TOKENHUB_ENV=prod
TOKENHUB_IMAGE_TAG=latest
# Bundled SQLite/local PostgreSQL application container (backend and frontend).
# Equal memory and memory-plus-swap limits disable container swap. Leave host RAM
# for the OS and other services; lower GOMEMLIMIT when lowering this hard limit.
TOKENHUB_CONTAINER_MEMORY_LIMIT=4g
# Go runtime soft memory target; excludes SQLite/cgo, frontend and page cache.
GOMEMLIMIT=2GiB
TOKENHUB_PUBLIC_BASE_URL=http://localhost:8080
TOKENHUB_RELEASE_REPOSITORY=astaxie/TokenHub
TOKENHUB_PLUGIN_DIR=/app/plugins
TOKENHUB_PLUGIN_MARKETPLACE_URL=
TOKENHUB_TRUSTED_PROXY_CIDRS=
# Auto permits private DNS names; both modes allow RFC1918/ULA literals when the CIDR list is empty.
TOKENHUB_PROVIDER_UPSTREAM_ACCESS_MODE=strict
# Set true to send permitted local upstream requests through the selected proxy.
TOKENHUB_PROVIDER_UPSTREAM_PROXY_LOCAL=false
TOKENHUB_PROVIDER_UPSTREAM_ALLOWED_CIDRS=
TOKENHUB_PROVIDER_UPSTREAM_NAT64_PREFIX=
# Used in strict mode or when a nonempty private allowlist is configured.
TOKENHUB_PROVIDER_UPSTREAM_ALLOW_LOOPBACK=false
# Optional standard outbound forward proxy for every HTTP provider channel.
HTTP_PROXY=
HTTPS_PROXY=
NO_PROXY=
TOKENHUB_CORS_ALLOWED_ORIGINS=http://localhost:3000
TOKENHUB_ADMIN_TOKEN=change-me-tokenhub-admin-token
TOKENHUB_BOOTSTRAP_ADMIN_PASSWORD=change-me-tokenhub-admin-password
TOKENHUB_SECRET_KEY=change-me-tokenhub-secret-key
TOKENHUB_BACKEND_PORT=8080
TOKENHUB_FRONTEND_PORT=3000
# Used by docker-compose.remote-postgres.yml.
TOKENHUB_BACKEND_REPLICAS=2
TOKENHUB_FRONTEND_REPLICAS=2
TOKENHUB_SEED_DEMO=false
TOKENHUB_RESOURCE_FAILURE_THRESHOLD=3
TOKENHUB_RESOURCE_COOLDOWN_SECONDS=300
TOKENHUB_RESOURCE_COOLDOWN_MAX_SECONDS=3600
TOKENHUB_METRICS_ENABLED=false
# Leave empty to accept the admin token; set a dedicated value to keep the admin
# credential out of your Prometheus scrape config.
TOKENHUB_METRICS_TOKEN=
TOKENHUB_METRICS_PROJECT_LABEL=false
# Total time limit for one non-streaming upstream request. Streaming calls have no
# total limit; they are bounded by how long they stay silent, and that budget
# restarts on every byte received. Raise the idle value for long reasoning or
# coding responses.
TOKENHUB_UPSTREAM_NON_STREAM_TIMEOUT_SECONDS=120
TOKENHUB_UPSTREAM_STREAM_IDLE_TIMEOUT_SECONDS=300
# Maximum JSON request body (raw bytes or a binary suffix like 8m/512k; clamped at
# 512 MiB). The multimodal limit is higher for base64-inlined images.
TOKENHUB_MAX_JSON_REQUEST_BYTES=8388608
TOKENHUB_MAX_MULTIMODAL_REQUEST_BYTES=33554432
# Body-size ceiling for the bundled multi-instance nginx load balancer, in nginx
# size syntax (bare bytes or a single-letter k/m/g suffix — NOT 8mb/8mib). Keep it
# at least as large as TOKENHUB_MAX_MULTIMODAL_REQUEST_BYTES or the proxy rejects
# large multimodal requests before they reach TokenHub. Used only by
# docker-compose.remote-postgres.yml.
TOKENHUB_NGINX_CLIENT_MAX_BODY_SIZE=32m
TOKENHUB_IN_FLIGHT_LEASE_TTL_SECONDS=300
TOKENHUB_CLUSTER_LOCK_TTL_SECONDS=180
# Optional Redis URL for high-concurrency billing admission. Leave empty to use
# the database-backed minute quota and API key/user concurrency path.
TOKENHUB_BILLING_REDIS_URL=
TOKENHUB_GRACEFUL_SHUTDOWN_SECONDS=150
TOKENHUB_IMAGE_WORKER_CONCURRENCY=2
TOKENHUB_RESPONSE_WORKER_CONCURRENCY=2
TOKENHUB_RESPONSE_POLL_INTERVAL_MILLIS=250
TOKENHUB_RESPONSE_JOB_TIMEOUT_SECONDS=300
TOKENHUB_RESPONSE_LEASE_TTL_SECONDS=30
TOKENHUB_RESPONSE_RESULT_TTL_SECONDS=3600
TOKENHUB_RESPONSE_MAX_QUEUED_JOBS=1000
TOKENHUB_STOP_GRACE_PERIOD=180s

# Cache locality routing for Chat Completions, Anthropic Messages, and Responses:
# pins a session to one upstream account so the provider's prompt cache keeps hitting.
# Off by default because it changes routing behaviour;
# roll back by turning it off rather than by rolling back the binary.
TOKENHUB_CACHE_AFFINITY_ENABLED=false
# Comma-separated model allowlist for staged rollout. Empty means every model.
TOKENHUB_CACHE_AFFINITY_MODELS=
# Accept user-scoped identifiers (OpenAI/Responses `user`, plain Anthropic `metadata.user_id`)
# as affinity keys. Off by default: one user's concurrent sessions share the value,
# so all of that user's traffic would land on a single account.
TOKENHUB_CACHE_AFFINITY_ALLOW_USER_SCOPE=false

# Dedicated Qwen3Guard OpenAI-compatible chat-completions endpoint. Enabling it
# sends inspected user-visible request text to that service. Leave empty to keep
# model detection offline and use each policy's unavailable behavior.
TOKENHUB_GUARDRAIL_MODEL_URL=
TOKENHUB_GUARDRAIL_MODEL_API_KEY=
TOKENHUB_GUARDRAIL_MODEL_NAME=Qwen/Qwen3Guard-Gen-0.6B
TOKENHUB_GUARDRAIL_MODEL_TIMEOUT_SECONDS=10

# Database configuration
# Option 1: Use Docker Compose (recommended)
#   - docker-compose.yml automatically uses SQLite
#   - docker-compose.postgres.yml automatically configures PostgreSQL URL
#   Just set the POSTGRES_* variables below

# Option 2: Manual database URL configuration (not using Docker or external database)
#   Uncomment and configure TOKENHUB_DATABASE_URL
# SQLite example:
# TOKENHUB_DATABASE_URL=sqlite:///app/data/tokenhub.db
# PostgreSQL example:
# TOKENHUB_DATABASE_URL=postgresql://tokenhub:your-password@localhost:5432/tokenhub?sslmode=disable
# Remote PostgreSQL example:
# TOKENHUB_DATABASE_URL=postgresql://tokenhub:your-password@db.example.com:5432/tokenhub?sslmode=require

# PostgreSQL configuration (for docker-compose.postgres.yml)
POSTGRES_DB=tokenhub
POSTGRES_USER=tokenhub
POSTGRES_PASSWORD=change-me-postgres-password
POSTGRES_PORT=5432

# PostgreSQL connection pool configuration
TOKENHUB_DB_MAX_OPEN_CONNS=25
TOKENHUB_DB_MAX_IDLE_CONNS=5
TOKENHUB_DB_CONN_MAX_LIFETIME_MINUTES=30

TOKENHUB_API_BASE_URL=http://localhost:8080

# Optional Jev routing overlay. Both shadow and enforce send eligible user text
# and candidate model capabilities to TypeSafe. Empty project allowlist denies all.
TOKENHUB_SEMANTIC_ROUTING_ENABLED=false
TOKENHUB_SEMANTIC_ROUTING_PROJECTS=
TOKENHUB_TYPESAFE_API_KEY=
TOKENHUB_TYPESAFE_MODEL=jev-1.13.0
TOKENHUB_SEMANTIC_ROUTING_TIMEOUT_MS=1000