thor/.env.example at main · scoutqa-dot-ai/thor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
# Environment variables required for Thor
# Copy this file to .env and fill in the values.

# ── CRON — shared secret for scheduled job auth ──────────────────────────────
CRON_SECRET=generate-a-random-secret

# ── INTERNAL — shared secret for internal APIs ──────────────────────────────
# Gates gateway↔remote-cli calls and admin config writes (ingress injects it
# on /admin/ after Vouch; admin re-validates it). Use a hex/url-safe token.
THOR_INTERNAL_SECRET=generate-a-random-secret
# Test-only runner helper endpoints. Leave unset outside deterministic e2e runs.
# THOR_E2E_TEST_HELPERS=1
# Optional live Jira assignee e2e. Requires ATLASSIAN_AUTH + ATLASSIAN_CLOUD_ID
# plus a Jira user email in THOR_E2E_JIRA_EMAIL that resolves in the target cloud. The create
# call uses hard-coded fake project/type values and is expected to fail after
# attribution is injected.
# THOR_E2E_JIRA_EMAIL=atlassian-user@example.com

# ── RUNNER — public base URL for Thor trigger viewer links ──────────────────
# Used by remote-cli when it appends "View trigger" links to PR/Jira text.
# Local ingress default:
RUNNER_BASE_URL=http://localhost:8080

# ── GRAFANA — service account token for Loki/Tempo/Prometheus queries ──────
GRAFANA_URL=https://your-instance.grafana.net
GRAFANA_SERVICE_ACCOUNT_TOKEN=glsa_XXXXXXXXXXXXXXXXXXXXXXXXXXXX
GRAFANA_ORG_ID=YOUR_ORG_ID

# ── ATLASSIAN — Atlassian MCP authorization header value ───────────────────
# Supports two authentication methods:
#
# 1. Service account API key (Bearer auth, recommended):
#    ATLASSIAN_AUTH=Bearer ATSTT3x_YOUR_SERVICE_ACCOUNT_API_KEY
#
# 2. Personal API token (Basic auth):
#    Generate: echo -n "you@example.com:ATATT3x_YOUR_SCOPED_TOKEN" | base64
#    ATLASSIAN_AUTH=Basic base64_encoded_email_colon_token
#
# See: https://support.atlassian.com/atlassian-rovo-mcp-server/docs/configuring-authentication-via-api-token/
# AUTH + CLOUD_ID are a bundle (set both or neither); profile-suffixed bundles: see docs/feat/profile.md
# CLOUD_ID accepts the cloud UUID or a full https:// site URL
ATLASSIAN_AUTH=Bearer YOUR_TOKEN_HERE
ATLASSIAN_CLOUD_ID=https://acme.atlassian.net

# ── SCOUTQA — auth for the `scoutqa` CLI passthrough in remote-cli ──────────
# The `scoutqa` CLI auto-detects this from the environment; no config file needed.
# SCOUT_API_KEY=YOUR_SCOUTQA_API_KEY

# ── LANGFUSE — read-only LLM observability via hosted MCP server ────────────
LANGFUSE_PUBLIC_KEY=pk-lf-XXXXXXXXXXXXXXXXXXXXXXXXXXXX
LANGFUSE_SECRET_KEY=sk-lf-XXXXXXXXXXXXXXXXXXXXXXXXXXXX
LANGFUSE_BASE_URL=https://us.cloud.langfuse.com

# ── LAUNCHDARKLY — read-only feature flag inspection via ldcli ─────────────
# LD_ACCESS_TOKEN=api-XXXXXXXXXXXXXXXXXXXXXXXXXXXX
# LD_BASE_URI=https://app.launchdarkly.com
# LD_PROJECT=default
# LD_ENVIRONMENT=production

# ── AWS — credential chain for the `aws` CLI passthrough in remote-cli ──────
# Leave unset when deployed with an attached IAM role.
# AWS_REGION=us-east-1
# AWS_DEFAULT_REGION=us-east-1
# AWS_ACCESS_KEY_ID=AKIAXXXXXXXXXXXXXXXX
# AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
# AWS_SESSION_TOKEN=

# ── PSQL — Postgres connection targets for the `psql` passthrough ───────────
# One JSON object per profile, keyed by a stable database alias. The agent
# selects a target with `psql <alias> ...`; remote-cli injects host/creds via
# PG* env and runs psql read-only. Use a read-only DB role. port defaults to
# 5432, sslmode to require. Falls back to the unsuffixed PSQL_DATABASES.
# PSQL_DATABASES={"reporting":{"host":"db.example.com","database":"reporting","username":"thor_ro","password":"REPLACE"}}
# Example profile-scoped bundle:
# PSQL_DATABASES_QA={"commerce":{"host":"qa-commerce.cluster-xxxx.us-east-1.rds.amazonaws.com","database":"commerce","username":"thor_ro","password":"REPLACE"},"scout":{"host":"qa-scout.cluster-xxxx.us-east-1.rds.amazonaws.com","database":"scout","username":"thor_ro","password":"REPLACE"}}

# ── GITHUB — GitHub App auth for git/gh in remote-cli ───────────────────────
GITHUB_APP_ID=123456
GITHUB_APP_SLUG=thor
GITHUB_APP_BOT_ID=49699333
GITHUB_APP_PRIVATE_KEY_FILE=/var/lib/remote-cli/github-app/private-key.pem
GITHUB_WEBHOOK_SECRET=replace-with-random-secret
# GITHUB_API_URL=https://api.github.com

# ── POSTHOG — personal API key (use the "MCP Server" preset) ────────────────
POSTHOG_API_KEY=phx_XXXXXXXXXXXXXXXXXXXXXXXXXXXX
# Example profile-scoped key: POSTHOG_API_KEY_QA=phx_YYYYYYYYYYYYYYYYYYYYYYYYYYYY

# ── DAYTONA — cloud sandboxes for Python/Java/etc. ──────────────────────────
# See docs/daytona.md for setup instructions.
# DAYTONA_API_KEY=daytona_XXXXXXXXXXXX
# DAYTONA_API_URL=https://app.daytona.io/api
# DAYTONA_SNAPSHOT=thor-sandbox  # optional; defaults to daytona-medium

# ── SLACK — remote-cli posting, bot token, and webhook verification ──────────
# Create a Slack app with Events API subscription and the `app_mentions:read`
# and `chat:write` bot scopes. The same bot token is used by remote-cli for
# controlled slack-post-message calls, by gateway for Slack Web API calls, by
# runner for Slack-thread progress updates, and by mitmproxy for supported
# Slack read/reaction/upload auth injection.
SLACK_BOT_TOKEN=
# Optional Slack Web API base URL. Defaults to https://slack.com/api.
# SLACK_API_BASE_URL=https://slack.com/api
SLACK_BOT_USER_ID=
SLACK_SIGNING_SECRET=
# Required repo directory name used for every Slack channel unless a per-channel
# override at /workspace/memory/thor/repo-by-slack-channel/<channel-id>.txt
# names a different repo directory. The value must name an existing directory
# under /workspace/repos before `docker compose up`.
SLACK_DEFAULT_REPO=your-repo
# Optional channel used by live Slack e2e scripts.
# SLACK_E2E_CHANNEL_ID=C0123456789
# SLACK_TIMESTAMP_TOLERANCE_SECONDS=300
# Optional Slack workspace team id. When set, the admin sessions dashboard
# and the runner trigger viewer render Slack thread chips and source links as
# clickable permalinks. Find it in any Slack URL:
# https://app.slack.com/client/<TEAM_ID>/...
# SLACK_TEAM_ID=T01234567

# ── VOUCH — Google SSO for ingress auth ──────────────────────────────────────
VOUCH_GOOGLE_CLIENT_ID=your-google-client-id
VOUCH_GOOGLE_CLIENT_SECRET=your-google-client-secret
VOUCH_JWT_SECRET=generate-a-random-secret
# Google-authenticated users from these email domains may use domain-scoped
# routes. Vouch matches exact domains and subdomains from the email address.
VOUCH_ALLOWED_EMAIL_DOMAINS=scoutqa.cc
# OpenCode-backed ingress routes and /admin/ require one of these exact
# authenticated emails (comma-separated).
THOR_ADMIN_EMAILS=admin@scoutqa.cc,owner@scoutqa.cc
# VOUCH_CALLBACK_URL=http://localhost:8080/vouch/auth
# VOUCH_COOKIE_DOMAIN=localhost