> ## Documentation Index > Fetch the complete documentation index at: https://docs.sinas.co/llms.txt > Use this file to discover all available pages before exploring further. # Environment Variables > All configuration options ## Required | Variable | Description | | ------------------- | ------------------------------------------------------------------------- | | `SECRET_KEY` | JWT signing key (auto-generated by install script) | | `ENCRYPTION_KEY` | Fernet key for encrypting stored credentials (LLM API keys, DB passwords) | | `DATABASE_PASSWORD` | PostgreSQL password | | `SUPERADMIN_EMAIL` | Admin user created on first startup | | `DOMAIN` | Your domain for Caddy auto-HTTPS (e.g., `sinas.example.com`) | ## Authentication | Variable | Default | Description | | --------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `AUTH_MODE` | `otp` | One of `otp`, `password`, `password+otp`. See [Authentication](/platform/authentication) for the differences. | | `SUPERADMIN_PASSWORD` | *(none)* | Seed password for the superadmin. Only used when `AUTH_MODE` includes `password`. Setting this and restarting acts as a password-reset escape hatch. | ## SMTP Required when `AUTH_MODE` is `otp` or `password+otp`. Skip entirely for `password` mode (airgapped deployments). | Variable | Default | Description | | --------------- | -------- | ------------------------------------------------ | | `SMTP_HOST` | *(none)* | SMTP server hostname (e.g., `smtp.sendgrid.net`) | | `SMTP_PORT` | `587` | SMTP port | | `SMTP_USER` | *(none)* | SMTP username | | `SMTP_PASSWORD` | *(none)* | SMTP password or API key | | `SMTP_DOMAIN` | *(none)* | Email "from" domain (e.g., `example.com`) | ## Application | Variable | Default | Description | | ----------------------------- | -------- | ------------------------------------- | | `DEBUG` | `false` | Enable verbose logging | | `CORS_ORIGINS` | *(none)* | Comma-separated allowed origins | | `ACCESS_TOKEN_EXPIRE_MINUTES` | `15` | JWT access token lifetime | | `REFRESH_TOKEN_EXPIRE_DAYS` | `30` | Refresh token lifetime | | `OTP_EXPIRE_MINUTES` | `10` | OTP code validity | | `OTP_MAX_ATTEMPTS` | `2` | Wrong OTP guesses before invalidation | ## Rate Limiting | Variable | Default | Description | | ---------------------------- | ------- | ----------------------------------------- | | `RATE_LIMIT_LOGIN_IP_MAX` | `10` | Max login requests per IP per window | | `RATE_LIMIT_LOGIN_EMAIL_MAX` | `5` | Max login requests per email per window | | `RATE_LIMIT_OTP_IP_MAX` | `10` | Max OTP verify requests per IP per window | | `RATE_LIMIT_WINDOW_SECONDS` | `900` | Rate limit window (15 minutes) | ## Function Execution | Variable | Default | Description | | --------------------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `FUNCTION_TIMEOUT` | `300` | Max execution time in seconds | | `MAX_FUNCTION_MEMORY` | `512` | Memory limit in MB | | `MAX_FUNCTION_CPU` | `1.0` | CPU cores per function | | `MAX_FUNCTION_STORAGE` | `1g` | Disk storage limit | | `FUNCTION_CONTAINER_IDLE_TIMEOUT` | `3600` | Idle container cleanup (seconds) | | `ALLOW_PACKAGE_INSTALLATION` | `true` | Allow `pip install` in functions | | `ALLOWED_PACKAGES` | *(all)* | Comma-separated package whitelist | | `MAX_EXECUTION_DEPTH` | *(= workers)* | Max nesting depth for execution chains (a function/agent invoking another execution). A deeper call is rejected fast instead of deadlocking the shared pool. Defaults to `DEFAULT_WORKER_COUNT`; `0` disables. | | `SHARED_POOL_RESERVE` | `0` | Shared-worker slots reserved for nested calls so a parent waiting on a child can't starve the pool. `0` = off. For full single-chain safety set to `MAX_EXECUTION_DEPTH - 1`. | ## Sandbox Containers | Variable | Default | Description | | ------------------------ | ------- | ------------------------------------ | | `SANDBOX_MIN_SIZE` | `4` | Containers to pre-create | | `SANDBOX_MAX_SIZE` | `20` | Maximum sandbox containers | | `SANDBOX_MIN_IDLE` | `2` | Replenish when idle drops below this | | `SANDBOX_MAX_EXECUTIONS` | `100` | Recycle after N executions | ## Agent Processing | Variable | Default | Description | | ------------------------ | ------- | -------------------------------------------- | | `MAX_TOOL_ITERATIONS` | `25` | Max consecutive tool-call rounds per message | | `MAX_HISTORY_MESSAGES` | `100` | Messages loaded for conversation context | | `AGENT_JOB_TIMEOUT` | `600` | Agent job timeout (seconds) | | `CODE_EXECUTION_TIMEOUT` | `120` | Code execution timeout (seconds) | ## Scaling | Variable | Default | Description | | ---------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------- | | `BACKEND_REPLICAS` | `1` | Backend API replicas | | `UVICORN_WORKERS` | `4` | Workers per backend replica | | `QUEUE_WORKER_REPLICAS` | `2` | Function queue worker replicas | | `QUEUE_AGENT_REPLICAS` | `2` | Agent queue worker replicas | | `QUEUE_FUNCTION_CONCURRENCY` | `10` | Concurrent functions per worker | | `QUEUE_AGENT_CONCURRENCY` | `5` | Concurrent agent jobs per worker | | `DEFAULT_WORKER_COUNT` | `4` | Shared (trusted) worker containers for `shared_pool` functions. Also the default ceiling for `MAX_EXECUTION_DEPTH`. | ## Resource Limits (Docker) | Variable | Default | Description | | ------------------------ | ------- | ----------------------------------- | | `APP_CPU_LIMIT` | `2.0` | Max CPU cores for backend container | | `APP_MEMORY_LIMIT` | `2G` | Max RAM for backend container | | `APP_CPU_RESERVATION` | `0.5` | Guaranteed CPU cores | | `APP_MEMORY_RESERVATION` | `512M` | Guaranteed RAM | ## Database | Variable | Default | Description | | --------------- | ---------------------- | -------------------------------------------------- | | `DATABASE_USER` | `postgres` | PostgreSQL user | | `DATABASE_HOST` | `postgres` | PostgreSQL host | | `DATABASE_PORT` | `5432` | PostgreSQL port | | `DATABASE_NAME` | `sinas` | Database name | | `DATABASE_URL` | *(built from above)* | Full connection string (overrides individual vars) | | `REDIS_URL` | `redis://redis:6379/0` | Redis connection string | ## ClickHouse (Optional) | Variable | Default | Description | | --------------------------------- | ------------ | ------------------------------ | | `CLICKHOUSE_HOST` | `clickhouse` | ClickHouse host | | `CLICKHOUSE_PORT` | `8123` | ClickHouse HTTP port | | `CLICKHOUSE_USER` | `default` | ClickHouse user | | `CLICKHOUSE_PASSWORD` | *(empty)* | ClickHouse password | | `CLICKHOUSE_DATABASE` | `sinas` | ClickHouse database | | `CLICKHOUSE_RETENTION_DAYS` | `90` | Data retention (no S3) | | `CLICKHOUSE_HOT_RETENTION_DAYS` | `30` | Hot retention (with S3) | | `CLICKHOUSE_S3_ENDPOINT` | *(none)* | S3 endpoint for tiered storage | | `CLICKHOUSE_S3_BUCKET` | *(none)* | S3 bucket name | | `CLICKHOUSE_S3_ACCESS_KEY_ID` | *(none)* | S3 access key | | `CLICKHOUSE_S3_SECRET_ACCESS_KEY` | *(none)* | S3 secret key | | `CLICKHOUSE_S3_REGION` | `us-east-1` | S3 region | ## Declarative Config | Variable | Default | Description | | ------------------- | -------- | ---------------------------- | | `CONFIG_FILE` | *(none)* | Path to YAML config file | | `AUTO_APPLY_CONFIG` | `false` | Apply config file on startup | The simplest useful setup requires the required variables plus a configured LLM provider. Everything else (functions, skills, state, etc.) is optional and can be added incrementally. ***