ktms/env.example at main · ai-process/ktms · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
# Required
DATABASE_URL=postgres://ktms:ktms@localhost:5435/ktms?sslmode=disable
# Versioned AES-256-GCM keyring for vendor keys at rest: "1:<base64 32B>[,2:...]".
# Generate: echo "1:$(head -c 32 /dev/urandom | base64)"
KTMS_ENCRYPTION_KEYS=

# Servers
GRPC_ADDR=:9090
GRPC_MAX_RECV_MSG_SIZE=16777216
HTTP_ADDR=:8080
# OpenAI-compatible HTTP API (/v1/...) on HTTP_ADDR; false leaves only /healthz and /readyz.
HTTP_API_ENABLED=true
HTTP_API_TIMEOUT=5m
METRICS_ADDR=:9091
SHUTDOWN_TIMEOUT=30s
LOG_LEVEL=info

# Postgres pool bounds
DB_MAX_CONNS=25
DB_MIN_CONNS=5
# Bounds connecting to Postgres and each per-request query (key checks). A DSN connect_timeout wins.
DB_TIMEOUT=3s
# While Postgres is unreachable, keys verified within this window keep working. 0 refuses every call.
AUTH_STALE_IF_ERROR=5m

# How often replicas poll config_state for admin changes made elsewhere.
ROUTING_RELOAD_SECONDS=60

# Embedded migrations run at startup; off means applying them by hand.
AUTO_MIGRATE=true
MIGRATE_TIMEOUT=3m

# Auto-seeding for quickstart: populates initial models, rules, and dev keys when unconfigured.
AUTO_SEED=false
SEED_CLIENT_KEY=
SEED_CLIENT_NAME=dev-default
SEED_OPENAI_KEY=
OPENAI_API_KEY=
SEED_GEMINI_KEY=
GEMINI_API_KEY=
SEED_ANTHROPIC_KEY=
ANTHROPIC_API_KEY=

# Redis-backed RPM + daily token budgets. Empty REDIS_ADDR = limits NOT enforced.
REDIS_ADDR=
REDIS_PASSWORD=
REDIS_DB=0
REDIS_KEY_PREFIX=
# Per-command read/write timeout (dials get twice as long). With the fail-fast guard, about what a hung Redis adds to a request.
REDIS_TIMEOUT=500ms
BUDGET_GRACE_MARGIN=0.05
# Monetary spend limits (admin SetSpendLimit). open: a Redis outage lets calls
# through unmetered; closed: calls under a spend limit get 503 until it is back.
SPEND_LIMITS_FAIL_MODE=open
# Output tokens priced into the spend reservation when a call sets no max tokens.
SPEND_DEFAULT_OUTPUT_RESERVE_TOKENS=4096

# Circuit Breaker for upstream provider failure isolation (fail-fast without network IO).
CIRCUIT_BREAKER_ENABLED=true
CIRCUIT_BREAKER_FAIL_THRESHOLD=5
CIRCUIT_BREAKER_COOLDOWN=30s
# Dedicated per-attempt upstream timeout (e.g. 30s, 60s). 0 disables watchdog.
# For unary and media calls, sets total per-attempt deadline; for streaming, acts as a per-chunk idle watchdog.
UPSTREAM_REQUEST_TIMEOUT=0
# Longest pause honoured when a vendor answers 429/503 with Retry-After. 0 disables pauses.
VENDOR_COOLDOWN_MAX=5m

# Batch processing
BATCH_POLL_SECONDS=60
BATCH_MAX_ITEMS=10000
RESULTS_RETENTION_DAYS=7

# Local Node Pool
NODE_HEARTBEAT_INTERVAL_SECONDS=5
NODE_HEARTBEAT_TTL_SECONDS=15
NODE_RETENTION_TTL_DAYS=1
NODE_ALLOW_LOCALHOST_ENDPOINTS=false
# Hours each node's request log is kept for its agent to pull; 0 turns it off.
NODE_USAGE_RETENTION_HOURS=168

# Accepted as an implicit admin key to mint the first real key; unset after.
BOOTSTRAP_ADMIN_KEY=

# Usage reporting; empty host disables it.
USAGE_COLLECTOR_HOST=
# TLS to the sink, e.g. one on Cloud Run (host:443).
USAGE_COLLECTOR_TLS=false
# Bearer token for light-tokenmeter with the write scope; empty sends none.
USAGE_COLLECTOR_TOKEN=
USAGE_PROJECT_ID=ktms

# Sentry
SENTRY_DSN=
SENTRY_ENVIRONMENT=development
SENTRY_RELEASE=
SENTRY_ENABLE_TRACING=false
SENTRY_DEBUG=false
SENTRY_WITH_BREADCRUMBS=false

# OpenTelemetry
OTEL_SERVICE_NAME=ktms
OTEL_EXPORTER_OTLP_ENDPOINT=

# Exact Match Cache
CACHE_ENABLED=false
CACHE_TTL=1h
CACHE_MAX_BYTES=1048576

# Guardrails & Security
GUARDRAILS_ENABLED=false
GUARDRAILS_PII_ACTION=block
GUARDRAILS_PROMPT_INJECTION_ACTION=block
# Latent guardrails: cosine similarity to known injection/jailbreak/exfiltration
# centroids. Action block|log; the JSON categories file adds to the built-ins.
GUARDRAILS_LATENT_ENABLED=false
GUARDRAILS_LATENT_THRESHOLD=0.70
GUARDRAILS_LATENT_ACTION=block
GUARDRAILS_LATENT_CATEGORIES_FILE=

# Semantic cache (needs Redis; shares CACHE_TTL / CACHE_MAX_BYTES). Requests opt
# in with enable_cache, as for the exact cache.
SEMANTIC_CACHE_ENABLED=false
SEMANTIC_CACHE_SIMILARITY_THRESHOLD=0.95
SEMANTIC_CACHE_MAX_ENTRIES=256

# Latent encoder for the two above: an OpenAI-compatible /v1/embeddings URL
# (e.g. a JEPA node). Empty or failing falls back to the local hash encoder.
LATENT_ENCODER_URL=
LATENT_ENCODER_MODEL=jepa-text
LATENT_ENCODER_API_KEY=
LATENT_ENCODER_TIMEOUT=50ms
LATENT_LOCAL_ENCODER_DIMS=512
LATENT_ENCODER_CACHE_SIZE=4096