5f28be5d58
Eliminate all code paths, configuration, and documentation related to running without authentication. Require AUTH_SECRET and BASE_URL at startup, updating middleware, server logic, and runtime checks to assume auth is always enabled. Simplify onboarding, settings, and test helpers to reflect mandatory auth. Update environment examples, Docker and deployment docs, and CI/test configs. Remove no-auth-specific UI flows, test cases, and feature toggles.
90 lines
4.6 KiB
Text
90 lines
4.6 KiB
Text
|
|
# Logging
|
|
# pretty (default): human-readable logs
|
|
# json: structured logs for log platforms
|
|
# LOG_FORMAT=pretty
|
|
# LOG_LEVEL=info
|
|
|
|
# Local / OpenAI TTS API Configuration (default)
|
|
# Suggest using https://github.com/remsky/Kokoro-FastAPI
|
|
#
|
|
# NOTE: On first boot, the server auto-seeds these values into a "default-openai"
|
|
# admin-managed shared provider (DB-backed, encrypted at rest). After that, the
|
|
# admin UI is authoritative and changing these env vars has no effect. You may
|
|
# remove them once the seed has run. Auth must be configured for this seed path.
|
|
# See Settings → Admin → Shared providers.
|
|
API_BASE=http://localhost:8880/v1
|
|
API_KEY=api_key_optional
|
|
|
|
# Auth configuration (required in v4+)
|
|
BASE_URL=http://localhost:3003 # Externally facing URL for this app (set to LAN IP for access from other devices on the network)
|
|
AUTH_SECRET=some_random_secret_key # Generate with `openssl rand -hex 32`
|
|
AUTH_TRUSTED_ORIGINS=http://localhost:3003,http://127.0.0.1:3003 # Additional trusted origins (BASE_URL is always trusted)
|
|
# (Optional) Allow anonymous auth sessions (default: `false`)
|
|
# USE_ANONYMOUS_AUTH_SESSIONS=false
|
|
# (Optional) Sign in w/ GitHub Configuration
|
|
# GITHUB_CLIENT_ID=
|
|
# GITHUB_CLIENT_SECRET=
|
|
|
|
# (Optional) Comma-separated list of emails that are auto-promoted to admin.
|
|
ADMIN_EMAILS=
|
|
|
|
# (Optional) Backend DB used for server-side metadata (documents/audiobooks) and auth tables.
|
|
# Defaults to SQLite at docstore/sqlite3.db when not set.
|
|
# POSTGRES_URL=
|
|
|
|
# Embedded SeaweedFS weed mini config
|
|
# (Optional) Enable embedded weed mini for local S3-compatible storage (defaults shown below)
|
|
# USE_EMBEDDED_WEED_MINI=true
|
|
# WEED_MINI_DIR=docstore/seaweedfs
|
|
# WEED_MINI_WAIT_SEC=20
|
|
|
|
# S3 storage config (use with embedded weed mini or external S3-compatible storage)
|
|
# (Optional) For embedded weed mini, set explicit keys if you want stable credentials across restarts.
|
|
S3_ACCESS_KEY_ID=
|
|
S3_SECRET_ACCESS_KEY=
|
|
S3_BUCKET=
|
|
# S3_REGION=
|
|
# (Optional) If empty in embedded mode, OpenReader uses BASE_URL host (when set) or detected LAN host.
|
|
# S3_ENDPOINT=
|
|
# S3_FORCE_PATH_STYLE=
|
|
# S3_PREFIX=
|
|
|
|
# (Optional) Library import mode directory (uses /docstore/library by default)
|
|
# IMPORT_LIBRARY_DIR=
|
|
# IMPORT_LIBRARY_DIRS=
|
|
|
|
# Compute worker configuration
|
|
# (Optional) Embedded compute worker (automatic startup) for local compute tasks (defaults shown below)
|
|
# EMBEDDED_COMPUTE_WORKER_PORT=8081
|
|
# EMBEDDED_NATS_PORT=4222
|
|
# EMBEDDED_NATS_MONITOR_PORT=8222
|
|
# EMBEDDED_NATS_STORE_DIR=docstore/nats/jetstream
|
|
# NATS_URL=nats://127.0.0.1:4222
|
|
# COMPUTE_LOG_LEVEL=info
|
|
# COMPUTE_JOB_CONCURRENCY=1
|
|
# COMPUTE_WHISPER_TIMEOUT_MS=30000
|
|
# COMPUTE_PDF_TIMEOUT_MS=300000
|
|
# COMPUTE_OP_STALE_MS=1800000
|
|
# WHISPER_MODEL_BASE_URL=https://huggingface.co/onnx-community/whisper-base_timestamped/resolve/main
|
|
# PDF_LAYOUT_MODEL_BASE_URL=https://huggingface.co/Bei0001/PP-DocLayoutV3-ONNX/resolve/main
|
|
# (Optional) External compute worker config (see docs/deploy/compute-worker)
|
|
# COMPUTE_WORKER_URL=http://localhost:8081
|
|
# COMPUTE_WORKER_TOKEN=local-compute-token
|
|
|
|
# (Optional) Override ffmpeg binary path used for audio processing
|
|
# FFMPEG_BIN=
|
|
|
|
# (Optional) Test/dev overrides
|
|
# DISABLE_AUTH_RATE_LIMIT=false
|
|
# ENABLE_TEST_NAMESPACE=false
|
|
|
|
# (Optional) Skip automatic startup migrations when set to `false` (default: `true`)
|
|
# RUN_DRIZZLE_MIGRATIONS=true
|
|
# (Optional) Skip automatic filesystem->S3/DB migration pass when set to `false` (default: `true`)
|
|
# RUN_FS_MIGRATIONS=true
|
|
|
|
# (Optional) v4 JSON seed for first-boot runtime config + shared providers.
|
|
# If both are set, RUNTIME_SEED_JSON_PATH is used.
|
|
# RUNTIME_SEED_JSON_PATH=/absolute/path/to/openreader-seed.json
|
|
# RUNTIME_SEED_JSON={"version":1,"runtimeConfig":{"enableUserSignups":true,"restrictUserApiKeys":true,"defaultTtsProvider":"custom-openai","enableTtsProvidersTab":true,"enableAudiobookExport":true,"enableDocxConversion":true,"enableDestructiveDeleteActions":true,"showAllProviderModels":true,"disableTtsRateLimit":true,"ttsDailyLimitAnonymous":50000,"ttsDailyLimitAuthenticated":500000,"ttsIpDailyLimitAnonymous":100000,"ttsIpDailyLimitAuthenticated":1000000,"ttsCacheMaxSizeBytes":268435456,"ttsCacheTtlMs":1800000,"ttsUpstreamMaxRetries":2,"ttsUpstreamTimeoutMs":285000,"disableComputeRateLimit":true,"computeParseBurstMax":8,"computeParseBurstWindowSec":60,"computeParseSustainedMax":24,"computeParseSustainedWindowSec":600,"maxUploadMb":200,"changelogFeedUrl":"https://docs.openreader.richardr.dev/changelog/manifest.json"},"providers":[{"slug":"default-openai","displayName":"Default (seeded)","providerType":"custom-openai","baseUrl":"http://localhost:8880/v1","apiKey":"api_key_optional","defaultModel":"kokoro","enabled":true}]}
|