.env.example

# Code Interpreter API Configuration

# API Configuration
API_HOST=0.0.0.0
API_PORT=8000
API_DEBUG=false
API_RELOAD=false

# SSL/HTTPS Configuration
ENABLE_HTTPS=false
HTTPS_PORT=443
SSL_REDIRECT=false

# Docker: Path to directory containing cert.pem and key.pem on the host
# The directory is mounted to /app/ssl/ inside the container automatically.
# Default is ./ssl (relative to docker-compose.yml)
# SSL_CERTS_PATH=/path/to/your/ssl/certs

# Non-Docker only: Absolute paths to certificate files (not needed for Docker)
# SSL_CERT_FILE=/path/to/cert.pem
# SSL_KEY_FILE=/path/to/key.pem
# SSL_CA_CERTS=/path/to/ca.pem

# Authentication Configuration
API_KEY=your-secure-api-key-here-change-this-in-production
# API_KEYS=key1,key2,key3  # Additional API keys (comma-separated)
API_KEY_HEADER=x-api-key
API_KEY_CACHE_TTL=300

# API Key Management Configuration
# MASTER_API_KEY=your-secure-master-key  # Required for CLI key management
RATE_LIMIT_ENABLED=true

# Global auth toggle (default true). When false, user-facing endpoints
# skip api-key auth — use only when running behind a trusted boundary
# (mTLS sidecar, VPC ingress, CIDR allowlist). Admin endpoints still
# require MASTER_API_KEY regardless.
# AUTH_ENABLED=true

# Trusted-network bypass (CIDR list, comma-separated). Requests whose
# socket peer IP falls in one of these networks skip api-key auth.
# Useful for in-cluster callers when AUTH_ENABLED can't be flipped
# globally. Source IP is the TCP peer, NOT X-Forwarded-For — unspoofable.
# AUTH_TRUSTED_NETWORKS=10.0.0.0/8,172.16.0.0/12

# LibreChat CodeAPI JWT Authentication
# --------------------------------------
# LibreChat 0.8.5 (danny-avila/LibreChat#13028) mints short-lived signed
# JWTs and sends them as `Authorization: Bearer <jwt>`. Enable this
# verifier when LC is configured with CODEAPI_AUTH_PROVIDER=librechat-jwt
# (or `both`). Env-var names mirror LC's signer side 1:1 — copy values
# from LC's deployment.
#
# CODEAPI_JWT_ENABLED=false
# CODEAPI_JWT_PUBLIC_KEY=                 # PEM, JWK JSON, or file path
# CODEAPI_JWT_ALGORITHM=EdDSA             # EdDSA (default) or RS256
# CODEAPI_JWT_ISSUER=librechat
# CODEAPI_JWT_AUDIENCE=codeapi
# CODEAPI_JWT_LEEWAY_SECONDS=10
# CODEAPI_JWT_TRUST_TENANT_ID=false       # record JWT tenant_id on sessions

# Redis Configuration
REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_PASSWORD=
REDIS_DB=0
# Alternative: Use Redis URL instead of individual settings
# REDIS_URL=redis://localhost:6379/0
REDIS_MAX_CONNECTIONS=20
REDIS_SOCKET_TIMEOUT=5
REDIS_SOCKET_CONNECT_TIMEOUT=5

# Redis Mode (standalone, cluster, sentinel)
# REDIS_MODE=standalone

# Redis Key Prefix (for multi-tenant deployments)
# REDIS_KEY_PREFIX=kcr:

# Redis TLS Configuration
# REDIS_SSL=false
# REDIS_SSL_CA_CERTS=/path/to/ca.pem
# REDIS_SSL_CERT_REQS=required
# REDIS_SSL_CERTFILE=/path/to/client-cert.pem
# REDIS_SSL_KEYFILE=/path/to/client-key.pem
# REDIS_SSL_CHECK_HOSTNAME=true

# Redis Cluster Configuration (mode=cluster)
# REDIS_CLUSTER_NODES=host1:6379,host2:6379,host3:6379

# Redis Sentinel Configuration (mode=sentinel)
# REDIS_SENTINEL_NODES=sentinel1:26379,sentinel2:26379,sentinel3:26379
# REDIS_SENTINEL_MASTER=mymaster
# REDIS_SENTINEL_PASSWORD=
# REDIS_SENTINEL_DB=0

# MinIO/S3 Configuration
MINIO_ENDPOINT=localhost:9000
MINIO_ACCESS_KEY=minioadmin
MINIO_SECRET_KEY=minioadmin
MINIO_SECURE=false
MINIO_BUCKET=kubecoderun-files
MINIO_REGION=us-east-1
# MINIO_USE_IAM=false  # Use IAM authentication (for AWS S3/IRSA)

# Kubernetes Configuration
K8S_IMAGE_REGISTRY=aronmuon/kubecoderun
K8S_IMAGE_TAG=latest
K8S_IMAGE_PULL_POLICY=Always
# K8S_IMAGE_PULL_SECRETS=  # Comma-separated secret names for private registries (e.g., docker-privaterepo,another-secret)
# K8S_NAMESPACE=  # Defaults to API's namespace
# K8S_SERVICE_ACCOUNT=kubecoderun-executor
# K8S_CPU_LIMIT=1
# K8S_MEMORY_LIMIT=512Mi
# K8S_CPU_REQUEST=100m
# K8S_MEMORY_REQUEST=128Mi
# K8S_RUN_AS_USER=65532
# K8S_SECCOMP_PROFILE_TYPE=RuntimeDefault
# K8S_JOB_TTL_SECONDS=60
# K8S_JOB_DEADLINE_SECONDS=300

# Resource Limits - Execution
MAX_EXECUTION_TIME=30
MAX_MEMORY_MB=512
MAX_CPUS=1
MAX_CPU_QUOTA=50000 #Deprecated
MAX_PIDS=512
MAX_OPEN_FILES=1024

# Resource Limits - Files
MAX_FILE_SIZE_MB=10
MAX_TOTAL_FILE_SIZE_MB=50
MAX_FILES_PER_SESSION=50
MAX_OUTPUT_FILES=10
MAX_FILENAME_LENGTH=255

# Resource Limits - Sessions
MAX_CONCURRENT_EXECUTIONS=10
MAX_SESSIONS_PER_ENTITY=100

# Session Configuration
# TTL applies only to MinIO-stored session data (files/metadata). Containers are ephemeral per execution.
# 0 = no expiry (infinite). Max 8760 (1 year).
SESSION_TTL_HOURS=0
SESSION_CLEANUP_INTERVAL_MINUTES=10
SESSION_ID_LENGTH=32

# MinIO Orphan Cleanup (optional)
# Enable periodic pruning of MinIO objects older than TTL with missing Redis sessions
# ENABLE_ORPHAN_MINIO_CLEANUP=false

# Pod Pool Configuration
POD_POOL_ENABLED=true
POD_POOL_WARMUP_ON_STARTUP=true
# POD_TTL_MINUTES=5
# POD_CLEANUP_INTERVAL_MINUTES=5

# Per-language pool sizes (0 = on-demand only, no pre-warming)
# Only set the languages you want to pre-warm
POD_POOL_PY=5     # Python
POD_POOL_JS=2     # JavaScript
# POD_POOL_TS=0   # TypeScript (default: 0)
# POD_POOL_GO=0   # Go (default: 0)
# POD_POOL_JAVA=0 # Java (default: 0)
# POD_POOL_C=0    # C (default: 0)
# POD_POOL_CPP=0  # C++ (default: 0)
# POD_POOL_PHP=0  # PHP (default: 0)
# POD_POOL_RS=0   # Rust (default: 0)
# POD_POOL_R=0    # R (default: 0)
# POD_POOL_F90=0  # Fortran (default: 0)
# POD_POOL_D=0    # D (default: 0)
# POD_POOL_BASH=0 # Bash (default: 0)

# Pool optimization settings
POD_POOL_PARALLEL_BATCH=5
POD_POOL_REPLENISH_INTERVAL=2
POD_POOL_EXHAUSTION_TRIGGER=true

# Max seconds to wait for a freshly-created pool pod to reach Ready.
# Default 300s (5 min) accommodates first-pull of large multi-runtime
# images (the unified bash image is ~1.13 GB and can take 90-180s to
# pull on a cold node). Too short a timeout is the most common reason
# `POD_POOL_<LANG>=N` doesn't materialise as N warm replicas — the pool
# tears down each pod before its image finishes pulling. The pool also
# early-aborts on terminal states (ImagePullBackOff, CrashLoopBackOff)
# so a misconfigured image fails fast regardless of this value.
POD_POOL_READY_TIMEOUT_SECONDS=300

# State Persistence Configuration (Python)
# Enables Python variable/function persistence across executions within same session
STATE_PERSISTENCE_ENABLED=true
# Redis hot storage TTL (default: 2 hours)
STATE_TTL_SECONDS=7200
# Maximum serialized state size
STATE_MAX_SIZE_MB=50
# Capture state even on execution failure
STATE_CAPTURE_ON_ERROR=false

# State Archival Configuration (Python)
# Archives inactive states from Redis to MinIO for long-term storage
STATE_ARCHIVE_ENABLED=true
# Archive to MinIO after this inactivity period (default: 1 hour)
STATE_ARCHIVE_AFTER_SECONDS=3600
# Keep archived states in MinIO for this many days
STATE_ARCHIVE_TTL_DAYS=7
# How often to check for states to archive
STATE_ARCHIVE_CHECK_INTERVAL_SECONDS=300

# Detailed Metrics Configuration
# Track per-API-key, per-language execution metrics
DETAILED_METRICS_ENABLED=true
# Maximum metrics to buffer in memory
METRICS_BUFFER_SIZE=10000
# Archive metrics to MinIO for long-term analysis
METRICS_ARCHIVE_ENABLED=true
# Keep archived metrics for this many days
METRICS_ARCHIVE_RETENTION_DAYS=90

# SQLite Metrics (local dashboard metrics)
# SQLITE_METRICS_ENABLED=true
# SQLITE_METRICS_DB_PATH=data/metrics.db
# METRICS_EXECUTION_RETENTION_DAYS=90
# METRICS_DAILY_RETENTION_DAYS=365
# METRICS_AGGREGATION_INTERVAL_MINUTES=60

# Pod Hardening
# POD_MASK_HOST_INFO=true
# POD_GENERIC_HOSTNAME=sandbox

# Pod Scheduling (for targeting sandboxed node pools)
# K8S_RUNTIME_CLASS_NAME=gvisor
# K8S_POD_NODE_SELECTOR={"sandbox":"true"}
# K8S_POD_TOLERATIONS=[{"key":"sandbox","operator":"Exists","effect":"NoSchedule"}]

# Custom Pod Labels
# JSON-encoded extra labels applied to all execution pods.
# K8S_POD_LABELS={"example.com/workload-type":"CodeRunner","example.com/workload-name":"MyApp"}
# JSON-encoded list of label keys from K8S_POD_LABELS whose values get "-<lang>" appended
# (e.g. "MyApp" becomes "MyApp-py" for Python pods). Optional — omit to skip suffixing.
# K8S_POD_LABEL_LANGUAGE_SUFFIX=["example.com/workload-name"]

# Security Configuration
ENABLE_NETWORK_ISOLATION=true
ENABLE_FILESYSTEM_ISOLATION=true

# WAN Network Access Configuration
# When enabled, execution containers can access the public internet
# but are blocked from accessing host, other containers, and private networks
# IMPORTANT: Requires NET_ADMIN capability for iptables management
ENABLE_WAN_ACCESS=false
WAN_NETWORK_NAME=kubecoderun-wan
# WAN_DNS_SERVERS=8.8.8.8,1.1.1.1,8.8.4.4

# Logging Configuration
LOG_LEVEL=INFO
LOG_FORMAT=json
# LOG_FILE=/var/log/kubecoderun-api.log
LOG_MAX_SIZE_MB=100
LOG_BACKUP_COUNT=5
ENABLE_ACCESS_LOGS=true
ENABLE_SECURITY_LOGS=true

# Health Check Configuration
HEALTH_CHECK_INTERVAL=30
HEALTH_CHECK_TIMEOUT=5

# Development Configuration
ENABLE_CORS=false
# CORS_ORIGINS=http://localhost:3000,http://localhost:8080
ENABLE_DOCS=true