mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
f03859c64c
* [fe5c049b] Register docs-sync feature flag and compose wiring (#505) * [fe5c049b] Register docs-sync feature flag and compose wiring * [fe5c049b] feat(config): wire ROBOCO_DOCS_SYNC_ENABLED flag and compose defaults * [fe5c049b] docs(config): document ROBOCO_DOCS_SYNC_ENABLED flag and compose defaults --------- * [687574d2] Implement docs-sync engine and release-proposal seam (#506) * [687574d2] Add docs-sync engine and release-proposal publish seam * [687574d2] Restore task.py safeguards deleted by docs-sync engine commit and filter docs_sync version in SQL * [687574d2] docs(map): add engine-docs-sync architecture map and cross-references * [687574d2] docs(config): update docs-sync flag, cap settings, and changelog entry --------- * [3e7cd5a8] Fix task.py regressions from docs-sync PR (#509) * [3e7cd5a8] fix(task): restore deleted auditor alerts and revert descendant cast form in task.py * [3e7cd5a8] docs(task-service): restore auditor alerts and cast notes in map and changelog --------- * [e6e23c1f] Enforce docs_sync_max_per_cycle cap in docs_sync_engine.py (#510) * [e6e23c1f] Enforce docs_sync_max_per_cycle cap in DocsSyncEngine * [e6e23c1f] docs(docs-sync): document docs_sync_max_per_cycle enforcement in engine map, README, and docstring --------- * [e4b7dd0f] Revert task.py cast regressions from docs-sync PR (#511) * [e4b7dd0f] fix(task): revert cast regressions in supersede and descendants * [e4b7dd0f] docs(map): correct PR #511 cast regression entry in task-service slice map * [e4b7dd0f] docs(backend): add SQLAlchemy UUID cast pattern note and inline comments in task.py --------- * [1fdfe711] Fix Python quality gate on docs-sync PR (#512) * [1fdfe711] Fix ruff formatting in task.py and add coverage tests for docs-sync surface * [1fdfe711] fix(task): use generic JSON .as_string() accessor in list_open_docs_sync_tasks and correct test patch targets * [1fdfe711] docs(task-service): record docs-sync JSON accessor fix and list_open_docs_sync_tasks map entry --------- --------- Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> Co-authored-by: Backend Developer 2 <be-dev-2@roboco.tech>
218 lines
11 KiB
Bash
218 lines
11 KiB
Bash
# =============================================================================
|
|
# RoboCo Environment Configuration
|
|
# =============================================================================
|
|
# Copy this file to .env
|
|
#
|
|
# NOTE: No API keys needed for agents - they use your Claude Code authentication.
|
|
# Run `claude` on the host to authenticate before starting RoboCo.
|
|
|
|
# =============================================================================
|
|
# Docker Deployment (NAS/Server)
|
|
# =============================================================================
|
|
# These are REQUIRED when running via docker compose on a NAS/server.
|
|
# They tell the orchestrator container where to find files on the HOST.
|
|
|
|
# Path to the project on the host (absolute path)
|
|
# ROBOCO_HOST_PROJECT_DIR=/volume1/roboco
|
|
|
|
# Path to Claude Code auth directory on the host
|
|
# ROBOCO_HOST_CLAUDE_DIR=/root/.claude
|
|
|
|
# Claude auth directory to mount into orchestrator
|
|
# CLAUDE_AUTH_DIR=~/.claude
|
|
|
|
# =============================================================================
|
|
# Container Images (docker-compose.registry.yml — pre-built deployment)
|
|
# =============================================================================
|
|
# Only used by docker-compose.registry.yml, which runs the published images
|
|
# instead of building from source. Defaults shown.
|
|
# Registry namespace: ghcr.io/rennf93 (GHCR) or docker.io/renzof93 (Docker Hub)
|
|
# ROBOCO_REGISTRY=ghcr.io/rennf93
|
|
# Image tag: latest, or a pinned release such as 0.5.0
|
|
# ROBOCO_VERSION=latest
|
|
|
|
# =============================================================================
|
|
# Data Persistence
|
|
# =============================================================================
|
|
# Set to a path on your NAS RAID array for durability
|
|
# Path to data directory on the host (MUST be absolute for Docker-in-Docker)
|
|
# ROBOCO_DATA_DIR=/volume1/roboco/data
|
|
|
|
# =============================================================================
|
|
# Application
|
|
# =============================================================================
|
|
ROBOCO_ENVIRONMENT=development
|
|
ROBOCO_DEBUG=true
|
|
|
|
# =============================================================================
|
|
# API Server
|
|
# =============================================================================
|
|
ROBOCO_HOST=0.0.0.0
|
|
ROBOCO_PORT=8000
|
|
|
|
# =============================================================================
|
|
# Database (PostgreSQL)
|
|
# =============================================================================
|
|
# For docker compose deployment, use container name:
|
|
# ROBOCO_DATABASE_HOST=roboco-postgres
|
|
# For local development:
|
|
ROBOCO_DATABASE_HOST=localhost
|
|
ROBOCO_DATABASE_PORT=5432
|
|
ROBOCO_DATABASE_USER=roboco
|
|
ROBOCO_DATABASE_PASSWORD=roboco
|
|
ROBOCO_DATABASE_NAME=roboco
|
|
ROBOCO_DATABASE_ECHO=false
|
|
|
|
# =============================================================================
|
|
# Redis
|
|
# =============================================================================
|
|
# For docker compose deployment, use container name:
|
|
# ROBOCO_REDIS_HOST=roboco-redis
|
|
# For local development:
|
|
ROBOCO_REDIS_HOST=localhost
|
|
ROBOCO_REDIS_PORT=6379
|
|
ROBOCO_REDIS_DB=0
|
|
# ROBOCO_REDIS_PASSWORD=
|
|
|
|
# =============================================================================
|
|
# RAG / Local LLM (Ollama + in-house pgvector engine)
|
|
# =============================================================================
|
|
# For docker compose use the container name (roboco-ollama); locally, localhost.
|
|
ROBOCO_OLLAMA_BASE_URL=http://localhost:11434
|
|
ROBOCO_LOCAL_LLM_BASE_URL=http://localhost:11434/v1
|
|
ROBOCO_LOCAL_LLM_MODEL=glm-5.2:cloud
|
|
ROBOCO_DEFAULT_EMBEDDING_MODEL=qwen3-embedding:0.6b
|
|
|
|
# =============================================================================
|
|
# Grok (xAI) Provider — optional
|
|
# =============================================================================
|
|
# RoboCo can run agents on Grok Build (xAI) via xAI's official `grok` CLI on the
|
|
# SuperGrok subscription, instead of Claude Code. No metered xAI API key is used:
|
|
# the CLI authenticates from a mounted ~/.grok/auth.json — run `grok login` once
|
|
# on the host (auth.json auto-refreshes). Every var below is optional.
|
|
|
|
# Host dir holding the SuperGrok auth (one canonical var). The compose mounts it
|
|
# into the orchestrator at the same path, and the orchestrator hands that path to
|
|
# each Grok agent's auth.json bind — so it must be the real host ~/.grok.
|
|
# ROBOCO_HOST_GROK_DIR=/home/youruser/.grok
|
|
|
|
# Image the orchestrator spawns for Grok agents, and the CLI model id.
|
|
# ROBOCO_GROK_AGENT_IMAGE=roboco-agent-grok:latest
|
|
# ROBOCO_GROK_CLI_MODEL=grok-build
|
|
|
|
# Per-role tool permissions are computed as native grok flags (subagents off
|
|
# except intake; edit/shell removed for non-coding roles; git network/branch/
|
|
# history mutation + rm -rf denied for coding roles; web search off for all —
|
|
# gated web is via the roboco-search MCP). Credential-exfil / identity-forgery /
|
|
# internal-API shell patterns are blocked by the same bash-guard the Claude path
|
|
# runs, wired as a grok PreToolUse hook. Nothing to set here.
|
|
|
|
# Reasoning effort for ALL Grok agents: low | medium | high | xhigh | max. Empty
|
|
# keeps grok's model default for every role (parity with Claude — no per-role
|
|
# cut); set this to trade quality for cost across the whole fleet.
|
|
# ROBOCO_GROK_REASONING_EFFORT=
|
|
|
|
# Hard ceiling on agentic turns per run (loop guard).
|
|
# ROBOCO_GROK_MAX_TURNS=200
|
|
|
|
# Kill a Grok agent container after this many seconds idle (no model call /
|
|
# stream) to reclaim a wedged one. Minimum 120.
|
|
# ROBOCO_GROK_IDLE_KILL_SECONDS=900
|
|
|
|
# Per-agent cost ceiling (USD) before the orchestrator kills the container;
|
|
# 0 disables. Backstops runaway-loop token burn.
|
|
# ROBOCO_GROK_MAX_COST_USD=0.0
|
|
|
|
# =============================================================================
|
|
# Security
|
|
# =============================================================================
|
|
# Encryption key for git tokens at rest (Fernet). REQUIRED — the orchestrator
|
|
# refuses to start without it. Generate with:
|
|
# python -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())'
|
|
ROBOCO_ENCRYPTION_KEY=
|
|
|
|
# Agent auth: HMAC secret that signs X-Agent-Token. REQUIRED for docker compose.
|
|
# Generate with: python -c 'import secrets; print(secrets.token_hex(32))'
|
|
ROBOCO_AGENT_AUTH_SECRET=
|
|
|
|
# Secure mode. On a trusted LAN you can leave this false (header-trust mode).
|
|
# Set true to require every request to carry a valid token so an agent cannot
|
|
# spoof another agent's role. When true you MUST also set ROBOCO_PANEL_AGENT_TOKEN.
|
|
ROBOCO_AGENT_AUTH_REQUIRED=false
|
|
|
|
# The control panel's CEO token, injected by nginx in secure mode so the human
|
|
# UI keeps working without the browser holding the signing secret. Generate it
|
|
# (after setting ROBOCO_AGENT_AUTH_SECRET above) with: make panel-token
|
|
# NOTE: leave this UNSET if you arm cloud auth (below) for real remote exposure —
|
|
# it is itself a valid CEO credential that would bypass the login page.
|
|
ROBOCO_PANEL_AGENT_TOKEN=
|
|
|
|
# =============================================================================
|
|
# Cloud auth (panel login) — ARMED ON in the NAS compose (v0.17.0)
|
|
# =============================================================================
|
|
# ROBOCO_CLOUD_AUTH_ENABLED defaults ON in docker-compose.yaml. When on, the
|
|
# orchestrator REFUSES TO START unless ROBOCO_CLOUD_AUTH_SECRET is set, the
|
|
# panel requires a login, and the session cookie is secure-only (needs TLS).
|
|
#
|
|
# To TEST-DEPLOY before you've set up creds + TLS, turn it off for that run:
|
|
# ROBOCO_CLOUD_AUTH_ENABLED=false
|
|
#
|
|
# To ARM it: set all three below + terminate TLS in front of nginx + leave
|
|
# ROBOCO_PANEL_AGENT_TOKEN unset.
|
|
# ROBOCO_CLOUD_AUTH_SECRET — session-signing key. REQUIRED when enabled.
|
|
# Generate: python -c 'import secrets; print(secrets.token_hex(32))'
|
|
# ROBOCO_CLOUD_AUTH_EMAIL / _PASSWORD — the single seeded login (no signup).
|
|
# ROBOCO_CLOUD_AUTH_SECRET=
|
|
# ROBOCO_CLOUD_AUTH_EMAIL=
|
|
# ROBOCO_CLOUD_AUTH_PASSWORD=
|
|
|
|
# =============================================================================
|
|
# Model routing strictness — ARMED ON in the NAS compose (v0.17.0)
|
|
# =============================================================================
|
|
# Fail-closed routing: a spawn whose configured provider is disabled RAISES
|
|
# instead of degrading to the legacy Claude path. Audit the model_assignments
|
|
# table first (a stale row pointing at a disabled provider crashes that spawn).
|
|
# To restore graceful degradation: ROBOCO_ROUTING_STRICT=false
|
|
|
|
# =============================================================================
|
|
# X (Twitter) engine — ARMED ON in the NAS compose (v0.17.0)
|
|
# =============================================================================
|
|
# The engine drafts release posts + mention replies HELD for per-post CEO
|
|
# approval; it is INERT until you store the four OAuth 1.0a secrets. Those are
|
|
# NOT env vars — enter them in the panel (Settings -> X credentials, stored
|
|
# Fernet-encrypted): API key, API secret, access token, access token secret,
|
|
# from an X developer app with read+write user-context access.
|
|
# Optional: pin the account's numeric user id (else it's resolved via /users/me).
|
|
# ROBOCO_X_ACCOUNT_USER_ID=
|
|
|
|
# =============================================================================
|
|
# Web research — ARMED ON in the NAS compose (v0.17.0)
|
|
# =============================================================================
|
|
# Gives Board/PM roles web_search + web_fetch. INERT (empty results) without a
|
|
# provider key — set one to make it live (Tavily / Brave / Exa, per your config).
|
|
# ROBOCO_RESEARCH_API_KEY=
|
|
|
|
# =============================================================================
|
|
# Auditor scheduled sweeps
|
|
# =============================================================================
|
|
# The orchestrator spawns the auditor on a periodic delivery-process review when
|
|
# the interval has elapsed AND recent delivery activity exists. 0 disables.
|
|
# ROBOCO_AUDIT_INTERVAL_SECONDS=21600
|
|
|
|
# =============================================================================
|
|
# Docs-divergence sync (release -> docs-update task)
|
|
# =============================================================================
|
|
# Master switch for the docs-sync engine. When on, a successful release publish
|
|
# originates one bounded, deduped docs-update task against the roboco-website
|
|
# project. Requires roboco-website to be registered as a project.
|
|
# NAS compose defaults this to true; local-dev and registry composes default to
|
|
# false. Toggle from Settings → Feature Flags.
|
|
# ROBOCO_DOCS_SYNC_ENABLED=false
|
|
# ROBOCO_DOCS_SYNC_MAX_OPEN_TASKS=3
|
|
# ROBOCO_DOCS_SYNC_MAX_PER_CYCLE=1
|
|
|
|
# =============================================================================
|
|
# CORS (comma-separated origins)
|
|
# =============================================================================
|
|
ROBOCO_CORS_ORIGINS=["http://localhost:3000","http://localhost:5173"]
|