SubtitleExtractor/.env.example at main · Dim145/SubtitleExtractor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
# ──────────────────────────────────────────────────────────────────────────
# SubtitleExtractor — example environment. Copy to `.env` and edit.
# ──────────────────────────────────────────────────────────────────────────

# ── Container images ───────────────────────────────────────────────────────
# Tag of the prebuilt GHCR images used by docker-compose (api / web / worker).
# Defaults to "latest". Pin a release for reproducible deploys, e.g. 0.1.0.
IMAGE_TAG=latest

# ── API ──────────────────────────────────────────────────────────────────
API_HTTP_ADDR=:8080
API_PUBLIC_URL=http://localhost:8080
# Comma-separated list of allowed CORS origins (frontend dev server, etc.)
API_CORS_ORIGINS=http://localhost:5173
# Max size (in bytes) of a single video upload. Default 2 GiB. Optional per-user
# storage quotas (admin › Settings) can cap total usage below this.
# MAX_UPLOAD_BYTES=2147483648

# ── Database (Postgres) ────────────────────────────────────────────────────
# Inside docker-compose the host is "postgres". Locally use "localhost".
# REQUIRED for docker-compose: these have NO fallback — a missing .env aborts
# the stack instead of booting with known credentials. Pick a strong password.
DATABASE_URL=postgres://subext:subext@postgres:5432/subext?sslmode=disable
POSTGRES_USER=subext
POSTGRES_PASSWORD=change-me-strong-db-password
POSTGRES_DB=subext

# ── Sessions / JWT ─────────────────────────────────────────────────────────
# REQUIRED: you MUST replace this placeholder. The API refuses to start while
# this value is left as-is. Generate a strong random value (>= 32 bytes):
#   openssl rand -hex 32
JWT_SIGNING_KEY=change-me-please-32-bytes-minimum-secret
SESSION_TTL=24h
# Cookie marked Secure. Leave UNSET to auto-enable when API_PUBLIC_URL (or the
# first CORS origin) is https://; set explicitly to true/false to override.
# SESSION_COOKIE_SECURE=false

# ── Auth: local accounts ───────────────────────────────────────────────────
AUTH_LOCAL_ENABLED=true
# When true, anyone can self-register a local account. When false, only admins create users.
AUTH_LOCAL_REGISTRATION_ENABLED=true

# ── Auth: OIDC (optional) ──────────────────────────────────────────────────
AUTH_OIDC_ENABLED=false
OIDC_ISSUER_URL=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
# Must point at the API callback, e.g. http://localhost:8080/api/auth/oidc/callback
OIDC_REDIRECT_URL=http://localhost:8080/api/auth/oidc/callback
OIDC_SCOPES=openid,email,profile
# Optional: claim whose presence/value grants admin (e.g. "groups")
OIDC_ADMIN_CLAIM=
OIDC_ADMIN_CLAIM_VALUE=

# ── Storage (local-fs OR s3) ───────────────────────────────────────────────
STORAGE_BACKEND=local

# local backend
STORAGE_LOCAL_ROOT=/data/blobs

# s3 / minio / r2 backend
STORAGE_S3_ENDPOINT=http://minio:9000
STORAGE_S3_BUCKET=subext
STORAGE_S3_REGION=us-east-1
STORAGE_S3_ACCESS_KEY=minioadmin
STORAGE_S3_SECRET_KEY=minioadmin
STORAGE_S3_USE_SSL=false
STORAGE_S3_FORCE_PATH_STYLE=true

# ── Worker protocol ────────────────────────────────────────────────────────
# Bootstrap/enrollment secret. On startup each worker exchanges this token for
# its own per-worker token (only the token's hash is stored server-side, and
# worker identity is derived from it); the bootstrap token itself can ONLY
# enroll — it cannot claim jobs or read source videos.
# REQUIRED: you MUST replace this placeholder. The API refuses to start while
# this value is left as-is. Generate one with: openssl rand -hex 32
INTERNAL_API_TOKEN=change-me-internal-worker-token
# How long without a heartbeat before a running job is considered dead (and re-queued).
WORKER_HEARTBEAT_TIMEOUT=2m

# ── Worker defaults (read by the Python worker) ────────────────────────────
# Drop OCR detections below this confidence and shorter than 2 chars (cuts
# transition-frame noise / spurious single-character cues).
WORKER_MIN_CONFIDENCE=0.6
# WORKER_DEFAULT_FPS=4
# WORKER_DEFAULT_CROP=x:y:w:h   # subtitle region in px; default = bottom ~38%

# ── MinIO (docker-compose dev only) ────────────────────────────────────────
# REQUIRED for docker-compose: NO fallback — a missing .env aborts the stack
# instead of booting MinIO with the well-known minioadmin/minioadmin creds.
MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=change-me-strong-minio-password