APP_BASE_URL=http://localhost:3000 AUTH_SECRET=replace-with-a-long-random-secret DATABASE_URL=postgres://kinresolve:kinresolve@localhost:5432/kinresolve DATABASE_POOL_MAX=10 DATABASE_AUTO_MIGRATE=true # Release automation only: use a protected direct/session connection, never the runtime transaction pooler. # MIGRATION_DATABASE_URL= # Persisted archive lifecycle. Hosted deployments must set both modes explicitly. KINRESOLVE_DEPLOYMENT_MODE=self-hosted KINRESOLVE_DATASET_MODE=demo # Hosted release cells: set to the SHA-256 fingerprint printed by `npm run db:identity`. # KINRESOLVE_DATABASE_IDENTITY= # Legacy KINSLEUTH_ARCHIVE_ID / KINSLEUTH_ALLOW_SIGNUPS names are still accepted # during a deprecation compatibility window; when a new and a legacy name are both # set they must hold the same value or the app fails closed. KINRESOLVE_ARCHIVE_ID=archive-default KINRESOLVE_GUIDED_RESEARCH_ENABLED=true # Read-only developer API. It is fail-closed and disabled unless the flag is # exactly true. Use a distinct 32-byte-or-stronger secret for signed opaque # cursors; never reuse AUTH_SECRET or any operator/recovery credential. KINRESOLVE_API_V1_ENABLED=false # KINRESOLVE_API_CURSOR_SECRET=replace-with-a-distinct-random-32-byte-secret # Hosted cohort-one manifest. These lines stay commented so self-hosted defaults remain enabled. # Uncomment all seven together for a hosted cohort-one deployment; partial hosted manifests fail closed. # Plain GEDCOM only: the fixed hosted limits are 10 MiB (10,485,760 bytes) and 40,000 people. # KINRESOLVE_DNA_ENABLED=false # KINRESOLVE_EXTERNAL_AI_ENABLED=true # KINRESOLVE_PUBLIC_ARCHIVE_ENABLED=false # KINRESOLVE_PUBLIC_PUBLISHING_ENABLED=false # KINRESOLVE_EVIDENCE_BINARY_UPLOADS_ENABLED=false # KINRESOLVE_PACKAGE_MEDIA_ENABLED=false # KINRESOLVE_PLAIN_GEDCOM_ENABLED=true # Hosted identity perimeter (separate from the seven capability flags). # KINRESOLVE_ALLOW_SIGNUPS=false # Always-on fictional public demo. Valid only with hosted + demo, the exact # canonical origin, and a dedicated privacy HMAC secret. The HMAC key derives # short-lived network rate-limit subjects; raw addresses are never persisted. KINRESOLVE_PUBLIC_DEMO_ENABLED=false # KINRESOLVE_PUBLIC_DEMO_ORIGIN=https://demo.kinresolve.com # KINRESOLVE_DEMO_CANARY_SECRET=replace-with-a-distinct-random-32-byte-secret # KINRESOLVE_DEMO_PRIVACY_HMAC_SECRET=replace-with-a-distinct-random-32-byte-secret # Hosted private-beta invitations and recovery. These stay commented for self-hosters. # Production requires every value, exact approved legal metadata, and a verified # sender domain; the operator private key never belongs in the deployment environment. # KINRESOLVE_BETA_PRIVACY_HMAC_SECRET=replace-with-a-separate-random-32-byte-secret # Public native beta application intake. Disabled unless the flag is exactly # true. Keep this HMAC key distinct from every auth, API, operator, # observability, release/recovery, email, database, S3/MinIO, and AI credential. KINRESOLVE_BETA_APPLICATIONS_ENABLED=false # KINRESOLVE_BETA_APPLICATION_HMAC_SECRET=replace-with-a-distinct-random-32-byte-secret # KINRESOLVE_BETA_OPERATOR_KEY_ID=beta-operator-1 # KINRESOLVE_BETA_OPERATOR_AUDIENCE=https://app.kinresolve.com # KINRESOLVE_BETA_OPERATOR_PUBLIC_KEY_SPKI=replace-with-base64url-ed25519-spki # KINRESOLVE_TRANSACTIONAL_EMAIL_PROVIDER=resend # KINRESOLVE_TRANSACTIONAL_EMAIL_FROM="Kin Resolve " # KINRESOLVE_TRANSACTIONAL_EMAIL_REPLY_TO=beta@kinresolve.com # RESEND_API_KEY= # KINRESOLVE_BETA_LEGAL_STATUS=approved # KINRESOLVE_BETA_PARTICIPATION_TERMS_VERSION= # KINRESOLVE_BETA_PARTICIPATION_TERMS_SHA256= # KINRESOLVE_BETA_PARTICIPATION_TERMS_URL= # KINRESOLVE_BETA_PRIVACY_NOTICE_VERSION= # KINRESOLVE_BETA_PRIVACY_NOTICE_SHA256= # KINRESOLVE_BETA_PRIVACY_NOTICE_URL= # Hosted privacy-safe operational telemetry and protected health probes. The # ingest endpoint receives only the fixed allowlisted schema in lib/observability.ts. # Generate distinct secrets with `openssl rand -hex 32`; never reuse auth, # cron, release-fence, or operator credentials. # KINRESOLVE_OBSERVABILITY_ENDPOINT=https://events.example.com/v1/kinresolve # KINRESOLVE_OBSERVABILITY_INGEST_SECRET=replace-with-a-distinct-random-secret # KINRESOLVE_OBSERVABILITY_PROBE_SECRET=replace-with-a-distinct-random-secret # KINRESOLVE_BETA_BOUNDARY_VERSION= # KINRESOLVE_BETA_BOUNDARY_SHA256= # KINRESOLVE_BETA_BOUNDARY_URL= # Data-source rollout gates. Partner approval is independent from enablement. KINRESOLVE_EXPORT_REFRESH_ENABLED=true KINRESOLVE_DESKTOP_MEDIA_ENABLED=false # Set true only after approved rights language/legal review; both media gates are required. KINRESOLVE_MEDIA_LEGAL_REVIEW_APPROVED=false KINRESOLVE_ANCESTRY_API_ENABLED=false KINRESOLVE_ANCESTRY_PARTNER_APPROVED=false # Private archive-namespaced artifact storage: s3 or vercel-blob. KINRESOLVE_OBJECT_STORAGE_BACKEND=s3 # Hosted release cells: set to the fingerprint printed by `npm run storage:identity:provision`. # KINRESOLVE_OBJECT_STORAGE_IDENTITY= BLOB_READ_WRITE_TOKEN= CRON_SECRET= # Hosted operational gate: required and exact. Use false in staging and true in production. # Self-hosted deployments preserve scheduled-write behavior when this setting is omitted. # KINRESOLVE_SCHEDULED_WRITES_ENABLED=true # Dedicated 256-bit-or-stronger base64url/hex bearer token for protected release-fence # control; generate with `openssl rand -hex 32` and never reuse CRON_SECRET. RELEASE_FENCE_SECRET= # Server/worker endpoint and browser-reachable presigned-POST endpoint respectively. S3_ENDPOINT=http://localhost:9000 S3_PUBLIC_ENDPOINT=http://localhost:9000 S3_BUCKET=kinresolve S3_REGION=us-east-1 # Required for the bundled Docker Compose MinIO service. Set unique values before startup. MINIO_ROOT_USER= MINIO_ROOT_PASSWORD= # Used by app/worker processes outside Compose when connecting to an S3-compatible service. S3_ACCESS_KEY_ID= S3_SECRET_ACCESS_KEY= # Durable job worker controls. Web and worker processes must share storage and database settings. KINRESOLVE_WORKER_ID=kinresolve-local-worker KINRESOLVE_WORKER_POLL_INTERVAL_MS=1000 KINRESOLVE_WORKER_LEASE_DURATION_MS=60000 KINRESOLVE_WORKER_MAX_JOBS_PER_RUN=25 KINRESOLVE_WORKER_MAINTENANCE_INTERVAL_MS=900000 KINRESOLVE_WORKER_MAINTENANCE_LIMIT=100 # Optional private clamd scanner used by long-running and scheduled workers. # A ZIP with any non-GEDCOM file fails closed before review when this is unset. KINRESOLVE_MALWARE_SCANNER=none KINRESOLVE_CLAMD_HOST=127.0.0.1 KINRESOLVE_CLAMD_PORT=3310 KINRESOLVE_MALWARE_SCAN_TIMEOUT_MS=30000 # Keep this at or below clamd's StreamMaxLength (24 MiB fits its stock 25 MiB limit). KINRESOLVE_MALWARE_SCAN_MAX_BYTES=25165824 AI_BASE_URL=https://api.openai.com/v1 AI_API_KEY= AI_API_MODE=responses AI_CHAT_MODEL=gpt-5-mini AI_EMBEDDING_MODEL=text-embedding-3-small # Hosted external calls require a fresh on-screen confirmation, send only the # minimized pilot projection, and set Responses API storage to false. Provider # abuse-monitoring retention still follows the provider account contract.