mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-10-26 21:26:39 +00:00
db7340d2fa
* fix(security): add DEER_FLOW_CREDENTIALS_KEY for at-rest credential encryption
There was no at-rest encryption key. ChannelCredentialCipher had no
production caller: the channel service, the scheduled-task notification
outbox and the channel-connections router all built
ChannelConnectionRepository without a cipher, so store_credentials refused
(RuntimeError) and get_credentials always returned None.
- New harness module deerflow.config.credentials_key: env-only
DEER_FLOW_CREDENTIALS_KEY (comma-separated Fernet keys; first encrypts,
all decrypt via MultiFernet), CredentialsCipher with encrypt_text /
decrypt_text / rotate_text, a fernet:v2: prefix with legacy fernet:v1:
values still readable, and get_credentials_cipher() as the process-wide
entry point. Malformed keys are refused without echoing key material.
Without the variable a single instance generates
{base_dir}/.credentials_key. Never derived from AUTH_JWT_SECRET.
- New deerflow.config.secret_file.read_or_create_secret_file: O_EXCL
create (0600) plus read-back with a bounded settle window, shared by
.credentials_key, .jwt_secret (fixes two replicas cold-starting on a
shared volume keeping different JWT secrets) and the managed-model key.
- ChannelCredentialCipher now builds on CredentialsCipher (same
constructors); the Gateway loads the cipher off the event loop at
startup when channel_connections is enabled and passes it to every
ChannelConnectionRepository. Undecryptable values stay "missing + warn".
- Startup gate: a malformed key stops startup in any topology; a declared
multi-instance deployment with channel_connections enabled and no key
is refused. Plain multi-worker shares the generated file and is allowed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(deploy): generate and inject DEER_FLOW_CREDENTIALS_KEY in Helm, compose and deploy.sh
- Helm: the app Secret generates a Fernet key (randBytes 32 translated to
the urlsafe alphabet) and preserves it across upgrades via lookup like
AUTH_JWT_SECRET; the gateway reads it through an optional secretKeyRef
so a user-managed existingAppSecret without it still boots (the Gateway
gate refuses only multi-instance deployments that store credentials).
README, NOTES and values document backup, rotation and existingAppSecret.
- scripts/deploy.sh resolves the key shell -> .env -> persisted file ->
generated, persisting it as $DEER_FLOW_HOME/.credentials_key (0600,
noclobber/O_EXCL with read-back): the same file the Gateway generates in
its runtime home, so either side's key is the one both keep.
- Both compose files pass DEER_FLOW_CREDENTIALS_KEY=${...:-} to the gateway.
- .env.example entry with a generation hint; README and CHANGELOG notes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(security): make abandoned secret-file replacement single-winner
A rename is last-writer-wins, so replicas that restart together and all
find the same abandoned empty secret file could each replace it and keep
a different value. The process that exclusively creates
<name>.replacing now owns the replacement, re-checks the file is still
empty, and publishes by renaming the claim over it; peers wait for that
value, bounded so a crashed replacer cannot block startup forever.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(changelog): link DEER_FLOW_CREDENTIALS_KEY entries to #6611
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(security): name the setting that turns off a credentials-key consumer
The multi-instance refusal ended with "or disable
channel_connections.enabled=true"; it now says "or set
channel_connections.enabled=false".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(security): never expose a secret file before its value is written
O_EXCL published the name before its content, so a creator that stalled
mid-write left an empty file a peer replaced after the settle window; the
resumed creator then returned a value nobody persisted, or deleted the
peer's valid file when its own write failed. Creators now write and sync
a private temporary file and hard-link it to the name, which fails if
the name exists; a failed creator only removes its own temporary file.
Filesystems without hard links publish through the same single-winner
<name>.replacing claim that replaces abandoned empty files, so creation
and replacement are serialized there.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(models): recover an empty managed-model key when no catalog exists
An interrupted first save could leave an empty key file; every later save
then passed empty bytes to Fernet and the endpoint returned 503 until the
file was removed by hand. An empty key with no catalog encrypted nothing,
so it now goes through the secret-file recovery path; next to an existing
catalog it is still refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(docker): pass the dotenv DEER_FLOW_CREDENTIALS_KEY through make docker-start
scripts/docker.sh runs Compose from docker/ without --env-file, so the dev
gateway's DEER_FLOW_CREDENTIALS_KEY=${DEER_FLOW_CREDENTIALS_KEY:-} entry
interpolated to empty and overrode the key the checkout .env supplied via
env_file. Export it from the dotenv like AUTH_TRUSTED_PROXIES.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
148 lines
7.2 KiB
Plaintext
148 lines
7.2 KiB
Plaintext
# Serper API Key (Google Search) - https://serper.dev
|
|
SERPER_API_KEY=your-serper-api-key
|
|
|
|
# Optional operator-controlled Serper-compatible API base URL, without /search or /images.
|
|
# The configured API key is sent in X-API-KEY to this host; use a trusted provider.
|
|
SERPER_BASE_URL=https://google.serper.dev
|
|
|
|
# Serply API Key (Google Search, News and Scholar) - https://serply.io
|
|
SERPLY_API_KEY=your-serply-api-key
|
|
|
|
# TAVILY API Key
|
|
TAVILY_API_KEY=your-tavily-api-key
|
|
|
|
# Optional Webz.io News Search key (select Webz in make setup)
|
|
# WEBZ_API_KEY=your-webz-api-key
|
|
|
|
# Jina API Key
|
|
JINA_API_KEY=your-jina-api-key
|
|
|
|
# InfoQuest API Key
|
|
INFOQUEST_API_KEY=your-infoquest-api-key
|
|
|
|
# Sofya API Key (web search and fetch) - https://sofya.co
|
|
SOFYA_API_KEY=your-sofya-api-key
|
|
|
|
# Unbrowse API Key (web fetch) - https://unbrowse.ai/app
|
|
UNBROWSE_API_KEY=your-unbrowse-api-key
|
|
|
|
# Browser CORS allowlist for split-origin or port-forwarded deployments (comma-separated exact origins).
|
|
# Leave unset when using the unified nginx endpoint, e.g. http://localhost:2026.
|
|
# GATEWAY_CORS_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
|
|
|
|
# Host interface the nginx entry port listens on, for the Docker stack and for
|
|
# local `make dev` / `make start` (where the Gateway and frontend always stay on
|
|
# loopback). Defaults to 127.0.0.1 (loopback only), matching the
|
|
# local-trusted-environment deployment model documented in README.md -- the
|
|
# agent can execute commands.
|
|
# Set 0.0.0.0 only when the host is protected by your own TLS/auth front door
|
|
# or firewall, and complete first-run setup before it becomes reachable.
|
|
# BIND_HOST=0.0.0.0
|
|
# PORT=2026
|
|
|
|
# Proxies whose X-Real-IP the Gateway trusts when it counts failed logins per
|
|
# client (comma-separated IPs, CIDRs or hostnames; a hostname is re-resolved
|
|
# every 10s). The Docker stack defaults to its bundled `nginx` service; without
|
|
# it every browser login shares nginx's address, so five wrong passwords from
|
|
# anyone lock everyone out. Behind your own front door, nginx sees that proxy's
|
|
# address instead: configure nginx's real_ip module for it as well.
|
|
# Outside Docker, unset or empty is direct mode: X-Real-IP is ignored. In the
|
|
# Docker stack an empty value also falls back to `nginx`, since every browser
|
|
# request arrives through it.
|
|
# AUTH_TRUSTED_PROXIES=nginx
|
|
|
|
# Optional:
|
|
# FIRECRAWL_API_KEY=your-firecrawl-api-key
|
|
# VOLCENGINE_API_KEY=your-volcengine-api-key
|
|
# OPENAI_API_KEY=your-openai-api-key
|
|
# OPENVIKING_API_KEY=your-openviking-user-api-key
|
|
# GEMINI_API_KEY=your-gemini-api-key
|
|
# DEEPSEEK_API_KEY=your-deepseek-api-key
|
|
# NOVITA_API_KEY=your-novita-api-key # OpenAI-compatible, see https://novita.ai
|
|
# MINIMAX_API_KEY=your-minimax-api-key # OpenAI-compatible, see https://platform.minimax.io
|
|
# OPPER_API_KEY=your-opper-api-key # OpenAI-compatible, see https://opper.ai
|
|
# OpenAI-compatible Images API (used by the image-generation skill)
|
|
# IMAGE_GENERATION_PROVIDER=openai # openai-compatible is also accepted
|
|
# IMAGE_GENERATION_API_KEY=your-image-generation-api-key
|
|
# IMAGE_GENERATION_BASE_URL=https://api.openai.com/v1
|
|
# IMAGE_GENERATION_MODEL=gpt-image-2.5-flare
|
|
# IMAGE_GENERATION_SIZE=1536x1024
|
|
# STEPFUN_API_KEY=your-stepfun-api-key # OpenAI-compatible, see https://platform.stepfun.com
|
|
# VLLM_API_KEY=your-vllm-api-key # OpenAI-compatible
|
|
|
|
# E2B cloud sandbox API key — required only when using E2BSandboxProvider.
|
|
# Sign up at https://e2b.dev/dashboard
|
|
# E2B_API_KEY=your-e2b-api-key
|
|
# FEISHU_APP_ID=your-feishu-app-id
|
|
# FEISHU_APP_SECRET=your-feishu-app-secret
|
|
|
|
# SLACK_BOT_TOKEN=your-slack-bot-token
|
|
# SLACK_APP_TOKEN=your-slack-app-token
|
|
# TELEGRAM_BOT_TOKEN=your-telegram-bot-token
|
|
# DISCORD_BOT_TOKEN=your-discord-bot-token
|
|
|
|
# Enable LangSmith to monitor and debug your LLM calls, agent runs, and tool executions.
|
|
# LANGSMITH_TRACING=true
|
|
# LANGSMITH_ENDPOINT=https://api.smith.langchain.com
|
|
# LANGSMITH_API_KEY=your-langsmith-api-key
|
|
# LANGSMITH_PROJECT=your-langsmith-project
|
|
|
|
# GitHub API Token
|
|
# GITHUB_TOKEN=your-github-token
|
|
|
|
# Database (only needed when config.yaml has database.backend: postgres)
|
|
# DATABASE_URL=postgresql://deerflow:password@localhost:5432/deerflow
|
|
#
|
|
# WECOM_BOT_ID=your-wecom-bot-id
|
|
# WECOM_BOT_SECRET=your-wecom-bot-secret
|
|
# DINGTALK_CLIENT_ID=your-dingtalk-client-id
|
|
# DINGTALK_CLIENT_SECRET=your-dingtalk-client-secret
|
|
|
|
# Set to "false" to disable Swagger UI, ReDoc, and OpenAPI schema in production
|
|
# GATEWAY_ENABLE_DOCS=false
|
|
|
|
# Shared internal Gateway auth token for multi-worker deployments.
|
|
# `make up` honors a value set here (as it does for BETTER_AUTH_SECRET) and
|
|
# otherwise generates one and persists it under DEER_FLOW_HOME; set it
|
|
# manually when Gateway workers also run outside the bundled deploy script.
|
|
# DEER_FLOW_INTERNAL_AUTH_TOKEN=your-shared-internal-token
|
|
|
|
# At-rest encryption key for stored credentials (a Fernet key). Comma-separate
|
|
# several to rotate: the first encrypts, all decrypt. Unset, a single instance
|
|
# generates DEER_FLOW_HOME/.credentials_key (`make up` persists the same file);
|
|
# instances that do not share DEER_FLOW_HOME must all set the same value.
|
|
# Back it up: losing it makes stored credentials unreadable. Generate:
|
|
# python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
# DEER_FLOW_CREDENTIALS_KEY=your-fernet-key
|
|
|
|
# Provisioner API key for sandbox authentication (required when using provisioner/K8s sandbox mode).
|
|
# The same value must be set on the provisioner container and in config.yaml sandbox.provisioner_api_key.
|
|
# Generate: openssl rand -hex 32
|
|
# PROVISIONER_API_KEY=your-provisioner-api-key
|
|
|
|
# ── Frontend SSR → Gateway wiring ─────────────────────────────────────────────
|
|
# The Next.js server uses these to reach the Gateway during SSR (auth checks,
|
|
# /api/* rewrites). They default to localhost values that match `make dev` and
|
|
# `make start`, so most local users do not need to set them.
|
|
#
|
|
# Override only when the Gateway is not on localhost:8001 (e.g. when the
|
|
# frontend and gateway run on different hosts, in containers with a service
|
|
# alias, or behind a different port). docker-compose already sets these.
|
|
# DEER_FLOW_INTERNAL_GATEWAY_BASE_URL=http://localhost:8001
|
|
# DEER_FLOW_TRUSTED_ORIGINS=http://localhost:3000,http://localhost:2026
|
|
|
|
# ── Claude Code / Codex CLI subscription as a model provider (optional) ───────
|
|
# If you configure a ClaudeChatModel / Codex model provider (or an ACP agent)
|
|
# that reuses your CLI subscription login, prefer passing a token via env over
|
|
# bind-mounting your whole ~/.claude / ~/.codex into the container. The Gateway
|
|
# credential loader reads these first, so no directory mount is needed.
|
|
# CLAUDE_CODE_CREDENTIALS_PATH points at a single .credentials.json (Claude)
|
|
# rather than the whole dir. docker-compose.cli-auth.yaml is the opt-in
|
|
# directory-mount fallback for adapters that need the full CLI config.
|
|
# ACP adapters often take their own env API key (e.g. ANTHROPIC_API_KEY) and
|
|
# need no mount at all — check the adapter's docs. See SECURITY.md.
|
|
# CLAUDE_CODE_OAUTH_TOKEN=your-claude-code-oauth-token
|
|
# ANTHROPIC_AUTH_TOKEN=your-anthropic-auth-token
|
|
# CLAUDE_CODE_CREDENTIALS_PATH=/path/to/.claude/.credentials.json
|
|
# CODEX_AUTH_PATH=/path/to/codex/auth.json
|