Repository navigation
Expand file tree
/
Copy path.env.example
More file actions
141 lines (127 loc) · 4.87 KB
/
Copy path.env.example
File metadata and controls
141 lines (127 loc) · 4.87 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
NODE_ENV=development
PORT=3000
# Public HTTPS origin used for payment redirects in production.
PUBLIC_APP_URL=
# Independent random server-side secrets (32 bytes or more each). Do not reuse
# browser/public keys and do not commit real values.
GOOGLE_IDENTITY_COOKIE_SECRET=
RATE_LIMIT_HASH_SECRET=
PROBLEM_CAPABILITY_SECRET=
JOB_CAPABILITY_SECRET=
IVUCX_LEDGER_SECRET=
# Supabase server-side APIs: BlueMode auth, cookie consent, and helper persistence.
NEXT_PUBLIC_SUPABASE_URL=
NEXT_PUBLIC_SUPABASE_ANON_KEY=
SUPABASE_SERVICE_ROLE_KEY=
# Optional fallback when URL is not available but the project ref is known.
SUPABASE_PROJECT_REF=
# Production Postgres connection string for admin SQL operations only.
# Do not expose this to browser code. Used by scripts/supabase-remote-access.ps1.
SUPABASE_DB_URL=
# Private problem attachment storage and per-problem abuse controls.
PROBLEM_ATTACHMENT_MAX_COUNT=100
PROBLEM_ATTACHMENT_FILE_MAX_BYTES=52428800
PROBLEM_ATTACHMENT_TOTAL_MAX_BYTES=262144000
PROBLEM_ATTACHMENT_SIGN_LIMIT_PER_HOUR=10
PROBLEM_ATTACHMENT_COMPLETE_LIMIT_PER_HOUR=20
# Gemini-backed saved problem/theorem search. Server-side only.
GEMINI_API_KEY=
GEMINI_MODEL=gemini-2.5-flash
GEMINI_REQUEST_TIMEOUT_MS=90000
GEMINI_RESPONSE_MAX_BYTES=2097152
# Proof editor AI prompt panel. Server-side keys are optional because users can
# enter provider API keys in the editor panel for per-request use.
OPENAI_API_KEY=
OPENAI_MODEL=gpt-5.4-mini
ANTHROPIC_API_KEY=
ANTHROPIC_MODEL=claude-sonnet-4-5
DEEPSEEK_API_KEY=
DEEPSEEK_MODEL=deepseek-v4-flash
DEEPSEEK_V4_API_KEY=
DEEPSEEK_V4_MODEL=deepseek-v4-flash
DEEPSEEK_PROVER_API_KEY=
DEEPSEEK_PROVER_MODEL=deepseek-v4-pro
# Optional proof-context adapters. Each endpoint receives language, code,
# validationOutput, files, and contextEngine, then returns context/output text.
PROOF_AI_CONTEXT_API_URL=
PROOF_AI_CONTEXT_API_KEY=
COQ_LSP_CONTEXT_API_URL=
PYCOQ_CONTEXT_API_URL=
LEAN_REPL_CONTEXT_API_URL=
LEANDOJO_CONTEXT_API_URL=
PROOF_AI_PROVIDER_TIMEOUT_MS=90000
PROOF_AI_RESPONSE_MAX_BYTES=1048576
# Stripe bounty checkout. Server-side secret key must never be exposed to browser code.
STRIPE_SECRET_KEY=
STRIPE_PUBLISHABLE_KEY=
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=
# Google upload import.
# Local development can use the Desktop client JSON that was provided.
GOOGLE_CLIENT_SECRET_PATH=
# For Vercel or Google Compute Engine, prefer a Web application OAuth client.
# Put the full JSON in one of these variables, or point GOOGLE_CLIENT_SECRET_PATH
# at a secret file on the server.
GOOGLE_CLIENT_SECRET_JSON=
GOOGLE_CLIENT_SECRET_BASE64=
# Public URL for this iVucx app. The effective callback becomes:
# <GOOGLE_PUBLIC_BASE_URL>/api/google-auth-callback
# Register that exact URL in Google Cloud OAuth client settings.
GOOGLE_PUBLIC_BASE_URL=
GOOGLE_REDIRECT_URI=
GOOGLE_IMPORT_MAX_BYTES=26214400
GOOGLE_TEXT_PREVIEW_BYTES=1048576
GOOGLE_REQUEST_TIMEOUT_MS=20000
GOOGLE_DOWNLOAD_TIMEOUT_MS=60000
GOOGLE_JSON_MAX_BYTES=2097152
# Email verification login. SMTP_PASS is server-side only; never expose it to
# browser code or NEXT_PUBLIC_* variables.
SMTP_HOST=smtp.gmail.com
SMTP_PORT=465
SMTP_SECURE=true
SMTP_USER=
SMTP_PASS=
EMAIL_FROM_NAME=PROVF
EMAIL_VERIFICATION_SECRET=
# Private server-to-server key for the optional Vertex AI proxy.
IVUCX_GEMINI_PROXY_KEY=
GEMINI_PROXY_TIMEOUT_MS=90000
GEMINI_PROXY_RESPONSE_MAX_BYTES=2097152
GEMINI_PROXY_MAX_CONCURRENT=4
GEMINI_PROXY_MAX_QUEUED=20
# Existing proof/helper deployment.
HELPER_API_BASE_URL=
HELPER_API_KEY=
EXECUTION_API_BASE_URL=
EXECUTION_API_KEY=
# Production execution traffic must use HTTPS. The control plane signs the
# exact method, URL path, body, timestamp, and nonce with this private key.
EXECUTION_API_PRIVATE_KEY=
EXECUTION_API_PRIVATE_KEY_PATH=
EXECUTION_API_KEY_ID=
# The execution VM receives only the matching public key. Use
# EXECUTION_API_PUBLIC_KEYS_JSON={"key-id":"-----BEGIN PUBLIC KEY-----..."}
# during key rotation when two public keys must be trusted temporarily.
EXECUTION_API_PUBLIC_KEY=
EXECUTION_API_PUBLIC_KEY_PATH=
EXECUTION_API_PUBLIC_KEYS_JSON=
EXECUTION_RECEIVER_MODE=false
EXECUTION_RECEIVER_AUTH_REQUIRED=true
EXECUTION_SIGNATURE_REQUIRED=true
EXECUTION_BEARER_REQUIRED=true
EXECUTION_REPLAY_CACHE_MAX=10000
# Production Linux proof workers fail closed unless bubblewrap is available.
IVUCX_PROOF_SANDBOX_REQUIRED=true
IVUCX_PROOF_SANDBOX_CMD=/usr/bin/bwrap
IVUCX_PROOF_LIMIT_CMD=/usr/bin/prlimit
IVUCX_PROOF_MAX_PROCESSES=64
IVUCX_PROOF_MAX_ADDRESS_SPACE_BYTES=2147483648
IVUCX_PROOF_MAX_FILE_BYTES=33554432
IVUCX_PROOF_MAX_OPEN_FILES=256
IVUCX_PROOF_MAX_CPU_SECONDS=180
# CIC conversion uses this exact installed release; rolling tags such as stable
# or nightly are rejected to prevent runtime toolchain drift.
LEAN_TOOLCHAIN=leanprover/lean4:v4.30.0
ALLOW_LOCAL_EXECUTION_FALLBACK=false
ALLOW_LOCAL_HELPER_FALLBACK=false
# Optional local-only directory containing .env.local. Defaults to ~/.ivucx/secrets.
IVUCX_ENV_DIR=