.env.example

# ── Required ──────────────────────────────────────────────────
# Session encryption key. Must be at least 32 characters.
# In development mode (bun run dev), a hardcoded dev secret is used automatically.
# In production (bun run start), this MUST be set.
SESSION_SECRET=

# ── Optional ─────────────────────────────────────────────────
# Bearer token required to scrape the /metrics (Prometheus) endpoint.
# The endpoint returns 401 if this is unset or the token does not match.
# ADMIN_PANEL_METRICS_SECRET=

# How often, in milliseconds, the server samples event-loop delay for the
# nodejs_eventloop_lag_{min,max,mean,stddev,p50,p90,p99}_seconds metrics.
# prom-client's own default of 10 wakes an idle server about 100 times a second;
# lower values give finer percentiles at that cost. A whole number from 1 to
# 2147483647; anything else falls back to the default of 1000.
# ADMIN_PANEL_METRICS_EVENT_LOOP_PRECISION_MS=1000

# URL base path for serving the admin panel under a subpath (e.g., /adminpanel).
# Must match at build time and runtime. Leave unset for root (/).
# VITE_BASE_PATH=/adminpanel

# Browser-facing URL of the LibreChat API server (used for OAuth redirects).
# Defaults to http://localhost:3080
# VITE_API_BASE_URL=http://localhost:3080

# Server-side URL for LibreChat API calls. Falls back to VITE_API_BASE_URL.
# Useful when the server reaches LibreChat on a different URL than the browser.
# API_SERVER_URL=http://localhost:3080

# Force SSO-only login (hides the email/password form). With exactly one SSO
# provider (OpenID, Google or SAML) available in LibreChat, sign-in goes
# straight to it; with several, the admin picks one.
# ADMIN_SSO_ONLY=false

# Hide the SSO login buttons while keeping email/password login enabled.
# Set to false to suppress the admin-panel SSO buttons (and SSO auto-redirect)
# even when LibreChat has OpenID, Google or SAML configured. Takes precedence
# over ADMIN_SSO_ONLY. Defaults to enabled.
# ADMIN_SSO_ENABLED=true

# Session idle timeout in milliseconds (default: 30 minutes)
# ADMIN_SESSION_IDLE_TIMEOUT_MS=1800000

# Whether the session cookie should only be sent over HTTPS.
# Defaults to true in production, false otherwise.
# Set to false only for HTTP-only deployments where browsers drop Secure cookies.
# SESSION_COOKIE_SECURE=false

# Extra browser-facing origins allowed to call the panel's server functions,
# comma-separated. Server functions answer 403 to requests the browser did not
# make from the panel's own origin. Over HTTPS (or on localhost) browsers state
# that directly; over plain HTTP the panel compares Origin/Referer with the
# Host it received, so list the public origin here when a reverse proxy
# rewrites Host or drops a non-default port (or terminates TLS for browsers
# without Sec-Fetch-Site support).
# ADMIN_PANEL_TRUSTED_ORIGINS=http://admin.example.com:8080,http://10.0.0.5:3000

# Request log. Each request is logged as "[req] GET /path" when it arrives and
# "[req] GET /path 200 12ms" once it is answered (paths only, no query strings,
# at most 200 requests per 10s). An arrival with no completion line names a
# request the process died holding. A request the client abandons before it is
# answered completes as 499; one it leaves mid-response ends in "client-closed".
# Set to false to turn the request log off.
# ADMIN_PANEL_REQUEST_LOG=true

# Memory watermarks. Every 10s the panel compares its resident memory (RSS) with
# these thresholds in MiB and logs "[mem] rss=391Mi heapUsed=213Mi (crossed 384Mi)"
# each time it climbs past one. A threshold is logged again only after RSS
# drops back below it.
# ADMIN_PANEL_MEMORY_LOG_THRESHOLDS_MB=256,384,448

# ── Cache Control ────────────────────────────────────────────
# These mirror LibreChat's cache env vars. ADMIN_PANEL_* variants
# take precedence, falling back to the shared LibreChat equivalents.

# Static asset caching (hashed files in /assets/)
# STATIC_CACHE_MAX_AGE=172800        # browser max-age in seconds (default: 2 days)
# STATIC_CACHE_S_MAX_AGE=86400       # CDN s-maxage in seconds (default: 1 day)
# ADMIN_PANEL_STATIC_CACHE_MAX_AGE=  # overrides STATIC_CACHE_MAX_AGE for admin panel
# ADMIN_PANEL_STATIC_CACHE_S_MAX_AGE= # overrides STATIC_CACHE_S_MAX_AGE for admin panel

# HTML / index response caching
# INDEX_CACHE_CONTROL=no-cache, no-store, must-revalidate
# INDEX_PRAGMA=no-cache
# INDEX_EXPIRES=0
# ADMIN_PANEL_INDEX_CACHE_CONTROL=   # overrides INDEX_CACHE_CONTROL for admin panel
# ADMIN_PANEL_INDEX_PRAGMA=          # overrides INDEX_PRAGMA for admin panel
# ADMIN_PANEL_INDEX_EXPIRES=         # overrides INDEX_EXPIRES for admin panel