overlay-web/.env.enterprise.example at main · LayerNorm/overlay-web · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
# Copy to .env and replace every placeholder before running:
#   cp .env.enterprise.example .env
#   cp docs/config/enterprise-private.example.json overlay.config.json
#   docker compose pull
#   docker compose up -d
#
# This default path pulls a published image. If you edit source code, use:
#   docker compose -f docker-compose.yml -f docker-compose.build.yml up --build -d

OVERLAY_WEB_IMAGE=ghcr.io/layernorm/overlay-web:latest
OVERLAY_HTTP_PORT=3000

NODE_ENV=production
NEXT_TELEMETRY_DISABLED=1

# Public app and Convex endpoints.
NEXT_PUBLIC_APP_URL=https://overlay.enterprise.example.com
NEXT_PUBLIC_CONVEX_URL=https://convex-enterprise.example.com

# Runtime config mounted by docker-compose.yml.
OVERLAY_CONFIG_FILE=/app/overlay.config.json
OVERLAY_CONFIG_VERSION=2
OVERLAY_CONFIG_PRESET=enterprise-private

# App-only secrets. Do not put these in Convex except INTERNAL_API_SECRET.
INTERNAL_API_SECRET=replace_with_internal_api_secret
INTERNAL_SERVICE_AUTH_SECRET=replace_with_internal_service_auth_secret
SESSION_SECRET=replace_with_session_secret
SESSION_TRANSFER_KEY=replace_with_session_transfer_key
SESSION_COOKIE_ENCRYPTION_KEY=replace_with_cookie_encryption_key
# Encrypts bearer tokens and custom headers stored for MCP servers.
MCP_CREDENTIAL_ENCRYPTION_KEY=replace_with_at_least_32_random_characters
# MCP_CREDENTIAL_ENCRYPTION_KEY_PREVIOUS=
# Rotation overlap only. Remove after the old session lifetime expires.
# SESSION_SECRET_PREVIOUS=
# SESSION_COOKIE_ENCRYPTION_KEY_PREVIOUS=
# SESSION_TRANSFER_KEY_PREVIOUS=
API_KEY_HASH_SECRET=replace_with_api_key_hash_secret
PROVIDER_KEYS_SECRET=replace_with_provider_keys_secret
HOOKS_TOKEN_SALT=replace_with_hooks_token_salt

# OIDC. Keycloak realms can be configured here with their realm issuer URL.
AUTH_PROVIDER=oidc
OIDC_ISSUER_URL=https://idp.enterprise.example.com
OIDC_CLIENT_ID=overlay-web
OIDC_CLIENT_SECRET=replace_with_oidc_client_secret
OIDC_AUDIENCE=overlay-api

# Better Auth alternative. Uncomment this block instead of the OIDC block when
# Overlay should own the web session and issue Convex-verifiable service JWTs.
# AUTH_PROVIDER=better-auth
# BETTER_AUTH_URL=https://overlay.enterprise.example.com
# BETTER_AUTH_BASE_PATH=/api/better-auth
# BETTER_AUTH_SECRET=replace_with_better_auth_secret
# BETTER_AUTH_DATABASE_URL=postgres://overlay_auth:replace_with_password@postgres:5432/overlay_auth
# BETTER_AUTH_CONNECTION_ID=primary-sso
# BETTER_AUTH_CONNECTION_PRESET=generic-oidc
# BETTER_AUTH_CONNECTION_LABEL=Continue with Enterprise SSO
# BETTER_AUTH_CONNECTION_DOMAINS=enterprise.example.com
# BETTER_AUTH_CONNECTION_ISSUER_URL=https://idp.enterprise.example.com
# BETTER_AUTH_CONNECTION_CLIENT_ID=overlay-web
# BETTER_AUTH_CONNECTION_CLIENT_SECRET=replace_with_oidc_client_secret
# BETTER_AUTH_REQUIRE_VERIFIED_EMAIL=true
# BETTER_AUTH_ALLOWED_EMAIL_DOMAINS=enterprise.example.com
# BETTER_AUTH_JWT_ISSUER=https://overlay.enterprise.example.com
# BETTER_AUTH_JWT_AUDIENCE=https://overlay.enterprise.example.com
# BETTER_AUTH_JWKS_URL=https://overlay.enterprise.example.com/api/better-auth/jwks

# Distributed runtime coordination. Production/on-prem deployments fail closed when Redis is unavailable.
# OVERLAY_PROVIDER_RATE_LIMIT=redis
# OVERLAY_REDIS_URL=rediss://overlay-redis.internal:6379
# OVERLAY_REDIS_FAILURE_MODE=deny
OVERLAY_PROVIDER_VECTOR_SEARCH=convex
OVERLAY_PROVIDER_EMBEDDINGS=openai
OVERLAY_EMBEDDING_MODEL_VERSION=text-embedding-3-small-v1
OVERLAY_MEMORY_EXTRACTION_MODEL_ID=gpt-4.1-mini
OVERLAY_RETENTION_MEMORY_DAYS=365
VECTOR_SEARCH_ENABLED=true
OVERLAY_FEATURE_VECTOR_SEARCH=true

# Integration provider. Composio remains the hosted SaaS default. For private
# deployments, run Executor as a separate service and point Overlay at its
# authenticated /api and browser surfaces.
# OVERLAY_FEATURE_INTEGRATIONS=true
# OVERLAY_PROVIDER_INTEGRATIONS=executor
# EXECUTOR_API_BASE_URL=https://executor.internal.example.com/api
# EXECUTOR_WEB_BASE_URL=https://executor.example.com
# EXECUTOR_MCP_URL=https://executor.internal.example.com/mcp
# EXECUTOR_API_KEY=replace_with_executor_service_api_key
# EXECUTOR_CONNECTION_OWNER=org
# EXECUTOR_REQUEST_TIMEOUT_MS=30000
#
# The following belong on the Executor service, not the Overlay web service:
# BETTER_AUTH_SECRET=replace_with_executor_better_auth_secret
# EXECUTOR_SECRET_KEY=replace_with_executor_encryption_key

# Billing disabled for private deployments by default.
BILLING_PROVIDER=none
OVERLAY_FEATURE_BILLING=false

# S3-compatible object storage. The bucket must already exist.
STORAGE_PROVIDER=s3
S3_BUCKET_NAME=overlay-enterprise
S3_REGION=us-east-1
S3_ENDPOINT_URL=https://s3.enterprise.example.com
S3_ACCESS_KEY_ID=replace_with_s3_access_key
S3_SECRET_ACCESS_KEY=replace_with_s3_secret_key
S3_FORCE_PATH_STYLE=false
S3_PRESIGN_TTL_SECONDS=300

# Direct model provider example. Set LLM_GATEWAY=none to ship without external models.
LLM_GATEWAY=openai
OPENAI_API_KEY=replace_with_openai_api_key
DEFAULT_CHAT_MODEL_ID=gpt-4.1

# Disable high-risk external processors until explicitly approved.
OVERLAY_FEATURE_INTEGRATIONS=false
OVERLAY_FEATURE_SANDBOXES=false
OVERLAY_FEATURE_WEB_SEARCH=false
OVERLAY_FEATURE_ANALYTICS=false
OVERLAY_FEATURE_ERROR_REPORTING=false
NEXT_PUBLIC_OVERLAY_FEATURE_ANALYTICS=false
NEXT_PUBLIC_OVERLAY_FEATURE_ERROR_REPORTING=false
OVERLAY_PROVIDER_INTEGRATIONS=none
OVERLAY_PROVIDER_SANDBOX=none
OVERLAY_PROVIDER_WEB_SEARCH=none
OVERLAY_PROVIDER_ANALYTICS=none
OVERLAY_PROVIDER_ERROR_REPORTING=none

# Optional enterprise compliance metadata.
OVERLAY_COMPLIANCE_PROFILE=enterprise-private
OVERLAY_ALLOW_EXTERNAL_PROCESSORS=false
OVERLAY_ALLOWED_PROCESSORS=models:openai,objectStorage:s3