ea0c00d68e
The container was never getting its configuration, so it started with nothing set and Traefik reported a Bad Gateway on every route. Dokploy writes its own .env into the build context from the service's Environment tab AFTER cloning the repository. That tab is empty, so it wrote a zero-byte file over the committed one, and `COPY .env .` faithfully copied the empty result into the image. The checkout showed it exactly: every file timestamped 08:33, and .env alone at 08:34 with a size of 0. Inside the running container, /app/.env was 0 bytes. Nothing about this is visible from the outside. The build log shows the COPY succeeding, the image is produced, and the platform reports only a 502. Dokploy does not manage .env.production, so the config now travels under that name and the Dockerfile copies it to /app/.env in the image. Anything set in the Environment tab still wins at runtime, because settings.py calls load_dotenv() without override=True. Verified by reconstructing the build context the way Dokploy does - git archive of HEAD, then an empty .env written over it - applying .dockerignore and the COPY lines, and booting the result with an empty environment: /app/.env is 4938 bytes, the sign-in passwords are absent, and scripts/check_deploy.sh reports 6 passed, 0 failed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
114 lines
4.8 KiB
Plaintext
114 lines
4.8 KiB
Plaintext
# Deployment configuration for mcp.nearle.ai.in.
|
|
#
|
|
# Committed at the repo owner's instruction so the deploy does not depend on
|
|
# re-entering config in the Dokploy UI. Everything needed to boot is here; no
|
|
# environment variables are required in Dokploy any more.
|
|
#
|
|
# A real environment variable still overrides anything set here - settings.py
|
|
# calls load_dotenv() without override=True, so the process environment wins.
|
|
# That is the escape hatch for changing a value without a commit.
|
|
#
|
|
# WHAT IS IN THIS FILE: live database, S3 and Google credentials, and the key
|
|
# that signs every access token. Anyone with read access to this repository has
|
|
# all of it, and git history keeps it after any rotation.
|
|
|
|
# --- Ports -----------------------------------------------------------------
|
|
# Dokploy routes the domain to 3000; 8000 is kept for the vite dev proxy and
|
|
# docker-compose. serve.py binds both.
|
|
PORTS=3000,8000
|
|
|
|
# --- CORS ------------------------------------------------------------------
|
|
# The FRONTEND's origin, not this API's. Wrong value = the browser blocks every
|
|
# response while the server logs healthy 200s.
|
|
API_CORS_ORIGINS=https://catalogue.nearle.ai.in
|
|
|
|
# --- Authentication --------------------------------------------------------
|
|
AUTH_ENABLED=true
|
|
|
|
# Freshly generated for this deployment - deliberately NOT the values from the
|
|
# development .env. Those hashes are for the passwords DevAdmin!2026 and
|
|
# DevUser!2026, which are sitting in plaintext in test_login_fix.py in this very
|
|
# repository: shipping them would publish working admin credentials.
|
|
# Sign-in passwords for the hashes below are in SIGNIN_PASSWORDS.txt (ignored).
|
|
AUTH_SECRET_KEY=4Kmyr4Cjf_kdUIq_4EGxo5vFHfCT5_uKVR3eouszB8Le6F0n45m7eDY94_KJoqSz
|
|
AUTH_ADMIN_USERNAME=admin
|
|
AUTH_ADMIN_PASSWORD_HASH=pbkdf2_sha256$600000$Xa07unPO4LeTU4bz04eh7Q==$KmZ2ZBrclJ0z0sDiCoKOrfTO2UK8e7hjsZZ6HB2PY9o=
|
|
AUTH_USER_USERNAME=user
|
|
AUTH_USER_PASSWORD_HASH=pbkdf2_sha256$600000$65VMpqwUSyFzCqnhlwBqgQ==$sMVnar+Hnp5ZmXcObFNI3jJMxqnVrW8naLZNFFh0KCw=
|
|
|
|
AUTH_TOKEN_TTL_MINUTES=720
|
|
AUTH_MAX_LOGIN_ATTEMPTS=10
|
|
AUTH_LOCKOUT_SECONDS=300
|
|
|
|
# MUST stay false here. The development .env has this true, where it is a
|
|
# convenience: it skips the password check entirely, so any username signs in
|
|
# and `admin` gets the admin pages. On a host published to the internet it means
|
|
# anyone who finds mcp.nearle.ai.in signs in as admin by typing anything at all.
|
|
AUTH_ALLOW_ANY_LOGIN=false
|
|
|
|
# Machine consumers. Empty: MCP clients authenticate with a login token instead.
|
|
API_KEYS=
|
|
|
|
# --- Postgres / pgvector ---------------------------------------------------
|
|
# DB_NAME is not set in the development .env, so it falls back to settings.py's
|
|
# default. Stated explicitly here so the deployment does not depend on that
|
|
# default staying the same.
|
|
USE_PGVECTOR=true
|
|
DB_HOST=31.97.228.132
|
|
DB_PORT=6054
|
|
DB_NAME=pgvector
|
|
DB_USER=admin
|
|
DB_PASSWORD=Package@321#
|
|
|
|
# --- Embeddings ------------------------------------------------------------
|
|
USE_EMBEDDINGS=true
|
|
EMBEDDINGS_MODEL=sentence-transformers/all-MiniLM-L6-v2
|
|
EMBEDDINGS_DIM=384
|
|
|
|
# --- Ollama (local LLM, powers /api/chat) ----------------------------------
|
|
# Off, because the development value (http://localhost:11434) cannot work from
|
|
# inside a container: there, localhost is the container itself, not the VPS
|
|
# host. Left on with nothing listening, /api/chat fails AND every healthcheck
|
|
# takes ~3s longer, because the health handler probes Ollama with a 3s timeout.
|
|
#
|
|
# To enable: set USE_OLLAMA=true and point OLLAMA_BASE_URL at something the
|
|
# container can actually reach - http://host.docker.internal:11434 with a
|
|
# host-gateway mapping, the VPS's LAN IP, or an ollama service name.
|
|
USE_OLLAMA=false
|
|
OLLAMA_BASE_URL=http://host.docker.internal:11434
|
|
OLLAMA_MODEL_NAME=qwen2.5:1.5b
|
|
OLLAMA_TIMEOUT_SECONDS=120
|
|
|
|
# --- DigitalOcean Spaces (product image storage) ---------------------------
|
|
USE_S3=true
|
|
S3_ACCESS_KEY=DO801G8Q8JAZKF49U3WJ
|
|
S3_SECRET_KEY=lBQExYfkVqH+ybmGVmQH5MkThBbrIohA/VQLgcPUvug
|
|
S3_ENDPOINT=https://nearle.sgp1.digitaloceanspaces.com
|
|
S3_BUCKET=nearle
|
|
S3_REGION=sgp1
|
|
|
|
# --- Google Custom Search (optional image source) --------------------------
|
|
USE_GOOGLE_CSE=true
|
|
GOOGLE_API_KEY=AIzaSyBY4pIO_Fp5FCMqeVxDNcfalzdWNHJWVn0
|
|
GOOGLE_CSE_ID=9745cbd96dd164562
|
|
|
|
# --- Open-source image sources (no key needed) -----------------------------
|
|
USE_DDG_IMAGES=true
|
|
USE_OPEN_FACTS=true
|
|
USE_WIKIMEDIA=true
|
|
# The Playwright browser binary is NOT installed in the image (see Dockerfile),
|
|
# so this tier is skipped at runtime regardless. false stops it being attempted.
|
|
USE_PLAYWRIGHT_FALLBACK=false
|
|
|
|
MIN_IMAGE_BYTES=3000
|
|
|
|
# --- Product validation ----------------------------------------------------
|
|
ENABLE_PRODUCT_VALIDATION=true
|
|
VALIDATION_REJECT_THRESHOLD=0.35
|
|
VALIDATION_REVIEW_THRESHOLD=0.70
|
|
|
|
# --- RAG -------------------------------------------------------------------
|
|
RAG_DEFAULT_TOP_K=5
|
|
RAG_MAX_TOP_K=15
|
|
RAG_MAX_CONTEXT_CHARS=4000
|