mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-10-26 13:16:24 +00:00
231335d309
* fix(deploy): honor BETTER_AUTH_SECRET and DEER_FLOW_INTERNAL_AUTH_TOKEN from .env deploy.sh only checked the shell before reloading a persisted secret or generating a fresh one and exporting it. Compose interpolation lets shell variables outrank --env-file, so a secret written to the repo-root .env -- the surface every deployment doc points at -- was silently replaced by the generated one: sessions were signed with a secret the operator never chose and Gateway workers outside the stack got 401 with the configured token. Leave a .env-provided secret unexported so Compose parses it itself (shell -> .env -> persisted file -> generated), and keep generating when the shell exports an empty value, since Compose would otherwise pass the empty string through. * docs(changelog): reference #5928 in the deploy.sh dotenv secrets entries * fix(deploy): decide whether .env provides a secret with Compose's own parser read_dotenv_value only matches KEY=VALUE and returns the literal text, but Compose also accepts `KEY: VALUE` lines and interpolates `${VAR}` inside values. So `TOKEN: abc` looked absent (and got shadowed by a generated token) while `TOKEN=${UNSET}` looked present (and suppressed generation, leaving the stack with an empty token). Ask Compose for its resolved interpolation environment instead (`docker compose config --environment`, same --env-file, stub project on stdin, project directory docker/) and treat a resolved-empty value as missing. Clients older than Compose 2.28 lack the flag and fall back to the plain reader. Tests cover the canned Compose answers, the fallback, and every dotenv spelling against the real Compose client when installed. * fix(deploy): resolve .env secrets through Compose on every supported client `config --environment` needs Compose 2.28, so 2.24–2.27 clients took the plain KEY=VALUE fallback and kept both defects: `TOKEN: abc` was missed and shadowed, `TOKEN=${UNSET}` counted as present and left the stack with an empty token. Drop the fallback. Render a stub project whose only environment entry is `${KEY}` through `docker compose config` — same --env-file and project directory as the real command — and read the interpolated value back; `""` means empty or unset. This is plain interpolation, available on every Compose v2, and verified identical on 2.24.0, 2.27.0 and 2.32. A failing probe stops the script instead of guessing. The real-Compose tests now run against the docker CLI and any standalone binaries listed in DEER_FLOW_TEST_COMPOSE_BINARIES.
116 lines
5.4 KiB
Plaintext
116 lines
5.4 KiB
Plaintext
# Serper API Key (Google Search) - https://serper.dev
|
|
SERPER_API_KEY=your-serper-api-key
|
|
|
|
# Serply API Key (Google Search, News and Scholar) - https://serply.io
|
|
SERPLY_API_KEY=your-serply-api-key
|
|
|
|
# TAVILY API Key
|
|
TAVILY_API_KEY=your-tavily-api-key
|
|
|
|
# Jina API Key
|
|
JINA_API_KEY=your-jina-api-key
|
|
|
|
# InfoQuest API Key
|
|
INFOQUEST_API_KEY=your-infoquest-api-key
|
|
|
|
# Sofya API Key (web search and fetch) - https://sofya.co
|
|
SOFYA_API_KEY=your-sofya-api-key
|
|
|
|
# Browser CORS allowlist for split-origin or port-forwarded deployments (comma-separated exact origins).
|
|
# Leave unset when using the unified nginx endpoint, e.g. http://localhost:2026.
|
|
# GATEWAY_CORS_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
|
|
|
|
# Host interface the Docker stack publishes its entry port on. Defaults to
|
|
# 127.0.0.1 (loopback only), matching the local-trusted-environment deployment
|
|
# model documented in README.md -- the agent can execute commands.
|
|
# Set 0.0.0.0 only when the host is protected by your own TLS/auth front door
|
|
# or firewall, and complete first-run setup before it becomes reachable.
|
|
# BIND_HOST=0.0.0.0
|
|
# PORT=2026
|
|
|
|
# Optional:
|
|
# FIRECRAWL_API_KEY=your-firecrawl-api-key
|
|
# VOLCENGINE_API_KEY=your-volcengine-api-key
|
|
# OPENAI_API_KEY=your-openai-api-key
|
|
# OPENVIKING_API_KEY=your-openviking-user-api-key
|
|
# GEMINI_API_KEY=your-gemini-api-key
|
|
# DEEPSEEK_API_KEY=your-deepseek-api-key
|
|
# NOVITA_API_KEY=your-novita-api-key # OpenAI-compatible, see https://novita.ai
|
|
# MINIMAX_API_KEY=your-minimax-api-key # OpenAI-compatible, see https://platform.minimax.io
|
|
# OpenAI-compatible Images API (used by the image-generation skill)
|
|
# IMAGE_GENERATION_PROVIDER=openai # openai-compatible is also accepted
|
|
# IMAGE_GENERATION_API_KEY=your-image-generation-api-key
|
|
# IMAGE_GENERATION_BASE_URL=https://api.openai.com/v1
|
|
# IMAGE_GENERATION_MODEL=gpt-image-2.5-flare
|
|
# IMAGE_GENERATION_SIZE=1536x1024
|
|
# STEPFUN_API_KEY=your-stepfun-api-key # OpenAI-compatible, see https://platform.stepfun.com
|
|
# VLLM_API_KEY=your-vllm-api-key # OpenAI-compatible
|
|
|
|
# E2B cloud sandbox API key — required only when using E2BSandboxProvider.
|
|
# Sign up at https://e2b.dev/dashboard
|
|
# E2B_API_KEY=your-e2b-api-key
|
|
# FEISHU_APP_ID=your-feishu-app-id
|
|
# FEISHU_APP_SECRET=your-feishu-app-secret
|
|
|
|
# SLACK_BOT_TOKEN=your-slack-bot-token
|
|
# SLACK_APP_TOKEN=your-slack-app-token
|
|
# TELEGRAM_BOT_TOKEN=your-telegram-bot-token
|
|
# DISCORD_BOT_TOKEN=your-discord-bot-token
|
|
|
|
# Enable LangSmith to monitor and debug your LLM calls, agent runs, and tool executions.
|
|
# LANGSMITH_TRACING=true
|
|
# LANGSMITH_ENDPOINT=https://api.smith.langchain.com
|
|
# LANGSMITH_API_KEY=your-langsmith-api-key
|
|
# LANGSMITH_PROJECT=your-langsmith-project
|
|
|
|
# GitHub API Token
|
|
# GITHUB_TOKEN=your-github-token
|
|
|
|
# Database (only needed when config.yaml has database.backend: postgres)
|
|
# DATABASE_URL=postgresql://deerflow:password@localhost:5432/deerflow
|
|
#
|
|
# WECOM_BOT_ID=your-wecom-bot-id
|
|
# WECOM_BOT_SECRET=your-wecom-bot-secret
|
|
# DINGTALK_CLIENT_ID=your-dingtalk-client-id
|
|
# DINGTALK_CLIENT_SECRET=your-dingtalk-client-secret
|
|
|
|
# Set to "false" to disable Swagger UI, ReDoc, and OpenAPI schema in production
|
|
# GATEWAY_ENABLE_DOCS=false
|
|
|
|
# Shared internal Gateway auth token for multi-worker deployments.
|
|
# `make up` honors a value set here (as it does for BETTER_AUTH_SECRET) and
|
|
# otherwise generates one and persists it under DEER_FLOW_HOME; set it
|
|
# manually when Gateway workers also run outside the bundled deploy script.
|
|
# DEER_FLOW_INTERNAL_AUTH_TOKEN=your-shared-internal-token
|
|
|
|
# Provisioner API key for sandbox authentication (required when using provisioner/K8s sandbox mode).
|
|
# The same value must be set on the provisioner container and in config.yaml sandbox.provisioner_api_key.
|
|
# Generate: openssl rand -hex 32
|
|
# PROVISIONER_API_KEY=your-provisioner-api-key
|
|
|
|
# ── Frontend SSR → Gateway wiring ─────────────────────────────────────────────
|
|
# The Next.js server uses these to reach the Gateway during SSR (auth checks,
|
|
# /api/* rewrites). They default to localhost values that match `make dev` and
|
|
# `make start`, so most local users do not need to set them.
|
|
#
|
|
# Override only when the Gateway is not on localhost:8001 (e.g. when the
|
|
# frontend and gateway run on different hosts, in containers with a service
|
|
# alias, or behind a different port). docker-compose already sets these.
|
|
# DEER_FLOW_INTERNAL_GATEWAY_BASE_URL=http://localhost:8001
|
|
# DEER_FLOW_TRUSTED_ORIGINS=http://localhost:3000,http://localhost:2026
|
|
|
|
# ── Claude Code / Codex CLI subscription as a model provider (optional) ───────
|
|
# If you configure a ClaudeChatModel / Codex model provider (or an ACP agent)
|
|
# that reuses your CLI subscription login, prefer passing a token via env over
|
|
# bind-mounting your whole ~/.claude / ~/.codex into the container. The Gateway
|
|
# credential loader reads these first, so no directory mount is needed.
|
|
# CLAUDE_CODE_CREDENTIALS_PATH points at a single .credentials.json (Claude)
|
|
# rather than the whole dir. docker-compose.cli-auth.yaml is the opt-in
|
|
# directory-mount fallback for adapters that need the full CLI config.
|
|
# ACP adapters often take their own env API key (e.g. ANTHROPIC_API_KEY) and
|
|
# need no mount at all — check the adapter's docs. See SECURITY.md.
|
|
# CLAUDE_CODE_OAUTH_TOKEN=your-claude-code-oauth-token
|
|
# ANTHROPIC_AUTH_TOKEN=your-anthropic-auth-token
|
|
# CLAUDE_CODE_CREDENTIALS_PATH=/path/to/.claude/.credentials.json
|
|
# CODEX_AUTH_PATH=/path/to/codex/auth.json
|