NodeGrade/stack.env.example at main · HASKI-RAK/NodeGrade · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
# Environment variables for the Portainer stack that runs docker-compose.prod.yml.
#
# Enter these as the stack's environment variables in Portainer (Stacks > the
# stack > Environment variables, or "Load variables from .env file" with a copy
# of this file). Portainer substitutes the ${VAR} references in the compose
# file from them and also writes them all to `stack.env`, which the backend
# service loads through `env_file`. So every backend setting from .env_template
# works here without a compose change; the ones below are the ones a
# deployment has to decide on.
#
# Never commit a filled-in copy. `stack.env` itself is gitignored.

# --- Required: the stack refuses to start without these -----------------------

# Public hostname, without scheme. Traefik routes it, and FRONTEND_URL and
# CORS_ORIGIN default to https://<this>.
NODEGRADE_HOST=grade.example.org

# Postgres password for the bundled database. Keep it URL-safe (letters, digits,
# - _ .) or set DATABASE_URL yourself with the escaped form.
POSTGRES_PASSWORD=

# Encrypts stored provider API keys. Generate once with
#   openssl rand -base64 32 | tr '+/' '-_' | tr -d '='
# and never change it: a new key cannot decrypt what the old one wrote.
PROVIDER_ENCRYPTION_KEY=

# Facilitator sign-in at /admin. Without both the admin area stays disabled.
ADMIN_USERNAME=
ADMIN_PASSWORD=

# --- Images -------------------------------------------------------------------

# Where .github/workflows/deploy.yml pushes. The service name (-backend,
# -frontend, -models) is appended. Change it only for a fork.
# NODEGRADE_IMAGE_PREFIX=ghcr.io/haski-rak/nodegrade
# `latest` follows main. Pin a build (sha-abc1234, from the Actions run) to roll
# back; the next webhook call still redeploys whatever tag is set here.
# NODEGRADE_IMAGE_TAG=latest

# --- Traefik ------------------------------------------------------------------

# The external network Traefik watches, and the names used in its labels.
# TRAEFIK_NETWORK=traefik_web
# TRAEFIK_ENTRYPOINT=websecure
# TRAEFIK_CERT_RESOLVER=le
# Router and service name inside Traefik. Must differ per stack if two NodeGrade
# stacks share one Traefik (e.g. a staging copy).
# TRAEFIK_ROUTER=nodegrade

# --- Backend ------------------------------------------------------------------

# Defaults to https://${NODEGRADE_HOST}. Comma-separated for several origins.
# CORS_ORIGIN=
# Proxies in front of the backend: Traefik, then nginx in the frontend image.
# Raise it if another proxy sits in front of Traefik.
# TRUST_PROXY=2
# Optional OpenAI-compatible text-generation endpoint offered as the `local`
# provider.
# MODEL_WORKER_URL=
# Seed credentials for the cloud providers; they start deny-all until a
# facilitator opens them in /admin/providers.
# OPENAI_API_KEY=
# OPENROUTER_API_KEY=
# KATALYST_API_KEY=
# xAPI LRS receiving run statements.
# XAPI_ENDPOINT=
# XAPI_USERNAME=
# XAPI_PASSWORD=
# --- LTI (docs/lti.md) --------------------------------------------------------

# LTI 1.3 platforms allowed to launch NodeGrade: a JSON array with one entry per
# platform registration. Moodle shows these values under Site administration >
# Plugins > External tool > Manage tools > "View configuration details"; Canvas
# shows the client id on the developer key and uses fixed Instructure endpoints.
# The admin registers https://${NODEGRADE_HOST}/lti/login (initiate login),
# /lti/launch (tool URL and redirect URI) and /lti/jwks (public keyset);
# GET https://${NODEGRADE_HOST}/lti/config lists them.
# LTI_PLATFORMS=[{"issuer":"https://moodle.example.org","clientId":"abc123","deploymentIds":["1"],"authorizationEndpoint":"https://moodle.example.org/mod/lti/auth.php","tokenEndpoint":"https://moodle.example.org/mod/lti/token.php","jwksUri":"https://moodle.example.org/mod/lti/certs.php","name":"Example Moodle"}]
# Optional RSA private key (PEM, newlines may be written as \n). /lti/jwks serves
# its public half; grade passback and roster reads will sign with it. Generate:
#   openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048
# LTI_TOOL_PRIVATE_KEY=
# Public base URL of the /lti routes, only when the request origin is not it.
# LTI_TOOL_URL=
# LTI 1.1 basic launch (deprecated by 1EdTech since 2021): the consumer key and
# secret an LMS signs POST /lti/basiclogin with. While either is unset the 1.1
# launch is refused with 503 lti_11_not_configured.
# LTI_CONSUMER_KEY=
# LTI_CONSUMER_SECRET=
# Local testing only: accept unsigned 1.1 launches. Whoever posts the form then
# picks the course, the role and the person, and every launch logs a warning.
# LTI_11_ALLOW_UNSIGNED=false
# Every other backend setting from .env_template (RETENTION_ENABLED,
# WORKSPACE_MAX_WORKFLOWS, ADMIN_SESSION_TTL_HOURS, ...) works the same way.

# --- Database -----------------------------------------------------------------

# POSTGRES_USER=nodegrade
# POSTGRES_DB=nodegrade

# --- NLP worker ---------------------------------------------------------------

# See README.md, "Choosing a different embedding model" before changing these.
# EMBEDDING_MODEL=BAAI/bge-m3
# EMBEDDING_MAX_SEQ_LENGTH=512
# EMBEDDING_TASK=
# EMBEDDING_TRUST_REMOTE_CODE=false
# NLI_MODEL=MoritzLaurer/mDeBERTa-v3-base-xnli-multilingual-nli-2mil7