LLM_MODEL=accounts/fireworks/models/llama4-maverick-instruct-basic
|
||
# LLM_BACKEND=openai_compatible
|
||
# LLM_BASE_URL=https://api.fireworks.ai/inference/v1
|
||
# LLM_API_KEY=fw_...
|
||
|
||
# === MiniMax ===
|
||
# LLM_BACKEND=minimax
|
||
# MINIMAX_API_KEY=...
|
||
# MINIMAX_MODEL=MiniMax-M2.7
|
||
# MINIMAX_BASE_URL=https://api.minimax.io/v1 # default (global); use https://api.minimaxi.com/v1 for China
|
||
|
||
# === Anthropic Direct ===
|
||
# LLM_BACKEND=anthropic
|
||
# ANTHROPIC_MODEL=claude-sonnet-4-6
|
||
# ANTHROPIC_API_KEY=sk-ant-...
|
||
# ANTHROPIC_BASE_URL=https://api.anthropic.com # default
|
||
# Prompt cache retention — controls Anthropic server-side prompt caching:
|
||
# none = disabled (no cache_control injected)
|
||
# short = 5-minute TTL, 1.25× (125%) write surcharge (default)
|
||
# long = 1-hour TTL, 2.0× (200%) write surcharge
|
||
# ANTHROPIC_CACHE_RETENTION=short
|
||
|
||
# === OpenAI Codex (ChatGPT subscription, OAuth) ===
|
||
# LLM_BACKEND=openai_codex
|
||
# OPENAI_CODEX_MODEL=gpt-5.3-codex # default
|
||
# OPENAI_CODEX_CLIENT_ID=app_EMoamEEZ73f0CkXaXp7hrann # override (rare)
|
||
# OPENAI_CODEX_AUTH_URL=https://auth.openai.com # override (rare)
|
||
# OPENAI_CODEX_API_URL=https://chatgpt.com/backend-api/codex # override (rare)
|
||
|
||
# === Google Gemini (OAuth, Gemini CLI compatible) ===
|
||
# LLM_BACKEND=gemini_oauth
|
||
# GEMINI_MODEL=gemini-2.5-flash # default
|
||
# GEMINI_CREDENTIALS_PATH=~/.gemini/oauth_creds.json # default
|
||
# GEMINI_API_KEY=... # optional: use API key instead of OAuth
|
||
# GEMINI_API_KEY_AUTH_MECHANISM=query # "query" (default) or "header"
|
||
# GEMINI_SAFETY_BLOCK_NONE=true # disable safety filters (default: false)
|
||
# GEMINI_CLI_CUSTOM_HEADERS=Key:Value,Key2:Value2
|
||
# GEMINI_TOP_P=0.95
|
||
# GEMINI_TOP_K=40
|
||
# GEMINI_SEED=42
|
||
# GEMINI_PRESENCE_PENALTY=0.0
|
||
# GEMINI_FREQUENCY_PENALTY=0.0
|
||
# GEMINI_RESPONSE_MIME_TYPE=application/json
|
||
# GEMINI_RESPONSE_JSON_SCHEMA={"type":"object"}
|
||
# GEMINI_CACHED_CONTENT=cachedContents/abc123
|
||
|
||
# For full provider setup guide see docs/LLM_PROVIDERS.md
|
||
|
||
# Channel Configuration
|
||
# CLI is always enabled
|
||
|
||
# Slack Bot (optional)
|
||
SLACK_BOT_TOKEN=xoxb-...
|
||
SLACK_APP_TOKEN=xapp-...
|
||
SLACK_SIGNING_SECRET=...
|
||
|
||
# Telegram Bot (optional)
|
||
TELEGRAM_BOT_TOKEN=...
|
||
|
||
# HTTP Webhook Server (optional)
|
||
HTTP_HOST=0.0.0.0
|
||
HTTP_PORT=8080
|
||
HTTP_WEBHOOK_SECRET=your-webhook-secret
|
||
# Webhook authentication uses HMAC-SHA256 signature verification.
|
||
# Callers must send an X-IronClaw-Signature header with format: sha256=<hex_digest>
|
||
# where the digest is HMAC-SHA256(HTTP_WEBHOOK_SECRET, raw_request_body) in lowercase hex.
|
||
#
|
||
# Example (bash):
|
||
# BODY='{"content":"hello"}'
|
||
# SIG=$(echo -n "$BODY" | openssl dgst -sha256 -hmac "$HTTP_WEBHOOK_SECRET" | cut -d' ' -f2)
|
||
# curl -X POST http://localhost:8080/webhook \
|
||
# -H "Content-Type: application/json" \
|
||
# -H "X-IronClaw-Signature: sha256=$SIG" \
|
||
# -d "$BODY"
|
||
#
|
||
# DEPRECATED: Passing "secret" in the JSON body still works but will be removed in a future release.
|
||
|
||
# Signal Channel (optional, requires signal-cli daemon --http)
|
||
# SIGNAL_HTTP_URL=http://127.0.0.1:8080
|
||
# SIGNAL_ACCOUNT=+1234567890
|
||
# SIGNAL_ALLOW_FROM=+1234567890,uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx # comma-separated, * for all, empty = deny/require pairing
|
||
# SIGNAL_ALLOW_FROM_GROUPS= # comma-separated group IDs, * for all, empty = deny all groups
|
||
# SIGNAL_DM_POLICY=pairing # open | allowlist | pairing
|
||
# SIGNAL_GROUP_POLICY=allowlist # allowlist | open | disabled
|
||
# SIGNAL_GROUP_ALLOW_FROM= # comma-separated, empty = inherit from ALLOW_FROM
|
||
# SIGNAL_IGNORE_ATTACHMENTS=false
|
||
# SIGNAL_IGNORE_STORIES=true
|
||
|
||
# Agent Settings
|
||
# Engine v2 is opt-in. Set this to true to route messages through the new engine.
|
||
# ENGINE_V2=true
|
||
AGENT_NAME=ironclaw
|
||
AGENT_MAX_PARALLEL_JOBS=5
|
||
AGENT_JOB_TIMEOUT_SECS=3600
|
||
AGENT_STUCK_THRESHOLD_SECS=300
|
||
# Maximum tokens per job (0 = unlimited, also settable via settings.json agent.max_tokens_per_job)
|
||
# AGENT_MAX_TOKENS_PER_JOB=0
|
||
# Enable planning phase before tool execution (default: true)
|
||
AGENT_USE_PLANNING=true
|
||
|
||
# Self-repair settings
|
||
SELF_REPAIR_CHECK_INTERVAL_SECS=60
|
||
SELF_REPAIR_MAX_ATTEMPTS=3
|
||
|
||
# Heartbeat settings (proactive periodic execution)
|
||
# When enabled, reads HEARTBEAT.md checklist and reports findings
|
||
HEARTBEAT_ENABLED=false
|
||
HEARTBEAT_INTERVAL_SECS=1800
|
||
HEARTBEAT_NOTIFY_CHANNEL=cli
|
||
HEARTBEAT_NOTIFY_USER=default
|
||
|
||
# Memory hygiene settings (automatic cleanup of stale workspace documents)
|
||
# Runs on each heartbeat tick; discovers cleanup targets from .config metadata
|
||
# MEMORY_HYGIENE_ENABLED=true
|
||
# MEMORY_HYGIENE_VERSION_KEEP_COUNT=50 # max versions to keep per document
|
||
# MEMORY_HYGIENE_CADENCE_HOURS=12 # minimum hours between cleanup passes
|
||
|
||
# Docker Sandbox
|
||
# SANDBOX_ENABLED=true
|
||
# SANDBOX_POLICY=readonly # readonly, workspace_write, or full_access
|
||
# SANDBOX_ALLOW_FULL_ACCESS=false # REQUIRED second opt-in for full_access policy.
|
||
# # FullAccess bypasses Docker entirely and runs
|
||
# # commands directly on the host. Without this
|
||
# # set to "true", full_access is downgraded to
|
||
# # workspace_write.
|
||
# SANDBOX_IMAGE=ironclaw-worker:latest
|
||
# SANDBOX_TIMEOUT_SECS=120
|
||
# SANDBOX_MEMORY_LIMIT_MB=2048
|
||
|
||
# ACP (Agent Client Protocol) agents
|
||
# ACP_ENABLED=false # Enable ACP agent sandbox mode
|
||
# ACP_MEMORY_LIMIT_MB=4096 # Memory limit for ACP containers
|
||
# ACP_TIMEOUT_SECS=1800 # Maximum session timeout
|
||
# Configure agents via CLI: ironclaw acp add goose --command goose --arg "--stdio"
|
||
|
||
# Safety settings
|
||
SAFETY_MAX_OUTPUT_LENGTH=100000
|
||
SAFETY_INJECTION_CHECK_ENABLED=true
|
||
|
||
# Restart Feature (Docker containers only)
|
||
# Set IRONCLAW_IN_DOCKER=true in the container entrypoint to enable the restart feature.
|
||
# Without this, the restart tool and /restart command will be disabled.
|
||
# IRONCLAW_IN_DOCKER=false
|
||
# IRONCLAW_RESTART_DELAY=5 # default wait before exit (seconds, range: 1-30)
|
||
# IRONCLAW_MAX_FAILURES=10 # max consecutive failures before container exits
|
||
|
||
# ─── OAuth / Social Login ────────────────────────────────────────────────
|
||
# Enable direct OAuth login (Google, GitHub). Disabled by default.
|
||
# OAUTH_ENABLED=true
|
||
|
||
# Base URL for OAuth callback URLs. Defaults to http://localhost:{GATEWAY_PORT}.
|
||
# Set this to your public URL in production (e.g., https://myapp.example.com).
|
||
# OAUTH_BASE_URL=https://myapp.example.com
|
||
|
||
# Restrict OAuth login to specific email domains (comma-separated).
|
||
# When set, only users with verified emails from these domains can log in.
|
||
# Applies to all OAuth providers and OIDC. Leave unset to allow all domains.
|
||
# OAUTH_ALLOWED_DOMAINS=company.com,partner.org
|
||
|
||
# Google OAuth — Create credentials at https://console.cloud.google.com/apis/credentials
|
||
# 1. Create an OAuth 2.0 Client ID (Web application type)
|
||
# 2. Add authorized redirect URI: {OAUTH_BASE_URL}/auth/callback/google
|
||
# 3. Copy Client ID and Client Secret below
|
||
# GOOGLE_CLIENT_ID=
|
||
# GOOGLE_CLIENT_SECRET=
|
||
|
||
# Restrict Google login to a specific Workspace (G Suite) domain.
|
||
# Adds the `hd` parameter to the authorization URL and validates server-side.
|
||
# GOOGLE_ALLOWED_HD=company.com
|
||
|
||
# Apple Sign In — Configure in https://developer.apple.com/account/resources/identifiers
|
||
# 1. Register a Services ID (e.g. com.example.myapp) under Identifiers
|
||
# 2. Enable "Sign In with Apple" and configure the return URL: {OAUTH_BASE_URL}/auth/callback/apple
|
||
# 3. Create a key (Keys section), enable "Sign In with Apple", download the .p8 file
|
||
# 4. Note your Team ID (top right of developer portal) and Key ID
|
||
# APPLE_CLIENT_ID=com.example.myapp
|
||
# APPLE_TEAM_ID=XXXXXXXXXX
|
||
# APPLE_KEY_ID=YYYYYYYYYY
|
||
# APPLE_PRIVATE_KEY_PATH=/path/to/AuthKey_YYYYYYYYYY.p8
|
||
# Or inline: APPLE_PRIVATE_KEY_PEM="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
|
||
|
||
# GitHub OAuth — Create an OAuth App at https://github.com/settings/developers
|
||
# 1. Create a new OAuth App
|
||
# 2. Set Authorization callback URL to: {OAUTH_BASE_URL}/auth/callback/github
|
||
# 3. Copy Client ID and generate a Client Secret below
|
||
# GITHUB_CLIENT_ID=
|
||
# GITHUB_CLIENT_SECRET=
|
||
|
||
# NEAR Wallet — No external setup needed. Users sign in with any NEAR wallet
|
||
# (HOT, Meteor, MyNearWallet, etc.) via the near-connect SDK.
|
||
# NEAR_AUTH_ENABLED=true
|
||
# NEAR_AUTH_NETWORK=mainnet # or testnet
|
||
# NEAR_AUTH_RPC_URL=https://rpc.mainnet.near.org # auto-detected from network
|
||
|
||
# ─── OIDC / SSO (Okta, Cognito, etc.) ──────────────────────────────────
|
||
# For reverse-proxy SSO (e.g., AWS ALB + Okta). The gateway validates JWTs
|
||
# from the configured header. See also OAUTH_ALLOWED_DOMAINS above, which
|
||
# applies to OIDC logins too.
|
||
# GATEWAY_OIDC_ENABLED=true
|
||
# GATEWAY_OIDC_JWKS_URL=https://your-idp.example.com/.well-known/jwks.json
|
||
# GATEWAY_OIDC_HEADER=x-amzn-oidc-data
|
||
# GATEWAY_OIDC_ISSUER=https://your-idp.example.com
|
||
# GATEWAY_OIDC_AUDIENCE=your-client-id
|
||
|
||
# Logging
|
||
RUST_LOG=ironclaw=debug,tower_http=debug
|