singularity/.env.example at main · hellonish/singularity · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
# Copy to .env for local development. Never commit real secrets.
# All API settings use the SINGULARITY_ prefix.

SINGULARITY_ENVIRONMENT=development

# Database. SQLite (default) needs no setup. For Supabase Postgres use the
# async asyncpg driver and the "Connection pooling" (transaction/session) URI
# from Project Settings → Database, rewritten to the SQLAlchemy async form:
#   postgresql+asyncpg://postgres.<project-ref>:<password>@<pooler-host>:5432/postgres
# URL-encode special characters in the password.
SINGULARITY_DATABASE_URL=sqlite+aiosqlite:///./singularity.db

# Object storage. "local" writes to STORAGE_ROOT on disk. "s3" targets any
# S3-compatible endpoint, including Supabase Storage.
SINGULARITY_STORAGE_BACKEND=local
SINGULARITY_STORAGE_ROOT=./data/objects

# Application audit/debug log. "steps" records flow boundaries and identifiers
# only; "full" also records user inputs, model outputs, research payloads, and
# every streamed chat delta. Full logs contain user content and need restricted
# access and an explicit retention policy.
SINGULARITY_LOG_FILE=./logs/singularity.log
SINGULARITY_LOG_MODE=steps
SINGULARITY_LOG_LEVEL=INFO
SINGULARITY_LOG_MAX_BYTES=10485760
SINGULARITY_LOG_BACKUP_COUNT=5

# Supabase Storage (S3-compatible). Required when STORAGE_BACKEND=s3.
# Endpoint is Project Settings → Storage → S3 connection endpoint. Prefer the
# direct Storage hostname:
#   https://<project-ref>.storage.supabase.co/storage/v1/s3
# Access key id / secret are generated under Storage → S3 access keys.
# Region must match the project's region. Create the bucket first.
SINGULARITY_S3_BUCKET=
SINGULARITY_S3_ENDPOINT_URL=
SINGULARITY_S3_REGION=us-east-1
SINGULARITY_S3_ACCESS_KEY_ID=
SINGULARITY_S3_SECRET_ACCESS_KEY=

# Required before accepting any user BYOK credential. Generate once with:
# python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# Keep this stable: changing it makes existing encrypted credentials unreadable.
SINGULARITY_CREDENTIAL_ENCRYPTION_KEY=

# Used only when a request, selected conversation, and credential default all
# omit a model. The selected provider validates the resolved model.
SINGULARITY_GROQ_FALLBACK_MODEL=openai/gpt-oss-20b
SINGULARITY_SSE_DUMMY_DELAY_SECONDS=0.15
SINGULARITY_REDIS_URL=redis://localhost:6379/0
SINGULARITY_RESEARCH_WORKER_ENABLED=0
SINGULARITY_RESEARCH_RUNS_PER_HOUR=3

# Real-inference smoke testing only. When 1, a research run may send
# "test_mode": true to force a single-node run (one real search + one real
# fetch). Keep 0 outside deliberate testing; a request cannot enable it alone.
SINGULARITY_RESEARCH_TEST_MODE=0
SINGULARITY_DEEPSEEK_FALLBACK_MODEL=deepseek-v4-flash
SINGULARITY_OPENROUTER_FALLBACK_MODEL=openai/gpt-4.1-mini

# Comma-separated browser origins allowed to call the API. Empty (default)
# leaves CORS off entirely. Example: http://localhost:3000,https://app.example.com
SINGULARITY_CORS_ALLOW_ORIGINS=

# Authentication. "bearer" (default) verifies a Google id_token and issues JWTs;
# "header" preserves the temporary X-User-ID boundary for local curl and tests.
# Bearer mode always requires a JWT signing secret. Browser Google login also
# requires the OAuth client id; automatic CLI device login does not.
SINGULARITY_AUTH_MODE=bearer
SINGULARITY_GOOGLE_CLIENT_ID=
SINGULARITY_JWT_SECRET=

# Modal is the master switch. The two tier flags allow independent diagnostics
# and rollout of trusted deterministic Functions versus stateful Sandboxes.
SINGULARITY_MODAL_ENABLED=0
SINGULARITY_MODAL_TRUSTED_FUNCTION_ENABLED=1
SINGULARITY_MODAL_SANDBOX_ENABLED=1
SINGULARITY_MODAL_APP=singularity-chat-tools
SINGULARITY_MODAL_FUNCTION=execute_chat_tool
SINGULARITY_MODAL_ENVIRONMENT=main
SINGULARITY_MODAL_TOOL_SECRET=singularity-tool-providers
SINGULARITY_MODAL_SANDBOX_APP=singularity-agent-sandboxes
SINGULARITY_MODAL_SANDBOX_TIMEOUT=1800
SINGULARITY_MODAL_SANDBOX_IDLE_TIMEOUT=300
SINGULARITY_MODAL_SANDBOX_IMAGE_REPOSITORY=singularity-sandbox-repository
SINGULARITY_MODAL_SANDBOX_IMAGE_REPOSITORY_BUILD=singularity-sandbox-repository_build
SINGULARITY_MODAL_SANDBOX_IMAGE_CODE=singularity-sandbox-code
SINGULARITY_MODAL_SANDBOX_IMAGE_DATA=singularity-sandbox-data
SINGULARITY_MODAL_SANDBOX_IMAGE_SERVICE=singularity-sandbox-service
SINGULARITY_MODAL_SANDBOX_IMAGE_GPU=singularity-sandbox-gpu
# Configure MODAL_TOKEN_ID and MODAL_TOKEN_SECRET outside this repository.

# Optional, only for the real Groq integration test. Do not commit a value.
SINGULARITY_TEST_GROQ_API_KEY=
SINGULARITY_RUN_LIVE_TESTS=0
SINGULARITY_RUN_MODAL_TESTS=0
SINGULARITY_RUN_MODAL_SANDBOX_TESTS=0

# Optional LangSmith observability. Keep content capture disabled by default;
# never commit LANGSMITH_API_KEY or enable content capture for production data
# without an approved retention policy.
LANGSMITH_TRACING=false
LANGSMITH_API_KEY=
LANGSMITH_PROJECT=singularity-dev
# LANGSMITH_ENDPOINT=https://api.smith.langchain.com
SINGULARITY_LANGSMITH_CAPTURE_CONTENT=false

# Terminal provider keys are configured interactively with /key and stored in
# ~/.config/singularity/terminal.json (user-only permissions). They are not
# read from .env. The Modal secret is separate and is only for optional tool
# provider credentials such as TAVILY_API_KEY or GITHUB_TOKEN.
# The terminal runs directly against the selected provider and Modal by
# default, loading this .env file. Set SINGULARITY_CLI_BACKEND=api only when a
# separately deployed API backend is intentionally available.