122 lines
5.2 KiB
Text
122 lines
5.2 KiB
Text
# ============================================================
|
|
# «Контракт-чек» — production config (see docs/ARCHITECTURE.md §11)
|
|
# Copy to `.env` and fill in. All config is 12-factor (env-driven).
|
|
# ============================================================
|
|
|
|
# --- Runtime ---
|
|
ENV=dev # dev | staging | prod
|
|
LOG_LEVEL=INFO
|
|
LOG_FORMAT=json # json (prod/staging) | console (dev)
|
|
APP_VERSION=0.1.0 # added to every log line; set at build/deploy time
|
|
|
|
# --- Postgres (async) ---
|
|
DATABASE_URL=postgresql+asyncpg://contract_check:contract_check@postgres:5432/contract_check
|
|
|
|
# --- Redis (rate-limit / sessions, future; NOT the job queue) ---
|
|
REDIS_URL=redis://redis:6379/0
|
|
|
|
# --- RabbitMQ (job queue pipeline) ---
|
|
RABBITMQ_URL=amqp://contract_check:contract_check@rabbitmq:5672//
|
|
MQ_PREFETCH_EXTRACT=1 # CPU-bound extraction; tune to CPU count
|
|
MQ_PREFETCH_ANALYZE=3 # mirrors Ollama Pro concurrency
|
|
MQ_PREFETCH_NOTIFY=5 # notification worker (I/O bound)
|
|
MQ_MAX_ATTEMPTS=5 # before a message lands on the DLQ
|
|
MQ_RETRY_BASE_MS=2000 # exponential backoff base (2s, 4s, 8s, ...)
|
|
|
|
# --- MinIO (object storage) ---
|
|
S3_ENDPOINT_URL=http://minio:9000
|
|
S3_ACCESS_KEY=contract_check
|
|
S3_SECRET_KEY=contract_check
|
|
S3_BUCKET=contract-check-docs
|
|
S3_REGION=us-east-1
|
|
S3_SERVER_SIDE_ENCRYPTION=false # true in prod
|
|
DOC_RETENTION_DAYS=7 # MinIO ILM expiry for raw docs (152-ФЗ lever)
|
|
TEXT_RETENTION_DAYS=30 # expiry for extracted .txt blobs
|
|
|
|
# --- Billing ---
|
|
REFUND_POLICY=all # all | infra_only (see docs/ARCHITECTURE.md §8)
|
|
|
|
# --- Observability (leave empty to disable) ---
|
|
SENTRY_DSN=
|
|
OTEL_EXPORTER_OTLP_ENDPOINT= # e.g. http://otel-collector:4317
|
|
OTEL_SERVICE_NAME=contract-check
|
|
|
|
# --- LLM provider (abstract port; first realization = Ollama Cloud) ---
|
|
# For Ollama Cloud use https://ollama.com (not api.ollama.com). Models must be
|
|
# available on the chosen host — cloud models differ from local Ollama models.
|
|
LLM_PROVIDER=ollama_cloud
|
|
OLLAMA_HOST=https://ollama.com
|
|
OLLAMA_API_KEY=replace-me
|
|
OLLAMA_MODEL=qwen2.5:14b
|
|
OLLAMA_FALLBACK_MODEL=qwen2.5:7b
|
|
OLLAMA_TEMPERATURE=0.2
|
|
OLLAMA_NUM_PREDICT=3072
|
|
OLLAMA_TIMEOUT=120
|
|
OLLAMA_MAX_CONCURRENCY=3
|
|
|
|
# --- YandexGPT (alternative provider) ---
|
|
# Set LLM_PROVIDER=yandex_gpt to use. Get API key & folder ID from Yandex Cloud.
|
|
YANDEXGPT_API_KEY=replace-me
|
|
YANDEXGPT_FOLDER_ID=replace-me
|
|
YANDEXGPT_MODEL=yandexgpt-lite # yandexgpt / yandexgpt-lite / yandexgpt-preview etc.
|
|
YANDEXGPT_FALLBACK_MODEL= # empty disables fallback
|
|
YANDEXGPT_BASE_URL=https://llm.api.cloud.yandex.net
|
|
YANDEXGPT_COMPLETION_PATH=/foundationModels/v1/completion
|
|
YANDEXGPT_TEMPERATURE=0.2
|
|
YANDEXGPT_MAX_TOKENS=3072
|
|
YANDEXGPT_TIMEOUT=120
|
|
YANDEXGPT_MAX_CONCURRENCY=3
|
|
CHUNK_SIZE_CHARS=10000
|
|
|
|
# --- API (FastAPI) ---
|
|
API_HOST=0.0.0.0
|
|
API_PORT=8000
|
|
API_METRICS_PORT=9100
|
|
B2B_DEFAULT_RATE_LIMIT_RPS=3 # per API key; mirrors Ollama Pro concurrency
|
|
CORS_ORIGINS= # comma-separated, future web SPA
|
|
|
|
# --- Auth (JWT + Telegram identity verification) ---
|
|
# Telegram bot token is also used by the API to verify Login Widget / Mini App signatures.
|
|
TELEGRAM_BOT_TOKEN=
|
|
JWT_SECRET= # HS256 secret for signing user JWTs; generate with `openssl rand -hex 32`
|
|
JWT_ALGORITHM=HS256
|
|
JWT_ACCESS_TTL_MINUTES=1440 # 24 hours default
|
|
JWT_REFRESH_TTL_DAYS=30 # refresh-token lifetime for webUI auth
|
|
|
|
# --- WebUI auth (email + password) ---
|
|
WEB_AUTH_ENABLED=true # toggle /api/v1/auth/{register,login,...} routes
|
|
WEB_ADMIN_ENABLED=true # toggle the /admin management UI (users role = 'admin')
|
|
ADMIN_REQUIRED_ROLE=admin # users.role value required to enter /admin
|
|
ADMIN_DEFAULT_EMAIL=admin@contract-check.local
|
|
# Default admin password. Set once on first deploy; the user is auto-created with role=admin.
|
|
# Leave empty to disable default admin creation (create admins manually via DB or register).
|
|
ADMIN_DEFAULT_PASSWORD=changeme-strong-password
|
|
PASSWORD_RESET_TTL_MINUTES=60
|
|
PASSWORD_MIN_LENGTH=8
|
|
WEB_APP_BASE_URL=http://localhost:5173 # SPA base — used to build reset links
|
|
|
|
# --- Prescreen stage (hybrid heuristic + optional LLM fallback) ---
|
|
PRESCREEN_ENABLED=true
|
|
PRESCREEN_AUTO_APPROVE=false
|
|
PRESCREEN_CONFIDENCE_THRESHOLD=0.75
|
|
PRESCREEN_HIGH_VALUE_THRESHOLD=100000
|
|
PRESCREEN_LLM_FALLBACK_ENABLED=false # kill-switch; set true after burn-in
|
|
PRESCREEN_LLM_FALLBACK_THRESHOLD=0.75 # <= confidence threshold
|
|
PRESCREEN_LLM_MAX_CHARS=20000 # cost-control cap for fallback
|
|
PRESCREEN_KEEP_REGEX=false # temporary rollback to regex-v1
|
|
|
|
# --- SMTP (notification transport; empty host → dev logger) ---
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_USERNAME=
|
|
SMTP_PASSWORD=
|
|
SMTP_FROM=no-reply@contract-check.local
|
|
SMTP_USE_TLS=true
|
|
|
|
# --- Edge proxy (Nginx + certbot) ---
|
|
NGINX_SERVER_NAME=contract-check.example.com # public domain for the edge profile
|
|
|
|
# --- Telegram bot (adapter, HTTP-only to api) ---
|
|
BOT_TOKEN= # same value as TELEGRAM_BOT_TOKEN (kept for the bot image)
|
|
BOT_SERVICE_TOKEN= # bearer looked up against service_tokens.name="bot-prod"
|
|
API_URL=http://api:8000 # base URL of the api service (container DNS in compose)
|