.env.example

# ── z8run environment ──────────────────────────────────────
# Copy to .env and adjust for your deployment

# Database (local dev uses SQLite by default)
Z8_DB_URL=postgres://z8run:z8run_secret@localhost:5432/z8run
Z8_PORT=7700
Z8_LOG_LEVEL=info
Z8_BIND=0.0.0.0
Z8_DATA_DIR=./data

# ── Docker deployment ─────────────────────────────────────
# Password for the z8run PostgreSQL user
POSTGRES_PASSWORD=z8run_secret

# JWT signing secret. REQUIRED for PostgreSQL/MySQL. With SQLite, when unset,
# a random one is generated on first start and kept in $Z8_DATA_DIR/secrets/.
# Generate with: openssl rand -base64 32
Z8_JWT_SECRET=change-me-in-production

# Encryption key for the credential vault (MUST change in production!).
# When unset it falls back to Z8_JWT_SECRET if that is set, otherwise to a
# generated key in $Z8_DATA_DIR/secrets/vault.key. Back that file up: losing
# it makes every stored credential unreadable.
Z8_VAULT_SECRET=change-me-in-production

# Mark the session cookie as Secure (HTTPS-only). Keep true in production:
# without it the session cookie can travel over plain HTTP. Browsers still
# send Secure cookies to http://localhost, so local use works; set false only
# to reach the app over plain HTTP from another machine.
Z8_COOKIE_SECURE=true

# Public port - use 80 behind Cloudflare, 8080 for local dev
Z8_PUBLIC_PORT=80

# ── CORS ─────────────────────────────────────────────────
# Comma-separated list of allowed browser origins. When set, CORS is
# restricted to exactly these origins. When unset, CORS is permissive
# (convenient for local dev) and a warning is logged at startup.
# Example: Z8_CORS_ORIGINS=https://app.example.com,https://admin.example.com
Z8_CORS_ORIGINS=

# ── Rate limiting ────────────────────────────────────────
# Requests per window per IP (token bucket). Set 0 to disable a limiter.
Z8_RATE_LIMIT_API=100
Z8_RATE_LIMIT_AUTH=20
Z8_RATE_LIMIT_HOOK=200
Z8_RATE_LIMIT_WINDOW=60

# ── Reverse proxy / client IP ────────────────────────────
# Per-IP limits key on the TCP peer unless the backend sits behind a proxy.
# Set Z8_TRUST_PROXY=true ONLY when the backend is not reachable directly
# (e.g. the docker-compose setup, where only nginx is published). Then
# X-Forwarded-For is read right to left, skipping hops that are trusted
# proxies; the first untrusted address is the client.
# Z8_TRUSTED_PROXIES: comma-separated IPs/CIDRs of your proxies. Default when
# empty: loopback and private ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12,
# 192.168.0.0/16, ::1, fc00::/7).
# With Cloudflare in front, let nginx resolve CF-Connecting-IP (see
# deploy/nginx.conf) rather than listing Cloudflare ranges here.
Z8_TRUST_PROXY=false
Z8_TRUSTED_PROXIES=

# ── Outbound connections from flows ──────────────────────
# Any registered user can build flows that run on this server, so nodes that
# connect out (HTTP Request, LLM/AI, embeddings, CRM, database, MQTT, ...)
# follow an egress policy.
#   strict (default): refuse loopback, private networks, link-local / cloud
#     metadata (169.254.169.254), CGNAT and other non-public addresses. DNS
#     answers and every redirect hop are checked too.
#   permissive: no filtering. Only for single-operator installs where every
#     flow author is trusted with the server's network access.
# This is an application-level check. For defense in depth also restrict
# outbound traffic at the network level (container/host firewall), and give
# database nodes accounts with the least privilege they need.
Z8_EGRESS_POLICY=strict
# Exceptions in strict mode: comma-separated IPs, CIDRs or hostnames.
# Example (local Ollama and an internal database):
#   Z8_EGRESS_ALLOW=localhost,127.0.0.1,10.0.5.20
Z8_EGRESS_ALLOW=
# Largest response body an outbound HTTP call may return (bytes, 10 MiB).
Z8_EGRESS_MAX_RESPONSE_BYTES=10485760

# ── Database node ────────────────────────────────────────
# Directory that SQLite files used by flows must live in (strict policy).
# Unset: only in-memory SQLite. Never point it at Z8_DATA_DIR, which holds
# z8run's own database.
Z8_DB_SQLITE_DIR=
# Per-query time limit (seconds) and maximum rows returned per query.
Z8_DB_QUERY_TIMEOUT_SECS=30
Z8_DB_MAX_ROWS=1000

# ── WASM plugins ─────────────────────────────────────────
# Limits for every call into a plugin. A plugin's manifest can ask for less
# memory, never more. A call that exceeds a limit fails and the plugin
# instance is replaced with a fresh one.
Z8_PLUGIN_MAX_MEMORY_MB=128
# CPU budget per call, in fuel units (roughly WASM instructions).
Z8_PLUGIN_FUEL=2000000000
# Wall-clock limit per call, in milliseconds.
Z8_PLUGIN_TIMEOUT_MS=5000
# Plugin calls running at once across the whole server (default: CPU cores).
# A call that can't get a slot within Z8_PLUGIN_TIMEOUT_MS is refused.
Z8_PLUGIN_MAX_CONCURRENCY=