Skip to content

Commit d171250

Browse files
author
EaCognitive
committed
Initial public v1 source release
0 parents  commit d171250

855 files changed

Lines changed: 189992 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.dockerignore‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Git
2+
.git
3+
.gitignore
4+
5+
# Python
6+
__pycache__
7+
*.py[cod]
8+
*.egg-info
9+
.eggs
10+
dist
11+
build
12+
.venv
13+
venv
14+
.pytest_cache
15+
.mypy_cache
16+
.ruff_cache
17+
*.egg
18+
19+
# Node (dashboard has its own)
20+
node_modules
21+
22+
# IDE
23+
.idea
24+
.vscode
25+
*.swp
26+
27+
# Docker
28+
Dockerfile*
29+
docker-compose*.yml
30+
31+
# Docs
32+
*.md
33+
!README.md
34+
35+
# Tests
36+
tests/
37+
htmlcov/
38+
.coverage
39+
40+
# Local env
41+
.env
42+
.env.local
43+
*.db

‎.env.example‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# AgentGate Docker Compose Environment Variables
2+
# Copy this file to .env and fill in with secure values
3+
# NEVER commit .env to version control
4+
5+
# Database Configuration
6+
POSTGRES_USER=agentgate
7+
POSTGRES_PASSWORD=generate-secure-password-here
8+
POSTGRES_DB=agentgate
9+
10+
# Backend Configuration
11+
# Generate SECRET_KEY with: openssl rand -hex 32
12+
SECRET_KEY=your-secret-key-here
13+
14+
# Identity provider mode
15+
# local | descope | custom_oidc | hybrid_migration
16+
IDENTITY_PROVIDER_MODE=local
17+
# Allow local password auth in non-local modes
18+
ALLOW_LOCAL_PASSWORD_AUTH=false
19+
# Production-only local mode override
20+
ALLOW_PRODUCTION_LOCAL_AUTH=false
21+
# Legacy role alias compatibility (operator -> approver)
22+
ROLE_OPERATOR_ALIAS_ENABLED=true
23+
# API reference access mode: public | authenticated | admin_mcp
24+
API_REFERENCE_ACCESS_MODE=public
25+
# Roles allowed for MCP-privileged surfaces
26+
MCP_PRIVILEGED_ROLES=admin
27+
# Required scopes when MCP scope enforcement is active
28+
MCP_REQUIRED_SCOPES=mcp:admin,mcp:access
29+
# Optional override for scope enforcement (true/false)
30+
MCP_REQUIRE_SCOPE=false
31+
# API key scope governance
32+
API_KEY_WILDCARD_ROLES=admin,security_admin
33+
API_KEY_MCP_SCOPE_ROLES=admin,security_admin,developer
34+
API_KEY_ALLOWED_CUSTOM_SCOPES=mcp:read,mcp:write,mcp:access,mcp:admin
35+
36+
# Descope OIDC validation
37+
DESCOPE_JWKS_URL=
38+
DESCOPE_ISSUER=
39+
DESCOPE_AUDIENCE=
40+
41+
# Generic OIDC validation
42+
OIDC_JWKS_URL=
43+
OIDC_ISSUER=
44+
OIDC_AUDIENCE=
45+
46+
# CORS Configuration (production only)
47+
# Comma-separated list of allowed origins
48+
ALLOWED_ORIGINS=http://localhost:3000
49+
50+
# Environment (development or production)
51+
AGENTGATE_ENV=development
52+
53+
# Redis Configuration (for distributed rate limiting)
54+
REDIS_URL=redis://redis:6379/0
55+
56+
# Distributed health monitoring (optional)
57+
# Enable periodic checks for API/dashboard/distributed targets.
58+
AGENTGATE_DISTRIBUTED_HEALTH_MONITOR_ENABLED=false
59+
# Comma-separated targets:
60+
# name=url
61+
# name|url|expected_substring
62+
# Example:
63+
# AGENTGATE_DISTRIBUTED_HEALTH_MONITOR_TARGETS=api=http://server:8000/api/health,dashboard|http://dashboard:3000|<html
64+
AGENTGATE_DISTRIBUTED_HEALTH_MONITOR_TARGETS=
65+
AGENTGATE_DISTRIBUTED_HEALTH_MONITOR_TARGETS_JSON=
66+
AGENTGATE_DISTRIBUTED_HEALTH_MONITOR_INTERVAL_SECONDS=30
67+
AGENTGATE_DISTRIBUTED_HEALTH_MONITOR_TIMEOUT_SECONDS=5
68+
AGENTGATE_DISTRIBUTED_HEALTH_MONITOR_FAILURE_THRESHOLD=2
69+
AGENTGATE_HEALTH_MONITOR_INCLUDE_DASHBOARD=false
70+
AGENTGATE_DASHBOARD_HEALTH_URL=http://dashboard:3000
71+
72+
# HMAC secret for policy integrity signatures
73+
# Generate with: openssl rand -hex 32
74+
AGENTGATE_HMAC_SECRET=
75+
76+
# Security alert delivery channels
77+
SECURITY_ALERT_LOG_MIN_PRIORITY=low
78+
SECURITY_ALERT_WEBHOOK_URL=
79+
SECURITY_ALERT_WEBHOOK_HEADERS_JSON=
80+
SECURITY_ALERT_WEBHOOK_MIN_PRIORITY=high
81+
SECURITY_ALERT_WEBHOOK_TIMEOUT_SECONDS=10
82+
SECURITY_ALERT_SLACK_WEBHOOK_URL=
83+
SECURITY_ALERT_SLACK_CHANNEL=
84+
SECURITY_ALERT_SLACK_MIN_PRIORITY=high
85+
SECURITY_ALERT_WINDOW_SECONDS=60
86+
SECURITY_ALERT_MAX_PER_WINDOW=10
87+
SECURITY_ALERT_COOLDOWN_SECONDS=300
88+
SECURITY_ALERT_MAX_DURING_COOLDOWN=1
89+
SECURITY_ALERT_DEDUP_WINDOW_SECONDS=300
90+
91+
# Dashboard Configuration
92+
NEXTAUTH_URL=http://localhost:3000
93+
# Generate NEXTAUTH_SECRET with: openssl rand -hex 32
94+
NEXTAUTH_SECRET=your-nextauth-secret-here
95+
API_URL=http://server:8000
96+
# Required for the dashboard playground chat route
97+
OPENAI_API_KEY=
98+
99+
# Default Admin (OPTIONAL - only for first startup)
100+
# Leave empty to skip auto-creation (recommended for production)
101+
# DEFAULT_ADMIN_EMAIL=admin@yourcompany.com
102+
# DEFAULT_ADMIN_PASSWORD=your-secure-password-here
103+
104+
# hCaptcha Configuration (for login protection)
105+
# Get keys from: https://www.hcaptcha.com/
106+
# Required for production to prevent brute force attacks
107+
HCAPTCHA_SECRET=your_hcaptcha_secret_key_here
108+
HCAPTCHA_SITE_KEY=your_hcaptcha_site_key_here

‎.env.production.example‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
# AgentGate Production Environment Configuration
2+
# Copy this file to .env.production and fill in the values
3+
# NEVER commit .env.production to version control
4+
5+
# ============================================================================
6+
# Database Configuration
7+
# ============================================================================
8+
# CRITICAL: Production requires PostgreSQL. SQLite is NOT supported in production.
9+
# Use passwordless Entra authentication in cloud_strict profile.
10+
# The URL must not embed static DB password material.
11+
DATABASE_URL=postgresql+asyncpg://agentgate@your-postgres-host:5432/agentgate?sslmode=require
12+
13+
POSTGRES_USER=agentgate
14+
# REQUIRED: Generate strong password (minimum 32 characters)
15+
# Example: openssl rand -base64 32
16+
POSTGRES_PASSWORD=
17+
POSTGRES_DB=agentgate
18+
POSTGRES_DATA_PATH=./data/postgres
19+
20+
# PostgreSQL Performance Tuning (Optional)
21+
POSTGRES_SHARED_BUFFERS=256MB
22+
POSTGRES_EFFECTIVE_CACHE_SIZE=1GB
23+
POSTGRES_MAX_CONNECTIONS=100
24+
25+
# ============================================================================
26+
# Redis Configuration
27+
# ============================================================================
28+
# REQUIRED: Generate strong password (minimum 32 characters)
29+
# Example: openssl rand -base64 32
30+
REDIS_PASSWORD=
31+
REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379/0
32+
REDIS_MAX_MEMORY=256mb
33+
REDIS_DATA_PATH=./data/redis
34+
35+
# ============================================================================
36+
# Application Security
37+
# ============================================================================
38+
# REQUIRED: Generate with: openssl rand -hex 32
39+
SECRET_KEY=
40+
# REQUIRED: Generate with: openssl rand -hex 32
41+
NEXTAUTH_SECRET=
42+
# REQUIRED: HMAC secret for policy integrity signatures
43+
# Generate with: openssl rand -hex 32
44+
AGENTGATE_HMAC_SECRET=
45+
46+
# Docker Secrets (Production)
47+
POSTGRES_PASSWORD_FILE=./secrets/db_password.txt
48+
API_SECRET_KEY_FILE=./secrets/api_secret_key.txt
49+
NEXTAUTH_SECRET_FILE=./secrets/nextauth_secret.txt
50+
51+
# ============================================================================
52+
# Application Configuration
53+
# ============================================================================
54+
AGENTGATE_ENV=production
55+
AGENTGATE_RUNTIME_PROFILE=cloud_strict
56+
DATABASE_AUTH_MODE=entra_token
57+
AGENTGATE_Z3_MODE=enforce
58+
IDENTITY_PROVIDER_MODE=descope
59+
ALLOW_LOCAL_PASSWORD_AUTH=false
60+
ALLOW_PRODUCTION_LOCAL_AUTH=false
61+
ROLE_OPERATOR_ALIAS_ENABLED=true
62+
API_REFERENCE_ACCESS_MODE=admin_mcp
63+
MCP_PRIVILEGED_ROLES=admin
64+
MCP_REQUIRED_SCOPES=mcp:admin,mcp:access
65+
MCP_REQUIRE_SCOPE=true
66+
API_KEY_WILDCARD_ROLES=admin,security_admin
67+
API_KEY_MCP_SCOPE_ROLES=admin,security_admin,developer
68+
API_KEY_ALLOWED_CUSTOM_SCOPES=mcp:read,mcp:write,mcp:access,mcp:admin
69+
70+
# Descope OIDC validation (required when IDENTITY_PROVIDER_MODE=descope)
71+
DESCOPE_JWKS_URL=
72+
DESCOPE_ISSUER=
73+
DESCOPE_AUDIENCE=
74+
75+
# CORS - Update with your actual domain
76+
ALLOWED_ORIGINS=https://yourdomain.com,https://www.yourdomain.com
77+
78+
# NextAuth - Update with your actual domain
79+
NEXTAUTH_URL=https://yourdomain.com
80+
NEXT_PUBLIC_API_URL=https://yourdomain.com/api
81+
82+
# ============================================================================
83+
# Server Configuration
84+
# ============================================================================
85+
# Number of Uvicorn workers (adjust based on CPU cores)
86+
WORKERS=4
87+
UVICORN_WORKERS=4
88+
89+
# Logging
90+
LOG_LEVEL=info
91+
LOG_FORMAT=json
92+
93+
# ============================================================================
94+
# Deployment Configuration
95+
# ============================================================================
96+
# Number of service replicas (for Docker Swarm or scaling)
97+
SERVER_REPLICAS=2
98+
DASHBOARD_REPLICAS=2
99+
100+
# Build metadata
101+
VERSION=1.0.0
102+
BUILD_DATE=2025-01-28T00:00:00Z
103+
104+
# ============================================================================
105+
# Monitoring and Observability (Optional)
106+
# ============================================================================
107+
ENABLE_METRICS=true
108+
METRICS_PORT=9090
109+
110+
# ============================================================================
111+
# Audit Event Pipeline
112+
# ============================================================================
113+
# sync: writes audit events directly to DB within request (default)
114+
# redis_stream: publishes to Redis Stream for async batch processing
115+
AUDIT_PIPELINE=sync
116+
117+
# ============================================================================
118+
# Feature Flags
119+
# ============================================================================
120+
ENABLE_RATE_LIMITING=true
121+
ENABLE_CORS=true
122+
ENABLE_CSRF=true
123+
124+
# ============================================================================
125+
# Admin User (DO NOT USE IN PRODUCTION)
126+
# ============================================================================
127+
# SECURITY WARNING: Do not use auto-creation in production
128+
# Create admin users manually through the CLI or database
129+
DEFAULT_ADMIN_EMAIL=
130+
DEFAULT_ADMIN_PASSWORD=
131+
132+
# ============================================================================
133+
# Azure Key Vault (Production Secret Management)
134+
# ============================================================================
135+
# REQUIRED in production: URL of the Azure Key Vault instance
136+
# Secrets are fetched via DefaultAzureCredential (Managed Identity on Azure,
137+
# az login / service principal locally)
138+
AZURE_KEY_VAULT_URL=https://your-vault-name.vault.azure.net
139+
140+
# ============================================================================
141+
# Backup Configuration
142+
# ============================================================================
143+
# Local backup settings
144+
BACKUP_DIR=/var/backups/agentgate
145+
RETENTION_DAYS=30
146+
147+
# Cloud Backup Provider (s3 or azure)
148+
# Set to enable automatic cloud backup uploads
149+
CLOUD_PROVIDER=azure
150+
CLOUD_BUCKET=agentgate-backups
151+
CLOUD_AUTO_CREATE_BUCKET=false # Set to true to auto-create bucket if missing
152+
153+
# AWS S3 Configuration (if CLOUD_PROVIDER=s3)
154+
# Credentials are stored in Azure Key Vault:
155+
# - aws-access-key-id
156+
# - aws-secret-access-key
157+
# Or set them directly (not recommended for production):
158+
# AWS_ACCESS_KEY_ID=
159+
# AWS_SECRET_ACCESS_KEY=
160+
AWS_REGION=us-east-1
161+
162+
# Azure Blob Storage Configuration (if CLOUD_PROVIDER=azure)
163+
# Uses DefaultAzureCredential (Managed Identity on Azure, az login locally)
164+
# No additional configuration needed beyond AZURE_KEY_VAULT_URL
165+
166+
# Backup Schedule (for cron)
167+
# BACKUP_SCHEDULE=0 2 * * * # Daily at 2 AM

0 commit comments

Comments
 (0)