mirror of
https://github.com/we-promise/sure.git
synced 2026-09-04 22:31:07 +00:00
Juan José Mata
fd6f4ff078
* Add live AI checks to system health Give super admins a dedicated AI status view with bounded liveness probes for LLMs, vector stores, pgvector, and embedding endpoints. Record sanitized failures in both the system debug log and Rails logger, and document the recommended local configuration.\n\nCloses #3145 * Fix AI health CI checks * Address AI health review feedback * Correct Ollama model preload guidance * Distinguish OpenAI-compatible providers * Make Ollama startup readiness explicit * Recognize Cloudflare AI endpoints
133 lines
5.5 KiB
Bash
133 lines
5.5 KiB
Bash
# To enable / disable self-hosting features.
|
|
SELF_HOSTED = true
|
|
|
|
# Custom port config
|
|
# For users who have other applications listening at 3000, this allows them to set a value puma will listen to.
|
|
PORT=3000
|
|
|
|
# SimpleFIN runtime flags (default-off)
|
|
# Accepted truthy values: 1, true, yes, on
|
|
# SIMPLEFIN_DEBUG_RAW: when truthy, logs the raw payload returned by SimpleFIN (debug-only; can be noisy)
|
|
SIMPLEFIN_DEBUG_RAW=false
|
|
# SIMPLEFIN_INCLUDE_PENDING: when truthy, forces `pending=1` on SimpleFIN fetches when caller doesn't specify `pending:`
|
|
SIMPLEFIN_INCLUDE_PENDING=false
|
|
|
|
# SnapTrade OAuth app credentials (register an OAuth app at https://dashboard.snaptrade.com,
|
|
# add https://<your-host>/snaptrade_items/oauth_callback as a redirect URI)
|
|
SNAPTRADE_OAUTH_CLIENT_ID=
|
|
SNAPTRADE_OAUTH_CLIENT_SECRET=
|
|
|
|
# Lunchflow runtime flags (default-off)
|
|
# LUNCHFLOW_DEBUG_RAW: when truthy, logs the raw payload returned by Lunchflow (debug-only; can be noisy)
|
|
LUNCHFLOW_DEBUG_RAW=false
|
|
# LUNCHFLOW_INCLUDE_PENDING: when truthy, adds `include_pending=true` to Lunchflow transaction fetch requests
|
|
LUNCHFLOW_INCLUDE_PENDING=false
|
|
|
|
# Controls onboarding flow (valid: open, closed, invite_only)
|
|
ONBOARDING_STATE = open
|
|
|
|
# Enable Twelve market data (careful, this will use your API credits)
|
|
TWELVE_DATA_API_KEY =
|
|
|
|
# OpenAI-compatible API endpoint config
|
|
OPENAI_ACCESS_TOKEN =
|
|
OPENAI_URI_BASE =
|
|
OPENAI_MODEL =
|
|
|
|
# LLM token budget. Applies to ALL outbound LLM calls: chat history,
|
|
# auto-categorize, merchant detection, provider enhancer, PDF processing.
|
|
# Defaults to Ollama's historical 2048-token baseline so small local models
|
|
# work out of the box — raise explicitly for cloud or larger-context models.
|
|
# LLM_CONTEXT_WINDOW = 2048 # Total tokens the model will accept
|
|
# LLM_MAX_RESPONSE_TOKENS = 512 # Reserved for the model's reply
|
|
# LLM_MAX_HISTORY_TOKENS = # Derived if unset (context - response - system_reserve)
|
|
# LLM_SYSTEM_PROMPT_RESERVE = 256 # Tokens reserved for the system prompt
|
|
# LLM_MAX_ITEMS_PER_CALL = 25 # Upper bound on auto-categorize / merchant batches
|
|
|
|
# OpenAI-compatible capability flags (custom/self-hosted providers)
|
|
# OPENAI_REQUEST_TIMEOUT = 60 # HTTP timeout in seconds; raise for slow local models
|
|
# AI_RESPONSE_TIMEOUT = 90 # Whole-turn budget: (1 + iterations) * OPENAI_REQUEST_TIMEOUT + tool time + queue wait
|
|
# ASSISTANT_MAX_TOOL_CALL_ITERATIONS = 5 # Chained tool calls per turn; a turn costs up to (1 + this) model calls
|
|
# OPENAI_SUPPORTS_PDF_PROCESSING = true # Set to false for endpoints without vision support
|
|
# OPENAI_SUPPORTS_RESPONSES_ENDPOINT = # true to force Responses API on custom providers
|
|
# LLM_JSON_MODE = # auto | strict | json_object | none
|
|
|
|
# Document-search vector store. Local OpenAI-compatible chat endpoints usually
|
|
# do not implement OpenAI's hosted /v1/vector_stores API, so use pgvector and a
|
|
# separate embeddings endpoint when testing local AI.
|
|
# VECTOR_STORE_PROVIDER = pgvector
|
|
# EMBEDDING_URI_BASE = http://host.docker.internal:11434/v1
|
|
# EMBEDDING_MODEL = mxbai-embed-large
|
|
# EMBEDDING_DIMENSIONS = 1024 # Must match the embedding model
|
|
# EMBEDDING_ACCESS_TOKEN = # Optional; falls back to OPENAI_ACCESS_TOKEN
|
|
# AI_HEALTH_PROBE_TIMEOUT = 5 # Per-request timeout for admin live checks
|
|
# AI_HEALTH_PROBE_CACHE_TTL = 60 # Cache live results and deduplicate failure logs
|
|
|
|
# (example: LM Studio/Docker config) OpenAI-compatible API endpoint config
|
|
# OPENAI_URI_BASE = http://host.docker.internal:1234/
|
|
# OPENAI_MODEL = qwen/qwen3-vl-4b
|
|
|
|
# OpenID Connect for development
|
|
OIDC_CLIENT_ID=
|
|
OIDC_CLIENT_SECRET=
|
|
OIDC_ISSUER=
|
|
OIDC_REDIRECT_URI=http://localhost:3000/auth/openid_connect/callback
|
|
|
|
# WebAuthn / passkey MFA development defaults
|
|
# RP ID must match the domain where credentials are registered.
|
|
WEBAUTHN_RP_ID=localhost
|
|
WEBAUTHN_ALLOWED_ORIGINS=http://localhost:3000
|
|
|
|
# Langfuse config
|
|
LANGFUSE_PUBLIC_KEY =
|
|
LANGFUSE_SECRET_KEY =
|
|
LANGFUSE_HOST = https://cloud.langfuse.com
|
|
|
|
# Set to `true` to get error messages rendered in the /chats UI
|
|
AI_DEBUG_MODE =
|
|
|
|
# =============================================================================
|
|
# SSL/TLS Configuration for Self-Signed Certificates
|
|
# =============================================================================
|
|
# Use these settings when connecting to services with self-signed or internal
|
|
# CA certificates (e.g., self-hosted Keycloak, Authentik, or AI endpoints).
|
|
#
|
|
# SSL_CA_FILE: Path to custom CA certificate file (PEM format)
|
|
# - The certificate that signed your server's SSL certificate
|
|
# - Must be readable by the application
|
|
# - Will be validated at startup
|
|
# SSL_CA_FILE = /certs/my-ca.crt
|
|
#
|
|
# SSL_VERIFY: Enable/disable SSL certificate verification
|
|
# - Default: true (verification enabled)
|
|
# - Set to "false" ONLY for development/testing
|
|
# - WARNING: Disabling removes protection against man-in-the-middle attacks
|
|
# SSL_VERIFY = true
|
|
#
|
|
# SSL_DEBUG: Enable verbose SSL logging for troubleshooting
|
|
# - Default: false
|
|
# - When enabled, logs detailed SSL connection information
|
|
# - Useful for diagnosing certificate issues
|
|
# SSL_DEBUG = false
|
|
#
|
|
# Example docker-compose.yml configuration:
|
|
# services:
|
|
# app:
|
|
# environment:
|
|
# SSL_CA_FILE: /certs/my-ca.crt
|
|
# SSL_DEBUG: "true"
|
|
# volumes:
|
|
# - ./my-ca.crt:/certs/my-ca.crt:ro
|
|
|
|
# Active Storage Configuration
|
|
# ACTIVE_STORAGE_SERVICE=google
|
|
# GCS_PROJECT=
|
|
# GCS_BUCKET=
|
|
# GCS_KEYFILE_JSON=
|
|
# GCS_KEYFILE=
|
|
|
|
# Skylight
|
|
# ========
|
|
SKYLIGHT_AUTHENTICATION=
|
|
SKYLIGHT_ENABLED=
|