# DocAI Fabric — Self-Hosted Standalone (Single Node) settings file
# Companion file for the guide: https://app.docaifabric.com/docs/deployment/self-hosted-standalone
# Save this file as .env next to your docker-compose.yml, then fill in the values.

# Application image. :latest is the most recent release and is simplest for a
# demo. For a long-lived or production install, pin the exact version tag we
# give you at onboarding (e.g. ...:2026.06.25-2) so you can roll back to a known
# version. Check what you are running any time with GET /api/version.
DOCAI_IMAGE=ghcr.io/docaifabric/docaifabric:latest

# Deployment topology. The Compose file already sets this to self_hosted_onprem
# for you, so you normally leave this line commented out. Only uncomment to
# override, and only ever to self_hosted_onprem for a docker-compose install.
# DEPLOYMENT_MODE=self_hosted_onprem

# Admin key for management operations. Generate a random value:
#   openssl rand -hex 32
ADMIN_API_KEY=

# Encrypts the secrets you save in the app or with the CLI: language model
# API keys, the client secret of a single sign-on connection, the SMTP
# password, and the credentials of import connectors. Without it, saving them
# is refused.
# Generate ONCE. Never just replace it: to change it, follow "Rotating the
# encryption key" in the guide (see warning below):
#   openssl rand -base64 32 | tr '+/' '-_'
CREDENTIAL_ENCRYPTION_KEY=

# Only while rotating CREDENTIAL_ENCRYPTION_KEY: the key it replaced (several,
# comma-separated). It only decrypts. Empty the rest of the time.
CREDENTIAL_ENCRYPTION_KEY_PREVIOUS=

# Older installations only. If this already has a value, keep it: model API
# keys saved so far are encrypted with it. Once CREDENTIAL_ENCRYPTION_KEY is set
# too, they move under that key at the next start; empty this only when
# "da admin credentials status" shows nothing left to re-encrypt. A new
# installation leaves it empty.
TENANT_MODELS_ENCRYPTION_KEY=

# Address used for the links inside invitation, password-reset and
# notification emails. It does not change where the app listens, which is
# always port 8080 (see the "ports:" line in docker-compose.yml). Set it to
# the address your users type in the browser, including the port.
APP_URL=http://localhost:8080

# OCR engines (run locally, no cloud). Keep at least one enabled.
RAPID_OCR_ENABLED=true
TESSERACT_OCR_ENABLED=true
# Optional: Microsoft Read (Azure Document Intelligence). Calls Azure, so the
# container needs outbound HTTPS to the endpoint below. Leave disabled to stay
# fully local. To use it, set all three:
# MICROSOFT_OCR_ENABLED=true
# MICROSOFT_OCR_ENDPOINT=https://<your-resource>.cognitiveservices.azure.com/
# MICROSOFT_OCR_KEY=<your-key>
# Default engine for new projects (must be one you enabled above).
DEFAULT_OCR_ENGINE=rapid_ocr

# Default LLM — any OpenAI-compatible endpoint (Ollama, vLLM, a cloud key, ...).
# IMPORTANT: this URL must be reachable from INSIDE the container. A bare name
# like http://ollama:11434 only works if "ollama" is a service in THIS Compose
# file (it is not, by default). See "Default LLM" below for the right address.
# Example below: Ollama running on the same machine, reached via host.docker.internal.
LLM_BASE_URL=http://host.docker.internal:11434
LLM_MODEL=gemma4
LLM_API_KEY=              # leave blank for Ollama; set the key for cloud providers

# AI Assistant (optional). It uses the Default LLM above unless you set a
# different model here. Set ASSISTANT_ENABLED=false to turn the assistant off.
# ASSISTANT_MODEL=
# ASSISTANT_ENABLED=true

# Voice input for the AI Assistant (optional, off by default). It uses Azure
# AI Speech, so the container needs outbound HTTPS to your Azure resource and
# recordings leave this host. To use it, set the first three:
# AUDIO_TRANSCRIPTION_ENABLED=true
# AUDIO_TRANSCRIPTION_ENDPOINT=https://<your-resource>.cognitiveservices.azure.com
# AUDIO_TRANSCRIPTION_API_KEY=<your-key>
# Languages to recognise, comma-separated, at most 10 (default en-US).
# AUDIO_TRANSCRIPTION_LOCALES=en-US

# Email notifications (optional). Set SMTP_HOST to enable invitation and
# notification emails; leave it unset to keep email off. See "Enable email
# notifications" in this guide for examples and details.
# SMTP_HOST=
# SMTP_PORT=587
# SMTP_USER=
# SMTP_PASSWORD=
# SMTP_FROM=
# Sender name shown in mail clients (default: DocAI Fabric). Set your own
# brand here, or empty to send just the address.
# SMTP_FROM_NAME=
# SMTP_USE_TLS=true
# Socket timeout in seconds (default 15). In locked-down / internal networks
# where outbound SMTP is blocked, this bounds the failure instead of hanging.
# SMTP_TIMEOUT=15

# Additional interface languages. Leave unset unless we have given you a value
# for your install.
# UI_OPTIONAL_LANGUAGES=

# Model endpoints, IMAP hosts, single sign-on identity providers and business
# rule HTTP calls may be on your own network (private addresses); loopback and
# link-local never.
# Set to false to allow only public internet addresses.
# EGRESS_ALLOW_PRIVATE_HOSTS=true

# Apple Silicon Macs only. This runs business rules and SLA scripts without
# their sandbox, so set it only when everyone who writes rules or SLA scripts
# may be trusted with the server itself.
# RULE_EXECUTOR_USE_VM=true