Spaces:
Runtime error
Runtime error
| # Matrix Runtime — example environment configuration | |
| # | |
| # Copy to .env and adjust. Every variable below is actually read by the binary | |
| # (see internal/config, internal/auth, internal/email). NEVER commit real | |
| # secrets — keep your filled-in .env out of version control. | |
| # ---- Core -------------------------------------------------------------------- | |
| # Mode: local-dev | customer-agent | cloud-worker | hf-space | |
| MATRIX_RUNTIME_MODE=customer-agent | |
| # HTTP port. $PORT (PaaS convention) is also honored; if busy, the next free | |
| # port is used automatically. | |
| MATRIX_RUNTIME_PORT=8080 | |
| # Writable data directory (SQLite db, model cache, sandboxes, secret key). | |
| MATRIX_RUNTIME_DATA_DIR=/var/lib/matrix-runtime | |
| # Externally reachable base URL (used in links/emails). Optional. | |
| MATRIX_RUNTIME_PUBLIC_URL= | |
| # ---- API authentication ------------------------------------------------------ | |
| # Operator bearer token. REQUIRED in production modes — without it the API is | |
| # unauthenticated for non-session callers (the readiness probe warns, and | |
| # protected endpoints fail closed). Generate: openssl rand -hex 32 | |
| MATRIX_RUNTIME_API_TOKEN= | |
| # ---- Database ---------------------------------------------------------------- | |
| # Default: a local SQLite file under the data dir. For multi-user / HA, set a | |
| # PostgreSQL (e.g. Neon) URL — MatrixCloud isolates all objects in its own | |
| # schema so the instance can be shared safely. | |
| # MATRIXCLOUD_DATABASE_URL / MATRIX_RUNTIME_DB_URL / DATABASE_URL (first wins) | |
| MATRIXCLOUD_DATABASE_URL= | |
| MATRIXCLOUD_DB_SCHEMA=matrixcloud | |
| # Override the SQLite path (when no Postgres URL is set). | |
| MATRIX_RUNTIME_DB_PATH= | |
| # ---- Secrets at rest --------------------------------------------------------- | |
| # 32-byte key (hex or base64) used to encrypt BYO provider credentials | |
| # (AES-256-GCM). If unset, a key is generated once into <data-dir>/secret.key. | |
| # Set this explicitly in production so secrets survive a fresh data dir. | |
| MATRIXCLOUD_SECRET_KEY= | |
| # ---- Transactional email (Resend) ------------------------------------------- | |
| # Used for welcome/verification and password-reset emails. Without a key the | |
| # sender runs in log-only mode (no email sent), which is fine for local dev. | |
| RESEND_API_KEY= | |
| MATRIXCLOUD_EMAIL_FROM=MatrixCloud <noreply@matrixhub.io> | |
| # Public console URL used to build email links (reset/verify). | |
| MATRIXCLOUD_APP_URL=https://cloud.matrixhub.io | |
| # ---- Limits & retention ------------------------------------------------------ | |
| MATRIX_RUNTIME_MAX_TTL_SECONDS=600 | |
| MATRIX_RUNTIME_MAX_CONCURRENT_JOBS=5 | |
| # Requests/min per client IP on write+auth endpoints (0 disables). | |
| MATRIX_RUNTIME_RATE_LIMIT_RPM=120 | |
| # Background retention (purge terminal jobs/scratch + prune old logs). | |
| MATRIX_RUNTIME_JOB_RETENTION_HOURS=24 | |
| MATRIX_RUNTIME_LOG_RETENTION_HOURS=72 | |
| MATRIX_RUNTIME_CLEANUP_INTERVAL_MINUTES=15 | |
| # ---- MatrixShell ------------------------------------------------------------- | |
| # Executes commands in a local Python sandbox. OFF by default in production | |
| # modes; ON by default only in local-dev. Set true/false to override. | |
| MATRIX_SHELL_ENABLED=false | |
| # ---- Control plane (hybrid join) -------------------------------------------- | |
| MATRIX_CLOUD_URL=https://cloud.matrixhub.io | |
| MATRIX_RUNTIME_JOIN_TOKEN= | |
| # Optional identity overrides. | |
| MATRIX_RUNTIME_ID= | |
| MATRIX_RUNTIME_WORKSPACE= | |
| # ---- Hugging Face ------------------------------------------------------------ | |
| # Optional operator HF token (users can also bring their own per-workspace). | |
| HF_TOKEN= | |
| MATRIX_RUNTIME_HF_CACHE_DIR= | |