-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.example
More file actions
139 lines (125 loc) · 8.73 KB
/
Copy path.env.example
File metadata and controls
139 lines (125 loc) · 8.73 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
# =============================================================================
# HARBOR — ENVIRONMENT VARIABLE REFERENCE
# Keys read by core/config/config.ts (validateGlobalConfig +
# resolveStoreTypeConfig). Copy to your deploy env or local .env file.
#
# Convention:
# - Uncommented lines = defaults applied when the var is absent.
# - Commented lines = conditional / optional; set only when needed.
# - "required" means the process exits at startup if the var is absent
# and the relevant backend type is active.
#
# ── Quick index (everything validateGlobalConfig + backends may read) ────────
# Always parsed (defaults shown inline below where uncommented):
# MCP_HOST MCP_PORT MCP_TRANSPORT MCP_TOKEN?
# SERVICES_DIR
# SESSION_IDLE_TTL_MS SESSION_SWEEP_INTERVAL_MS
# AUTH_TOKEN_CACHE_TTL_MS TOKEN_CACHE_TYPE IDEMPOTENCY_TYPE
# SANDBOX_MEMORY_MB SANDBOX_EXECUTE_TIMEOUT_MS SANDBOX_SEARCH_TIMEOUT_MS
# SANDBOX_MAX_API_CALLS SANDBOX_MAX_CONCURRENT_CALLS
# LOG_LEVEL SERVICE_NAME MCP_AGENT_NAME ENVIRONMENT ENABLE_AUDIT
# Conditional — TOKEN_CACHE_TYPE:
# memcache → TOKEN_CACHE_MEMCACHE_HOST PORT (+ optional TIMEOUT_MS)
# couchbase → TOKEN_CACHE_CB_HOST PORT BUCKET USERNAME PASSWORD (+ optional TIMEOUT_MS)
# Conditional — IDEMPOTENCY_TYPE:
# memcache → IDEMPOTENCY_MEMCACHE_HOST PORT (+ optional TIMEOUT_MS)
# couchbase → IDEMPOTENCY_CB_HOST PORT BUCKET USERNAME PASSWORD (+ optional TIMEOUT_MS)
# =============================================================================
# ── MCP server ────────────────────────────────────────────────────────────────
MCP_HOST=127.0.0.1
MCP_PORT=3333
# http | stdio
MCP_TRANSPORT=http
# Required when MCP_TRANSPORT=stdio — static bearer for the stdio client connection
# MCP_TOKEN=
# ── Services directory ────────────────────────────────────────────────────────
# Absolute or relative path to the directory containing per-service subdirectories.
# Each subdirectory must contain a config.json. Defaults to ./services when unset.
# In Docker the image sets this to /app/services automatically.
# SERVICES_DIR=./services
# ── Session (HTTP transport only) ─────────────────────────────────────────────
# Idle MCP session eviction threshold (ms). Default: 1 hour.
SESSION_IDLE_TTL_MS=3600000
# How often the idle-session sweeper runs (ms). Default: 5 min.
SESSION_SWEEP_INTERVAL_MS=300000
# ── Auth — token cache TTL ────────────────────────────────────────────────────
# Upper bound on how long a validated token stays cached. Actual TTL per entry
# = min(token's own expires_in, AUTH_TOKEN_CACHE_TTL_MS). Default: 5 min.
AUTH_TOKEN_CACHE_TTL_MS=300000
# ── Token cache backend (SYSTEM-LEVEL — shared by every service, no per-service override)
# One backend is active for the entire gateway process.
# Valid values: in-memory | memcache | couchbase
TOKEN_CACHE_TYPE=in-memory
# ── TOKEN_CACHE_TYPE=memcache ─────────────────────────────────────────────────
# Prefix: TOKEN_CACHE_MEMCACHE_
# Use when multiple gateway pods share a Memcached cluster for token lookups.
#
# TOKEN_CACHE_MEMCACHE_HOST=memcache.svc.cluster.local # required
# TOKEN_CACHE_MEMCACHE_PORT=11211 # required
# TOKEN_CACHE_MEMCACHE_TIMEOUT_MS=2000 # optional (default: 2000)
# ── TOKEN_CACHE_TYPE=couchbase ────────────────────────────────────────────────
# Prefix: TOKEN_CACHE_CB_ (host, port, bucket, username, password).
# Token cache and idempotency use separate env prefixes so each can target a different cluster.
# Recommended bucket name: mcp-token-cache (bucket TTL ≈ 300 s to match token TTL).
#
# TOKEN_CACHE_CB_HOST=cb-cluster-0.cb-cluster.couchbase.svc.cluster.local # required
# TOKEN_CACHE_CB_PORT=8091 # required (REST/KV port per your deployment)
# TOKEN_CACHE_CB_BUCKET=mcp-token-cache # required — create bucket in Couchbase first
# TOKEN_CACHE_CB_USERNAME= # required — Vault: TOKEN_CACHE_CB_USERNAME
# TOKEN_CACHE_CB_PASSWORD= # required — Vault: TOKEN_CACHE_CB_PASSWORD
# TOKEN_CACHE_CB_TIMEOUT_MS=3000 # optional (default: 3000)
# ── Sandbox (SYSTEM-LEVEL defaults — per-service config.json sandbox block may override)
SANDBOX_MEMORY_MB=64 # V8 isolate memory cap per run (MB)
SANDBOX_EXECUTE_TIMEOUT_MS=8000 # Wall-clock cap for api_execute sandbox (ms; includes awaits)
SANDBOX_SEARCH_TIMEOUT_MS=3000 # Wall-clock cap for search_code / discover_skills (ms)
SANDBOX_MAX_API_CALLS=50 # Max api.request() calls per sandbox run
SANDBOX_MAX_CONCURRENT_CALLS=5 # Max concurrent in-flight requests per run
# ── Idempotency (SYSTEM-LEVEL default — services may override type + TTL in config.json)
# Default is noop (no deduplication). For multi-pod deployments use memcache or couchbase.
# Connection fields (host/port/bucket/credentials) are env-only; per-service config.json
# may only change the type and idempotencyKeyTtlMs.
# Valid values: noop | in-memory | memcache | couchbase
IDEMPOTENCY_TYPE=noop
# ── IDEMPOTENCY_TYPE=memcache ─────────────────────────────────────────────────
# Prefix: IDEMPOTENCY_MEMCACHE_
# Use when multiple gateway pods share a Memcached cluster for request deduplication.
# Token cache may use a different Memcached cluster via TOKEN_CACHE_MEMCACHE_*.
#
# IDEMPOTENCY_MEMCACHE_HOST=memcache.svc.cluster.local # required
# IDEMPOTENCY_MEMCACHE_PORT=11211 # required
# IDEMPOTENCY_MEMCACHE_TIMEOUT_MS=2000 # optional (default: 2000)
# ── IDEMPOTENCY_TYPE=couchbase ────────────────────────────────────────────────
# Prefix: IDEMPOTENCY_CB_
# Recommended bucket name: mcp-idempotency (bucket TTL ≈ 86400 s = 1 day).
#
# IDEMPOTENCY_CB_HOST=cb-cluster-0.cb-cluster.couchbase.svc.cluster.local # required
# IDEMPOTENCY_CB_PORT=8091 # required
# IDEMPOTENCY_CB_BUCKET=mcp-idempotency # required — create bucket in Couchbase first
# IDEMPOTENCY_CB_USERNAME= # required — Vault: IDEMPOTENCY_CB_USERNAME
# IDEMPOTENCY_CB_PASSWORD= # required — Vault: IDEMPOTENCY_CB_PASSWORD
# IDEMPOTENCY_CB_TIMEOUT_MS=3000 # optional (default: 3000)
# ── Observability ─────────────────────────────────────────────────────────────
# fatal | error | warn | info | debug | trace
LOG_LEVEL=info
SERVICE_NAME=harbor-gateway
# Sent as X-Request-Source header to all downstream API calls. Default: mcp-agent.
MCP_AGENT_NAME=mcp-agent
# dev | staging | staging-secondary | canary | prod
# Non-prod environments include caller file:line in logs (pino-caller).
ENVIRONMENT=dev
# Set true in production to log every api_execute call for compliance/audit trails.
ENABLE_AUDIT=false
# ── OAuth 2.1 / RFC 9728 Protected Resource Metadata (optional) ──────────────
# Set HARBOR_RESOURCE_URI to enable the OAuth 2.1 discovery flow.
# When set, Harbor advertises a /.well-known/oauth-protected-resource document
# and includes a WWW-Authenticate header on 401 responses so MCP clients can
# discover where to obtain a token. Clients that already carry a token are
# completely unaffected.
#
# HARBOR_RESOURCE_URI=https://harbor.example.com # required to enable OAuth 2.1 mode
# HARBOR_AUTH_SERVERS=https://auth.example.com # comma-separated list of AS URIs
# HARBOR_SCOPES_SUPPORTED=api:read,api:write # optional: advertised scopes
# ── Per-service config.json ────────────────────────────────────────────────────
# Connection and strategy options for each service live in services/<name>/config.json,
# not in env vars. See docs/configuration.md for the full per-service reference and the
# idempotency merge semantics over the IDEMPOTENCY_* defaults above.