BuildLabs/.env.example at main · Developer668/BuildLabs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
# Build-agent runtime
NODE_ENV=development
HOST=127.0.0.1
PORT=3000
BUILDLABS_DATABASE_PATH=.buildlabs/build-agent.db
BUILDLABS_ARTIFACT_DIR=.buildlabs/artifacts
BUILDLABS_SLOT_COUNT=4
BUILDLABS_LEASE_MILLISECONDS=30000
# Required in production. Generate a random value with at least 32 characters.
BUILDLABS_INTERNAL_TOKEN=

# Sponsor providers
DAYTONA_API_KEY=
DAYTONA_API_URL=https://app.daytona.io/api
# Custom Docker/Chromium snapshot provisioned with Daytona's large profile
# (4 vCPU, 8 GiB memory, 10 GiB disk).
DAYTONA_BUILD_SNAPSHOT=buildlabs-dind-browser-large-v3
DAYTONA_SNAPSHOT_ATTESTATION_PATH=.buildlabs/daytona/snapshot-attestation.json
DAYTONA_PROVISIONER_SOURCE_PATH=scripts/provision-daytona-snapshot.ts
DAYTONA_TELEMETRY_PATH=.buildlabs/daytona/telemetry.jsonl
# Optional comma-separated allowlist: builder,verifier-commands,verifier-delivery
# Frozen previews use unique proven snapshots and are not warm-pool eligible.
DAYTONA_WARM_POOL_ROLES=
# Optional Daytona SDK tracing. Both the collector and the exact reviewed
# content policy attestation are required before the SDK can emit.
DAYTONA_OTEL_ENABLED=false
# DAYTONA_OTEL_SAFE_POLICY_ATTESTATION=buildlabs.daytona.sdk-otel-safe.v1
# OTEL_EXPORTER_OTLP_ENDPOINT=
# OTEL_EXPORTER_OTLP_HEADERS=
FIREWORKS_API_KEY=
FIREWORKS_BASE_URL=https://api.fireworks.ai/inference/v1
# Default model for every Fireworks reasoning, coding, evaluation, and voice role.
FIREWORKS_MODEL=accounts/fireworks/models/minimax-m3
FIREWORKS_BUILDER_MODEL=accounts/fireworks/models/minimax-m3
FIREWORKS_STUDIO_MODEL=accounts/fireworks/models/minimax-m3
FIREWORKS_EVALUATOR_MODEL=accounts/fireworks/models/minimax-m3
FIREWORKS_VISION_MODEL=accounts/fireworks/models/minimax-m3
# Exact run-pinned model used only by the server-side ElevenAgents bridge.
FIREWORKS_VOICE_MODEL=accounts/fireworks/models/minimax-m3
BRAINTRUST_API_KEY=
BRAINTRUST_API_URL=https://api.braintrust.dev
BRAINTRUST_APP_URL=https://www.braintrust.dev
BRAINTRUST_PROJECT_NAME=BuildLabs
# Optional: enables the authenticated Speech Engine WebSocket and WebRTC token bridge.
# Both values are required; webhook tool routes remain independently available.
# ELEVENLABS_API_KEY=
# ELEVENLABS_SPEECH_ENGINE_ID=
# Dedicated bearer secret for scoped ElevenLabs webhook tools.
# ELEVENLABS_TOOL_SECRET=
# Local voice-intake workspace, reconciled test deployment, and signed bridge.
# ELEVENLABS_AGENT_ID=
# ELEVENLABS_BRANCH_ID=
# ELEVENLABS_AGENT_VERSION_ID=
# ELEVENLABS_VOICE_ID=
# BUILDLABS_VOICE_PUBLIC_BASE_URL=
# Provider secret resource IDs; values remain server-side below.
# ELEVENLABS_CUSTOM_LLM_SECRET_ID=
# ELEVENLABS_TOOL_BEARER_SECRET_ID=
# Dedicated stored secret used only by the authenticated SIP pre-call webhook.
# ELEVENLABS_PRECALL_SECRET_ID=
# ELEVENLABS_WEBHOOK_ID=
# Generate each server-held value independently with at least 32 characters.
# ELEVENLABS_CUSTOM_LLM_SECRET=
# ELEVENLABS_CAPABILITY_SECRET=
# ELEVENLABS_PRECALL_SECRET=
# ELEVENLABS_WEBHOOK_SECRET=
# VOICE_SESSION_SECRET=
# Comma-separated exact origins; required in production.
# VOICE_INTAKE_ALLOWED_ORIGINS=
# CALL_LAB_ACCESS_CODE=
# BUILDLABS_ORCHESTRATION_URL=http://127.0.0.1:3100
# Inbound-only Plivo test transport. The number must already exist in the
# account and remain unassigned until an explicit reconciler apply binds it.
# PLIVO_AUTH_ID=
# PLIVO_AUTH_TOKEN=
# PLIVO_BUILDLABS_NUMBER=
# PLIVO_RECONCILIATION_SECRET=
# Authenticate this dedicated home once, outside the runtime. The service never
# accepts or passes a CodeRabbit key in process arguments.
CODERABBIT_AUTH_MODE=preauthenticated
CODERABBIT_AUTH_HOME=
CODERABBIT_BIN=coderabbit
CODERABBIT_TIMEOUT_SECONDS=600

# General orchestration runtime (Node.js 24+)
ORCHESTRATION_HOST=127.0.0.1
ORCHESTRATION_PORT=3100
ORCHESTRATION_DATABASE_PATH=.buildlabs/orchestration.db
# Generate each independently: openssl rand -base64 32
ORCHESTRATION_ENCRYPTION_KEY_BASE64=
ORCHESTRATION_REPLY_SECRET_BASE64=
ORCHESTRATION_INTERNAL_TOKEN=
# Required real Resend receiving/sending domains. No placeholder is accepted in
# production.
ORCHESTRATION_REPLY_DOMAIN=
ORCHESTRATION_FROM_EMAIL=
# Public origin registered in both Stripe and Resend webhook settings.
ORCHESTRATION_PUBLIC_BASE_URL=
# Public origin of the customer dashboard. Emailed login links land here — the
# dashboard owns the customer session cookie and the opaque project alias.
# Omit only for a single-origin deployment behind one proxy, where it defaults
# to ORCHESTRATION_PUBLIC_BASE_URL.
ORCHESTRATION_DASHBOARD_BASE_URL=
ORCHESTRATION_RECONCILE_INTERVAL_MS=10000
ORCHESTRATION_RECONCILE_BATCH_SIZE=25
ORCHESTRATION_RECONCILE_CONCURRENCY=4
ORCHESTRATION_PROJECT_RECONCILE_TIMEOUT_MS=1920000
ORCHESTRATION_TRACE_FLUSH_TIMEOUT_MS=10000
# Durable provider effects retry with capped exponential backoff, then stop in
# operator attention instead of retrying forever.
ORCHESTRATION_EFFECT_MAX_ATTEMPTS=5
ORCHESTRATION_EFFECT_RETRY_INITIAL_MS=1000
ORCHESTRATION_EFFECT_RETRY_MAX_MS=60000
# Hard ceilings for candidate construction and delayed candidate.proven events.
ORCHESTRATION_BUILD_DEADLINE_MS=7200000
ORCHESTRATION_PROOF_EVENT_GRACE_MS=120000
# Required preview/final email delivery must become authoritative within this
# window or the project stops for operator attention.
ORCHESTRATION_MAIL_DELIVERY_DEADLINE_MS=21600000
ORCHESTRATION_SHUTDOWN_TIMEOUT_MS=30000
ORCHESTRATION_PREVIEW_TTL_SECONDS=172800
ORCHESTRATION_PREVIEW_REVIEW_PERIOD_MS=86400000
ORCHESTRATION_ARTIFACT_TEMP_DIRECTORY=

# Orchestration providers
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
# Required real public HTTPS routes. Production also requires live-mode Stripe.
STRIPE_SUCCESS_URL=
STRIPE_CANCEL_URL=
STRIPE_EXPECTED_LIVEMODE=false
STRIPE_PRODUCT_NAME=BuildLabs software engagement
RESEND_API_KEY=
RESEND_WEBHOOK_SECRET=
# The build backend runs private in production. Plaintext HTTP is accepted only
# for a loopback or a private *.internal host (e.g. Fly.io 6PN); any publicly
# routable host must be HTTPS. Example private host:
#   http://buildlabs-build-agent.internal:3000
BUILD_BACKEND_BASE_URL=http://127.0.0.1:3000
# Use the build backend's BUILDLABS_INTERNAL_TOKEN; keep it distinct from
# ORCHESTRATION_INTERNAL_TOKEN.
BUILD_BACKEND_INTERNAL_TOKEN=
BUILD_BACKEND_REQUEST_TIMEOUT_MS=30000
BUILD_BACKEND_PREVIEW_TIMEOUT_MS=360000
BUILD_BACKEND_ARTIFACT_TIMEOUT_MS=600000
# Dynamic per-project app creation requires an org-scoped deploy token.
# An app-scoped token works only when the exact derived app is pre-provisioned.
FLY_ACCESS_TOKEN=
FLY_ORG_SLUG=
FLY_PRIMARY_REGION=sjc
FLY_APP_NAME_PREFIX=buildlabs
FLYCTL_BIN=flyctl
FLY_HEALTH_PATH=/
FLY_OPERATION_TIMEOUT_MS=1200000

# =============================================================================
# The dashboard (Next.js) and voice-intake (vinext) services do NOT read this
# file. Next.js and vinext load env files from their own app directory:
#   dashboard    -> apps/dashboard/.env.local     (see apps/dashboard/.env.example)
#   voice-intake -> apps/voice-intake/.env.local  (see apps/voice-intake/README.md)
# The dashboard needs BUILDLABS_INTERNAL_TOKEN (matching this file's value),
# BUILDLABS_OPERATOR_TOKEN, BUILDLABS_DASHBOARD_ALIAS_SECRET, and the WIP
# secrets. Run `npm run check:config` to see exactly what each service is
# missing — it prints variable names and constraints only, never values.
# =============================================================================