skillhub/.env.release.example

# `latest` tracks the latest stable release image.
# For deterministic environments, pin a release tag like `v0.1.0`.
# Use `edge` only when you explicitly want the latest build from `main`.
SKILLHUB_VERSION=latest
SKILLHUB_SERVER_IMAGE=ghcr.io/iflytek/skillhub-server
SKILLHUB_WEB_IMAGE=ghcr.io/iflytek/skillhub-web
SKILLHUB_SCANNER_IMAGE=ghcr.io/iflytek/skillhub-scanner
POSTGRES_IMAGE=postgres:16-alpine
REDIS_IMAGE=redis:7-alpine

# Public entrypoint seen by browsers/CLI, no trailing slash.
# Default to localhost so `runtime.sh up` works as a zero-config quickstart.
SKILLHUB_PUBLIC_BASE_URL=http://localhost

# Suite Bundle rollout controls. Confirmation is opt-in; review writes remain enabled
# for the single-server release Compose topology.
SKILLHUB_SUITE_BUNDLE_CONFIRMATION_ENABLED=false
SKILLHUB_SUITE_REVIEW_WRITES_ENABLED=true

# Frontend usually keeps this empty and proxies to the backend through nginx.
SKILLHUB_WEB_API_BASE_URL=
SKILLHUB_API_UPSTREAM=http://server:8080
# Keep false for direct exposure. Enable only behind a trusted proxy that replaces
# X-Forwarded-Proto and blocks direct access to the web container.
SKILLHUB_TRUST_FORWARDED_PROTO=false

# Sub-path deployment example. Keep all three public/browser values aligned:
# SKILLHUB_PUBLIC_BASE_URL=https://example.com/skillhub
# SKILLHUB_WEB_API_BASE_URL=/skillhub
# SKILLHUB_WEB_BASE_PATH=/skillhub/
# Leave empty so a fixed-base image keeps its baked base; set to a sub-path to override.
SKILLHUB_WEB_BASE_PATH=

# 可选前端动作统计，默认关闭。配置方法见 docs/frontend-analytics-integration.md。
# 只放公开参数，不放平台密钥。JSON 保持一行；Compose .env 中可用单引号包裹。
# 修改后需重新创建 Web（up -d --force-recreate web），restart 不会重新读取本文件。
# Managed by runtime.sh analytics-enable/analytics-disable. For manual setup,
# restart Web after editing. Local Umami requires the external network overlay.
SKILLHUB_ANALYTICS_NETWORK_ENABLED=false
# Give each local installation a unique project and network name if sharing a host.
SKILLHUB_ANALYTICS_PROJECT=skillhub-analytics
SKILLHUB_ANALYTICS_NETWORK=skillhub-analytics
SKILLHUB_WEB_ANALYTICS_CONFIG=
# 仅 Web 代理使用的 HTTP(S) origin，无路径、凭证、查询或末尾斜杠。
SKILLHUB_WEB_ANALYTICS_UPSTREAM=

POSTGRES_BIND_ADDRESS=127.0.0.1
POSTGRES_PORT=5432
POSTGRES_DB=skillhub
POSTGRES_USER=skillhub
POSTGRES_PASSWORD=change-this-postgres-password

REDIS_BIND_ADDRESS=127.0.0.1
REDIS_PORT=6379

# Optional external Redis connection. Leave these commented to use the bundled
# standalone Redis service. For Redis Cluster, every advertised node address
# must be reachable from the server container.
# SPRING_DATA_REDIS_CLUSTER_NODES=redis-0.example.com:6379,redis-1.example.com:6379,redis-2.example.com:6379
# SPRING_DATA_REDIS_CLUSTER_MAX_REDIRECTS=5
# SPRING_DATA_REDIS_USERNAME=
# SPRING_DATA_REDIS_PASSWORD=
# SPRING_DATA_REDIS_SSL_ENABLED=false
# SPRING_DATA_REDIS_CONNECT_TIMEOUT=5s
# SPRING_DATA_REDIS_TIMEOUT=3s
# SPRING_DATA_REDIS_CLIENT_NAME=skillhub

# Optional external Redis Sentinel. Sentinel takes precedence if both Sentinel
# and Cluster settings are present. Use separate credentials when Sentinel ACL
# differs from the Redis data nodes.
# SPRING_DATA_REDIS_SENTINEL_MASTER=mymaster
# SPRING_DATA_REDIS_SENTINEL_NODES=sentinel-0.example.com:26379,sentinel-1.example.com:26379,sentinel-2.example.com:26379
# SPRING_DATA_REDIS_SENTINEL_USERNAME=
# SPRING_DATA_REDIS_SENTINEL_PASSWORD=
# SKILLHUB_REDIS_SENTINEL_CHECK_SENTINELS_LIST=true

API_PORT=8080
WEB_PORT=80
SESSION_COOKIE_SECURE=false

# Observability defaults require no Collector or tracing backend.
# Use json in container deployments when stdout is collected centrally.
# Opt in to protected metrics with health,info,metrics,prometheus; never use '*'.
SKILLHUB_ACTUATOR_EXPOSURE_INCLUDE=health,info
SKILLHUB_TRACING_MODE=none
SKILLHUB_LOG_FORMAT=json
SKILLHUB_LOG_ASYNC_QUEUE_SIZE=1024
SKILLHUB_SERVICE_VERSION=unknown
SKILLHUB_SERVICE_ENVIRONMENT=production
SKILLHUB_TRACING_SAMPLING_PROBABILITY=0.1
# Set only with SKILLHUB_TRACING_MODE=otel-sdk.
MANAGEMENT_OTLP_TRACING_ENDPOINT=
SKILLHUB_OTLP_TIMEOUT=5s
SKILLHUB_OTLP_COMPRESSION=gzip

# Independent, lossy business analytics. Default off; no receiver required.
# Full catalog, Secret injection and Collector query example: docs/business-event-logs.md
SKILLHUB_BUSINESS_LOGS_ENABLED=false
# Managed by runtime.sh; unique names per installation on a shared Docker host.
SKILLHUB_BUSINESS_LOGS_NETWORK_ENABLED=false
SKILLHUB_BUSINESS_LOGS_NETWORK=skillhub-business-logs
SKILLHUB_BUSINESS_LOGS_PROJECT=skillhub-business-logs
SKILLHUB_BUSINESS_LOGS_ENDPOINT=
# URL-encoded name=value pairs, comma-separated; inject from deployment Secrets, never commit real values.
SKILLHUB_BUSINESS_LOGS_HEADERS=
SKILLHUB_BUSINESS_LOGS_TIMEOUT=3s
SKILLHUB_BUSINESS_LOGS_COMPRESSION=gzip
SKILLHUB_BUSINESS_LOGS_MAX_QUEUE_SIZE=2048
SKILLHUB_BUSINESS_LOGS_MAX_EXPORT_BATCH_SIZE=256
SKILLHUB_BUSINESS_LOGS_SCHEDULE_DELAY=1s
SKILLHUB_BUSINESS_LOGS_SHUTDOWN_TIMEOUT=5s
SKILLHUB_BUSINESS_LOGS_RETRY_MAX_ATTEMPTS=3
SKILLHUB_BUSINESS_LOGS_RETRY_INITIAL_BACKOFF=200ms
SKILLHUB_BUSINESS_LOGS_RETRY_MAX_BACKOFF=1s
SKILLHUB_BUSINESS_LOGS_EVENT_ALLOWLIST=skill.publication.effective,skill.download.prepared,skill.review.approved,skill.review.rejected,skill.promotion.approved,skill.promotion.rejected,skill.status.changed,skill.visibility.changed,skill.version.yanked
# Empty = all namespaces, INCLUDING private-resource IDs; never names/content.
SKILLHUB_BUSINESS_LOGS_NAMESPACE_ALLOWLIST=

# Zero-config runtime validation uses local storage.
# Switch to `s3` and fill the fields below before a real production deployment.
SKILLHUB_STORAGE_PROVIDER=local
SKILLHUB_STORAGE_S3_ENDPOINT=https://oss-cn-example.aliyuncs.com
SKILLHUB_STORAGE_S3_PUBLIC_ENDPOINT=
SKILLHUB_STORAGE_S3_BUCKET=skillhub-prod
# Static credentials for S3-compatible storage (MinIO, Alibaba OSS, etc.).
# Leave both blank to use IAM authentication (EC2 instance profile, ECS task role, EKS IRSA).
SKILLHUB_STORAGE_S3_ACCESS_KEY=replace-me
SKILLHUB_STORAGE_S3_SECRET_KEY=replace-me
SKILLHUB_STORAGE_S3_REGION=cn-shanghai
SKILLHUB_STORAGE_S3_FORCE_PATH_STYLE=false
# Aliyun OSS rejects aws-chunked encoding; set to true when targeting Aliyun OSS.
SKILLHUB_STORAGE_S3_DISABLE_CHUNKED_ENCODING=true
SKILLHUB_STORAGE_S3_AUTO_CREATE_BUCKET=false
SKILLHUB_STORAGE_S3_PRESIGN_EXPIRY=PT10M
# When enabling GitHub sync with S3, set the staging prefix byte budget from real storage capacity.
SKILLHUB_GITHUB_SYNC_STAGING_CAPACITY_LIMIT_BYTES=0
# Enable the optional github-sync profile only after filling the shared Java/Go token.
SKILLHUB_GITHUB_SYNC_SERVICE_TOKEN=
SKILLHUB_GITHUB_SYNC_SERVICE_TOKENS=
# S3/MinIO: comma-separated internal hosts (host:port) used by presigned PUT URLs.
SKILLHUB_GITHUB_SYNC_ALLOWED_S3_HOSTS=
# Optional system credential pool; both fields stay blank for anonymous public API access.
SKILLHUB_GITHUB_SYNC_CREDENTIAL_KEYS=
SKILLHUB_GITHUB_SYNC_ACTIVE_CREDENTIAL_KEY_VERSION=
# Optional GitHub outbound proxy; Java internal and staging PUT requests stay direct.
SKILLHUB_GITHUB_SYNC_HTTP_PROXY=
SKILLHUB_GITHUB_SYNC_HTTPS_PROXY=
SKILLHUB_GITHUB_SYNC_NO_PROXY=

# Bootstrap local admin account for first login. Rotate or disable after initial setup.
BOOTSTRAP_ADMIN_ENABLED=true
BOOTSTRAP_ADMIN_USER_ID=docker-admin
BOOTSTRAP_ADMIN_USERNAME=admin
BOOTSTRAP_ADMIN_PASSWORD=ChangeMe!2026
BOOTSTRAP_ADMIN_DISPLAY_NAME=Platform Admin
BOOTSTRAP_ADMIN_EMAIL=admin@example.com

# Optional override. Defaults to ${SKILLHUB_PUBLIC_BASE_URL}/device.
DEVICE_AUTH_VERIFICATION_URI=

# Optional: configure real GitHub OAuth before exposing the stack to other users.
OAUTH2_GITHUB_CLIENT_ID=
OAUTH2_GITHUB_CLIENT_SECRET=

# Optional: configure real GitLab OAuth before exposing the stack to other users.
# Set OAUTH2_GITLAB_BASE_URI to your self-hosted GitLab URL when applicable.
OAUTH2_GITLAB_CLIENT_ID=
OAUTH2_GITLAB_CLIENT_SECRET=
OAUTH2_GITLAB_BASE_URI=https://gitlab.com
OAUTH2_GITLAB_DISPLAY_NAME=GitLab

# Optional: Feishu (Lark) login as a public sign-in provider. Leaving the client id empty keeps
# the button off the login page. Grant contact:user.base:readonly and
# contact:user.email:readonly on the Feishu open-platform app itself; scopes are not sent here.
# Full Feishu endpoints are configurable for Lark international, private deployments, and gateways.
# Legacy OAUTH2_FEISHU_AUTHORIZE_URI/OAUTH2_FEISHU_BASE_URI remain supported as base-URI fallbacks.
# The token endpoint must accept Feishu's JSON authorization-code exchange contract. Supported
# token protocols are v2 and v3; v3 is the default. Selection is explicit and never falls back.
# Feishu emails are admin-imported and never confirmed with the user, so emailVerified is always
# false. If you set skillhub.access-policy.mode=EMAIL_DOMAIN in application.yml, that policy
# denies every unverified email and Feishu login will always fail; keep the default OPEN mode,
# or use another policy, when enabling this provider.
OAUTH2_FEISHU_CLIENT_ID=
OAUTH2_FEISHU_CLIENT_SECRET=
OAUTH2_FEISHU_AUTHORIZATION_URI=https://accounts.feishu.cn/open-apis/authen/v1/authorize
OAUTH2_FEISHU_PROTOCOL_VERSION=v3
OAUTH2_FEISHU_TOKEN_URI=https://accounts.feishu.cn/oauth/v3/token
OAUTH2_FEISHU_USER_INFO_URI=https://open.feishu.cn/open-apis/authen/v1/user_info
# Optional; defaults to {baseUrl}/login/oauth2/code/feishu. Set explicitly for local previews or reverse proxies.
OAUTH2_FEISHU_REDIRECT_URI=
OAUTH2_FEISHU_DISPLAY_NAME=飞书

# Optional: DingTalk login as a public sign-in provider. Leaving the client id empty keeps the
# button off the login page. Use the app's AppKey as the client id and AppSecret as the secret.
# Like Feishu, DingTalk returns an organization-recorded email without attesting ownership, so
# emailVerified is always false and the EMAIL_DOMAIN access policy would reject every login.
# The DingTalk console's server egress IP must be the real public IP of the backend calling
# api.dingtalk.com. A reverse tunnel only changes callback ingress and does not change egress.
OAUTH2_DINGTALK_CLIENT_ID=
OAUTH2_DINGTALK_CLIENT_SECRET=
OAUTH2_DINGTALK_AUTHORIZE_URI=https://login.dingtalk.com
OAUTH2_DINGTALK_BASE_URI=https://api.dingtalk.com
# Optional; defaults to {baseUrl}/login/oauth2/code/dingtalk.
OAUTH2_DINGTALK_REDIRECT_URI=
OAUTH2_DINGTALK_DISPLAY_NAME=钉钉

# Optional: OIDC login (e.g. Keycloak, Okta, Azure AD).
# Replace "OIDC" in variable names with your registration id (uppercase).
# The registration id becomes identity_binding.provider_code — keep it stable.
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_ID=
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_SECRET=
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_PROVIDER=oidc
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_AUTHORIZATION_GRANT_TYPE=authorization_code
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_REDIRECT_URI={baseUrl}/login/oauth2/code/{registrationId}
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_SCOPE=openid,profile,email
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_NAME=OIDC
SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_OIDC_ISSUER_URI=

# Direct (username/password) authentication for environments without OAuth2.
# To enable, set BOTH:
#   - SKILLHUB_AUTH_DIRECT_ENABLED=true       (server: enables the /api/v1/auth/direct endpoint)
#   - SKILLHUB_WEB_AUTH_DIRECT_ENABLED=true   (web:    surfaces the username/password form)
# Set SKILLHUB_WEB_AUTH_DIRECT_PROVIDER to a direct provider id returned by
# /api/v1/auth/methods (e.g. "local"). Do not use the built-in auth method id
# "local-password" here; that method points at /api/v1/auth/local/login.
SKILLHUB_AUTH_DIRECT_ENABLED=false
SKILLHUB_WEB_AUTH_DIRECT_ENABLED=false
SKILLHUB_WEB_AUTH_DIRECT_PROVIDER=

# SMTP configuration for password reset verification emails.
SPRING_MAIL_HOST=
SPRING_MAIL_PORT=587
SPRING_MAIL_USERNAME=
SPRING_MAIL_PASSWORD=
SPRING_MAIL_SMTP_AUTH=true
SPRING_MAIL_SMTP_STARTTLS_ENABLE=true
SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE=false
# Optional certificate trust override: leave absent for the JVM trust store.
# Never set an empty value; use an explicit host only when required.
# SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_TRUST=smtp.example.com
SKILLHUB_AUTH_PASSWORD_RESET_CODE_EXPIRY=PT10M
SKILLHUB_AUTH_PASSWORD_RESET_FROM_ADDRESS=noreply@example.com
SKILLHUB_AUTH_PASSWORD_RESET_FROM_NAME=SkillHub

# Security scanner is enabled by default. Set to false to disable scanning.
SKILLHUB_SECURITY_SCANNER_ENABLED=true

# Built-in starter skills are installed by default. Set to false to skip initialization.
SKILLHUB_BUILTIN_SKILLS_ENABLED=true

# Required for signing anonymous download rate-limit cookies. Use a unique random value per deployment.
# runtime.sh generates and persists one automatically when this placeholder is still present.
SKILLHUB_DOWNLOAD_ANON_COOKIE_SECRET=replace-with-random-download-secret-32-bytes

# Scanner LLM configuration (optional, for AI-powered scanning features)
SKILL_SCANNER_LLM_API_KEY=
SKILL_SCANNER_LLM_BASE_URL=
SKILL_SCANNER_LLM_MODEL=

# Optional notification email. Only the first three values seed an absent DB setting.
# Afterwards change enabled/window/public URL in Admin > System Configuration.
SKILLHUB_NOTIFICATION_EMAIL_ENABLED=false
SKILLHUB_NOTIFICATION_EMAIL_DIGEST_WINDOW_MINUTES=60
SKILLHUB_NOTIFICATION_EMAIL_PUBLIC_BASE_URL=
SKILLHUB_NOTIFICATION_EMAIL_FROM_ADDRESS=noreply@example.com
SKILLHUB_NOTIFICATION_EMAIL_FROM_NAME=SkillHub
# Finite timeouts apply to the shared SMTP transport (including password reset).
SPRING_MAIL_SMTP_CONNECTION_TIMEOUT_MS=5000
SPRING_MAIL_SMTP_READ_TIMEOUT_MS=10000
SPRING_MAIL_SMTP_WRITE_TIMEOUT_MS=10000
# Worker defaults: 10s polling, 120s lease, 24h temporary-failure recovery, 20 work items per poll.
# Sent/suppressed metadata: 30 days; failed/unknown: 90 days (minimum 8 days).
SKILLHUB_NOTIFICATION_EMAIL_DELIVERY_POLL_DELAY_MS=10000
SKILLHUB_NOTIFICATION_EMAIL_DELIVERY_LEASE_SECONDS=120
SKILLHUB_NOTIFICATION_EMAIL_DELIVERY_RETRY_WINDOW_HOURS=24
SKILLHUB_NOTIFICATION_EMAIL_DELIVERY_BATCH_SIZE=20
SKILLHUB_NOTIFICATION_EMAIL_DELIVERY_SENT_RETENTION_DAYS=30
SKILLHUB_NOTIFICATION_EMAIL_DELIVERY_FAILED_RETENTION_DAYS=90