Epstein/.env.example at main · l0lsec/Epstein · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
# Epstein Files Search Platform — environment template
# Copy to .env and fill in the values you want to use. .env is gitignored.

# ─── Core ────────────────────────────────────────────────────────────────────

# OpenAI API key — required for Ask AI, AI summaries, and the Whisper API
# transcription fallback. Leave blank to disable LLM features.
OPENAI_API_KEY=

# Chat model used for Ask AI / summaries (defaults to gpt-4-turbo). Token usage
# and cost per call are tracked on the admin dashboard's "LLM Cost" tab.
# OPENAI_MODEL=gpt-4-turbo

# Fallback price (USD per 1,000,000 tokens) for cost tracking when the configured
# model isn't in the built-in pricing table. Set both to price an unknown model.
# LLM_PRICE_INPUT_PER_1M=
# LLM_PRICE_OUTPUT_PER_1M=

# OPTIONAL: OpenAI dashboard *session* key (sess-...) used only to show the live
# provider credit balance on the admin "LLM Cost" tab. Standard sk- API keys
# CANNOT read remaining prepaid balance — OpenAI restricts that endpoint. If you
# don't set this, the dashboard falls back to a balance snapshot you record
# manually (recommended for most setups). Leave blank to disable the live fetch.
# OPENAI_BILLING_KEY=

# Override the project base path (used when running the server from a cwd
# other than the repo root). Defaults to the parent of backend/.
# EPSTEIN_BASE_PATH=

# Server bind host/port
HOST=0.0.0.0
PORT=8000

# ─── Admin & access control ──────────────────────────────────────────────────

# Required to use the admin panel and /api/admin/* endpoints. If unset,
# admin endpoints are unreachable. Use a long random string (e.g.
# `python -c "import secrets; print(secrets.token_urlsafe(32))"`).
ADMIN_API_KEY=

# Optional comma-separated list of IPs additionally allowed to hit admin
# endpoints. Leave blank to allow any client with the ADMIN_API_KEY header.
ADMIN_IP_WHITELIST=

# Comma-separated CORS allow-list for the API
ALLOWED_ORIGINS=http://localhost:8000,http://127.0.0.1:8000

# Comma-separated referer allow-list for /api/documents/{id}/file
# (anti-scraping). Leave blank to use the built-in defaults (own domain +
# major social platforms + ChatGPT).
ALLOWED_REFERERS=

# ─── Spam protection ─────────────────────────────────────────────────────────

# Google reCAPTCHA v3 secret key. If unset, feedback spam protection is
# disabled and all submissions are accepted. The matching site key is
# embedded in frontend/app.js — replace it there too when rotating.
RECAPTCHA_SECRET_KEY=

# ─── Sessions & security ─────────────────────────────────────────────────────

# HMAC key for signed session IDs. If unset, a random key is generated per
# process (sessions don't survive restarts). Set explicitly in production.
SESSION_SECRET_KEY=

# Set to true behind HTTPS so session cookies are marked Secure.
SESSION_COOKIE_SECURE=false

# Comma-separated proxy IPs trusted to set X-Forwarded-For. When behind
# nginx on localhost, 127.0.0.1 is typical.
TRUSTED_PROXIES=

# Cloudflare client-IP handling: auto / enabled / disabled
CLOUDFLARE_MODE=auto

# ─── Background indexing ─────────────────────────────────────────────────────

# Periodically re-index new files in the background while the server runs.
AUTO_INDEX_ENABLED=false

# Interval in seconds when AUTO_INDEX_ENABLED=true (default: 48 hours)
AUTO_INDEX_INTERVAL=172800

# ─── Ads / monetization ──────────────────────────────────────────────────────

# Ads.txt Manager URL. When set, GET /ads.txt 301-redirects here so the ad
# network can keep the authorized-seller list current (e.g.
# https://srv.adstxtmanager.com/XXXXX/epsteinfta.com). If unset, a static
# frontend/ads.txt is served when present, otherwise /ads.txt returns 404.
ADS_TXT_REDIRECT_URL=