lasuite-docs/documentation/env.md

Docs variables

Here we describe all environment variables that can be set for the docs application.

impress-backend container

These are the environment variables you can set for the impress-backend container.

Option	Description	default
AI_ALLOW_REACH_FROM	Users that can use AI must be this level. options are "public", "authenticated", "restricted"	authenticated
OPENAI_SDK_API_KEY	AI key to be used by the OpenAI python SDK
OPENAI_SDK_BASE_URL	OpenAI compatible AI base url
MISTRAL_SDK_API_KEY	AI key to be used by the Mistral python SDK /!\ Mistral sdk can be used only in async mode with uvicorn /!\
MISTRAL_SDK_BASE_URL	Mistral compatible AI base url
AI_BOT	Information to give to the frontend about the AI bot	{ "name": "Docs AI", "color": "#8bc6ff" }
AI_FEATURE_ENABLED	Enable AI options	false
AI_FEATURE_BLOCKNOTE_ENABLED	Enable Blocknote AI options	false
AI_FEATURE_LEGACY_ENABLED	Enable legacyAI options	true
AI_MODEL	AI Model to use
AI_VERCEL_SDK_VERSION	The vercel AI SDK version used	6
ALLOW_LOGOUT_GET_METHOD	Allow get logout method	true
API_USERS_LIST_LIMIT	Limit on API users	5
API_USERS_LIST_THROTTLE_RATE_BURST	Throttle rate for api on burst	30/minute
API_USERS_LIST_THROTTLE_RATE_SUSTAINED	Throttle rate for api	180/hour
API_USERS_SEARCH_QUERY_MIN_LENGTH	Minimum characters to insert to search a user	3
AWS_S3_ACCESS_KEY_ID	Access id for s3 endpoint
AWS_S3_ENDPOINT_URL	S3 endpoint
AWS_S3_REGION_NAME	Region name for s3 endpoint
AWS_S3_SECRET_ACCESS_KEY	Access key for s3 endpoint
AWS_S3_SIGNATURE_VERSION	S3 signature version (s3v4 or s3)	s3v4
AWS_STORAGE_BUCKET_NAME	Bucket name for s3 endpoint	impress-media-storage
CACHES_DEFAULT_TIMEOUT	Cache default timeout	30
CACHES_DEFAULT_KEY_PREFIX	The prefix used to every cache keys.	docs
COLLABORATION_WS_INACTIVITY_TIMEOUT	Timeout (in seconds) after which the user is considered inactive when there is no activity. The WebSocket is closed after this inactivity period. None means disabled.	None
COLLABORATION_WS_URL	Collaboration websocket url
CONVERSION_API_CONTENT_FIELD	Conversion api content field	content
CONVERSION_API_ENDPOINT	Conversion API endpoint	convert
CONVERSION_API_SECURE	Require secure conversion api	false
CONVERSION_API_TIMEOUT	Conversion api timeout	30
CONVERSION_FILE_MAX_SIZE	The file max size allowed when uploaded to convert it	20971520 (20MB)
CONVERSION_FILE_EXTENSIONS_ALLOWED	Extension list managed by the conversion service	[".docx", ".md"]
CONVERSION_UPLOAD_ENABLED	Enable or not the conversion feature. Without it the endpoint will fail and the logo in the front application will not appear	False
DB_ENGINE	Engine to use for database connections	django.db.backends.postgresql_psycopg2
DB_HOST	Host of the database	localhost
DB_NAME	Name of the database	impress
DB_PASSWORD	Password to authenticate with	pass
DB_PORT	Port of the database	5432
DB_PSYCOPG_POOL_ENABLED	Enable or not the psycopg pool configuration in the default database options	False
DB_PSYCOPG_POOL_MIN_SIZE	The psycopg min pool size	4
DB_PSYCOPG_POOL_MAX_SIZE	The psycopg max pool size	None
DB_PSYCOPG_POOL_TIMEOUT	The default maximum time in seconds that a client can wait to receive a connection from the pool	3
DB_USER	User to authenticate with	dinum
DJANGO_ALLOWED_HOSTS	Allowed hosts	[]
DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS	Celery broker transport options	{}
DJANGO_CELERY_BROKER_URL	Celery broker url	redis://redis:6379/0
DJANGO_CORS_ALLOWED_ORIGINS	List of origins allowed for CORS	[]
DJANGO_CORS_ALLOWED_ORIGIN_REGEXES	List of origins allowed for CORS using regulair expressions	[]
DJANGO_CORS_ALLOW_ALL_ORIGINS	Allow all CORS origins	false
DJANGO_CSRF_TRUSTED_ORIGINS	CSRF trusted origins	[]
DJANGO_EMAIL_BACKEND	Email backend library	django.core.mail.backends.smtp.EmailBackend
DJANGO_EMAIL_BRAND_NAME	Brand name for email
DJANGO_EMAIL_FROM	Email address used as sender	from@example.com
DJANGO_EMAIL_HOST	Hostname of email
DJANGO_EMAIL_HOST_PASSWORD	Password to authenticate with on the email host
DJANGO_EMAIL_HOST_USER	User to authenticate with on the email host
DJANGO_EMAIL_LOGO_IMG	Logo for the email
DJANGO_EMAIL_PORT	Port used to connect to email host
DJANGO_EMAIL_URL_APP	Url used in the email to go to the app
DJANGO_EMAIL_USE_SSL	Use ssl for email host connection	false
DJANGO_EMAIL_USE_TLS	Use tls for email host connection	false
DJANGO_SECRET_KEY	Secret key
DJANGO_SERVER_TO_SERVER_API_TOKENS		[]
DOCSPEC_API_URL	URL to endpoint of DocSpec conversion API
DOCUMENT_IMAGE_MAX_SIZE	Maximum size of document in bytes	10485760
DOCUMENT_ALL_ENDPOINT_ENABLED	Enable or not the endpoint /api/v1.0/documents/all/	true
FRONTEND_CSS_URL	To add a external css file to the app
FRONTEND_JS_URL	To add a external js file to the app
FRONTEND_HOMEPAGE_FEATURE_ENABLED	Frontend feature flag to display the homepage	false
FRONTEND_THEME	Frontend theme to use
JWT_PRIVATE_KEY	PEM encoded RSA private key used to sign the JWT tokens (RS256). Can be read from a file with JWT_PRIVATE_KEY_FILE
JWT_TOKEN_LIFETIME	Lifetime in seconds of the generated JWT tokens. Also used as the cache timeout of these tokens	3600
LANGUAGE_CODE	Default language	en-us
LANGFUSE_SECRET_KEY	The Langfuse secret key used by the sdk	None
LANGFUSE_PUBLIC_KEY	The Langfuse public key used by the sdk	None
LANGFUSE_BASE_URL	The Langfuse base url used by the sdk	None
LASUITE_MARKETING_BACKEND	Backend used when SIGNUP_NEW_USER_TO_MARKETING_EMAIL is True. See https://github.com/suitenumerique/django-lasuite/blob/main/documentation/how-to-use-marketing-backend.md	lasuite.marketing.backends.dummy.DummyBackend
LASUITE_MARKETING_PARAMETERS	The parameters to configure LASUITE_MARKETING_BACKEND. See https://github.com/suitenumerique/django-lasuite/blob/main/documentation/how-to-use-marketing-backend.md	{}
LOGGING_LEVEL_LOGGERS_APP	Application logging level. options are "DEBUG", "INFO", "WARN", "ERROR", "CRITICAL"	INFO
LOGGING_LEVEL_LOGGERS_ROOT	Default logging level. options are "DEBUG", "INFO", "WARN", "ERROR", "CRITICAL"	INFO
LOGIN_REDIRECT_URL	Login redirect url
LOGIN_REDIRECT_URL_FAILURE	Login redirect url on failure
LOGOUT_REDIRECT_URL	Logout redirect url
MALWARE_DETECTION_BACKEND	The malware detection backend use from the django-lasuite package	lasuite.malware_detection.backends.dummy.DummyBackend
MALWARE_DETECTION_PARAMETERS	A dict containing all the parameters to initiate the malware detection backend	{"callback_path": "core.malware_detection.malware_detection_callback",}
MEDIA_BASE_URL
MEDIA_AUTH_ORIGINAL_URL_HEADER	Parameter containing the original request URL, as seen at the media auth endpoint, in CGI/WSGI form (HTTP_HEADER_NAME_ALL_CAPS_WITH_UNDERSCORES)	HTTP_X_ORIGINAL_URL
OIDC_ALLOW_DUPLICATE_EMAILS	Allow duplicate emails	false
OIDC_AUTH_REQUEST_EXTRA_PARAMS	OIDC extra auth parameters	{}
OIDC_CREATE_USER	Create used on OIDC	false
OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION	Fallback to email for identification	true
OIDC_OP_AUTHORIZATION_ENDPOINT	Authorization endpoint for OIDC
OIDC_OP_JWKS_ENDPOINT	JWKS endpoint for OIDC
OIDC_OP_LOGOUT_ENDPOINT	Logout endpoint for OIDC
OIDC_OP_TOKEN_ENDPOINT	Token endpoint for OIDC
OIDC_OP_USER_ENDPOINT	User endpoint for OIDC
OIDC_OP_USER_ENDPOINT_FORMAT	user endpoint format. Values can be AUTO, JSON or JWT	AUTO
OIDC_REDIRECT_ALLOWED_HOSTS	Allowed hosts for OIDC redirect url	[]
OIDC_REDIRECT_REQUIRE_HTTPS	Require https for OIDC redirect url	false
OIDC_RP_CLIENT_ID	Client id used for OIDC	impress
OIDC_RP_CLIENT_SECRET	Client secret used for OIDC
OIDC_RP_SCOPES	Scopes requested for OIDC	openid email
OIDC_RP_SIGN_ALGO	verification algorithm used OIDC tokens	RS256
OIDC_STORE_ID_TOKEN	Store OIDC token	true
OIDC_STORE_ACCESS_TOKEN	If True stores OIDC access token in session.	false
OIDC_STORE_REFRESH_TOKEN	If True stores OIDC refresh token in session.	false
OIDC_STORE_REFRESH_TOKEN_KEY	Key to encrypt refresh token stored in session, must be a valid Fernet key
OIDC_USERINFO_FULLNAME_FIELDS	OIDC token claims to create full name	["first_name", "last_name"]
OIDC_USERINFO_SHORTNAME_FIELD	OIDC token claims to create shortname	first_name
OIDC_USE_NONCE	Use nonce for OIDC	true
POSTHOG_KEY	Posthog key for analytics
POSTHOG_HOST	Posthog host for analytics
REDIS_URL	Cache url	redis://redis:6379/1
SEARCH_INDEXER_BATCH_SIZE	Size of each batch for indexation of all documents	100000
SEARCH_INDEXER_CLASS	Class of the backend for document indexation & search
SEARCH_INDEXER_COUNTDOWN	Minimum debounce delay of indexation jobs (in seconds)	1
SEARCH_INDEXER_QUERY_LIMIT	Maximum number of results expected from search endpoint	50
SEARCH_URL	Find application endpoint for search queries
SEARCH_INDEXER_SECRET	Token required for indexation queries
INDEXING_URL	Find application endpoint for indexation
SENTRY_DSN	Sentry host
SESSION_COOKIE_AGE	duration of the cookie session	606012
SIGNUP_NEW_USER_TO_MARKETING_EMAIL	Register new user to the marketing onboarding. If True, see env LASUITE_MARKETING_* system	False
SILK_ENABLED	Enable the django-silk request/SQL/cProfile profiler and its /silk/ UI. OFF by default; never enable against production with real users. See documentation/profiling.md	False
SILK_PYTHON_PROFILER	When silk is enabled, run a cProfile on each intercepted request	True
SILK_PYTHON_PROFILER_BINARY	Also write each cProfile as a downloadable binary .prof (stored in S3 via the SILKY_STORAGE backend, not the pod filesystem)	True
SILK_INTERCEPT_PERCENT	Percentage of requests silk records (lower it under load)	100
SILK_MAX_RECORDED_REQUESTS	Ring-buffer size: oldest recorded requests are dropped past this	10000
SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK		false
STORAGES_STATICFILES_BACKEND		whitenoise.storage.CompressedManifestStaticFilesStorage
THEME_CUSTOMIZATION_CACHE_TIMEOUT	Cache duration for the customization settings	86400
THEME_CUSTOMIZATION_FILE_PATH	Full path to the file customizing the theme. An example is provided in src/backend/impress/configuration/theme/default.json	BASE_DIR/impress/configuration/theme/default.json
TRASHBIN_CUTOFF_DAYS	Trashbin cutoff	30
TREEBEARD_PATH_COMPUTE_RETRY_MAX_ATTEMPTS	Number of attempts to create a document before failing.	10
USER_OIDC_ESSENTIAL_CLAIMS	Essential claims in OIDC token	[]
USER_ONBOARDING_DOCUMENTS	A list of documents IDs for which a read-only access will be created for new s	[]
USER_ONBOARDING_SANDBOX_DOCUMENT	ID of a template sandbox document that will be duplicated for new users
USER_RECONCILIATION_FORM_URL	URL of a third-party form for user reconciliation requests
YHUB_API_BASE_URL	Base url of the yhub collaboration server REST API
YHUB_API_TIMEOUT	Timeout (in seconds) of the requests to the yhub API	30
YHUB_MIGRATION_TIMEOUT	Timeout (in seconds) of the call replaying the legacy history of one document, which reads every one of its S3 versions	600
YHUB_ORG	yhub organization the documents live in. Must match the YHUB_ORG of the yhub server	docs
Y_PROVIDER_API_BASE_URL	Y Provider url
Y_PROVIDER_API_KEY	Key exempting the calls of the collaboration server from the API throttling, sent as X-Y-Provider-Key. Set the same value on the yhub container

impress-yhub container

These are the environment variables you can set for the impress-yhub container, the collaboration server. It reads none of the backend's settings: what it shares with the backend is repeated here by value. src/yhub-server/README.md documents what each of them changes.

Option	Description	default
PORT	Port the server listens on	3002
REDIS	Required. Redis/Valkey url holding the live state of the documents. Not a cache: it holds what no worker has persisted yet
POSTGRES	Required. Url of the yhub database. Created by npm run init-db, never by the server
REDIS_PREFIX	Namespace of the redis keys, when the instance is shared	yhub
COLLABORATION_BACKEND_BASE_URL	Base url of the Docs backend, which answers who a user is and what they may do with a document	http://app-dev:8000
COLLABORATION_SERVER_ORIGIN	Comma separated list of the origins allowed to open a websocket	http://localhost:3000
Y_PROVIDER_API_KEY	Sent as X-Y-Provider-Key on the calls made to the backend, exempting them from the API throttling. The same value as the backend's	yprovider-api-key
YHUB_ORG	Organization the documents live under. Must match the YHUB_ORG of the backend	docs
YHUB_JWT_PRIVATE_KEY	PEM encoded RSA private key signing the calls made to the backend (RS256). Can be read from a file with YHUB_JWT_PRIVATE_KEY_FILE
YHUB_ROLE	all runs the websockets and the worker in one process, server only the websockets and the routes, worker only the persistence	all
YHUB_TASK_CONCURRENCY	Tasks one worker process claims at once	5
YHUB_TASK_DEBOUNCE_MS	How long an update waits on the redis stream before a worker persists it	10000
YHUB_MIN_MESSAGE_LIFETIME_MS	How long persisted updates stay replayable from redis rather than read back from postgres	60000
SOFT_MIGRATION	Set to "true" to seed a room from the legacy Django/S3 document store the first time it is opened	false
LEGACY_S3_ENDPOINT_URL	Required by SOFT_MIGRATION, endpoint of the legacy media bucket, without a path
LEGACY_S3_ACCESS_KEY_ID	Required by SOFT_MIGRATION, read access to that bucket (or LEGACY_S3_ACCESS_KEY_ID_FILE)
LEGACY_S3_SECRET_ACCESS_KEY	Required by SOFT_MIGRATION, secret of the key above (or LEGACY_S3_SECRET_ACCESS_KEY_FILE)
LEGACY_S3_BUCKET_NAME	Name of the legacy media bucket	impress-media-storage
LEGACY_S3_REGION_NAME	Region of that bucket, when its provider needs one	us-east-1
LEGACY_S3_SIGNATURE_VERSION	How the calls to that bucket are signed, s3v4 or v4	s3v4
YHUB_S3_PERSISTENCE	Set to "true" to write new document blobs to a bucket instead of the yhub database. The YHUB_S3_* settings below attach the bucket whether or not this is on, and must stay in place for as long as it holds anything — see the "Document storage" section of src/yhub-server/README.md	false
YHUB_S3_ENDPOINT_URL	Endpoint of the bucket the blobs live in, without a path. Required as a set with the three below
YHUB_S3_ACCESS_KEY_ID	Read/write/delete access to that bucket, deleting object versions included (or YHUB_S3_ACCESS_KEY_ID_FILE)
YHUB_S3_SECRET_ACCESS_KEY	Secret of the key above (or YHUB_S3_SECRET_ACCESS_KEY_FILE)
YHUB_S3_BUCKET_NAME	Name of that bucket, created on startup when missing
YHUB_S3_REGION_NAME	Region of that bucket, when its provider needs one

impress-y-provider container

These are the environment variables you can set for the impress-y-provider container, the conversion service. It no longer serves the collaboration.

Option	Description	default
PORT	Port the service listens on	4444
COLLABORATION_BACKEND_BASE_URL	Base url of the Docs backend. The JWKS verifying the tokens it is called with is fetched from {this}/api/v1.0/jwks, so it has to reach it	http://app-dev:8000
COLLABORATION_SERVER_ORIGIN	Comma separated list of the allowed origins	http://localhost:3000
COLLABORATION_LOGGING	Set to "true" to log the requests	false
CONVERSION_FILE_MAX_SIZE	Maximum size, in bytes, of a file submitted for conversion	20971520
SENTRY_DSN	Sentry DSN, unset disables it

impress-frontend image

These are the environment variables you can set to build the impress-frontend image.

Depending on how you are building the front-end application, this variable is used in different ways.

If you want to build the Docker image, this variable is used as an argument in the build command.

Example:

docker build -f src/frontend/Dockerfile --target frontend-production --build-arg PUBLISH_AS_MIT=false docs-frontend:latest

If you want to build the front-end application using the yarn build command, you can edit the file src/frontend/apps/impress/.env with the NODE_ENV=production environment variable and modify it. Alternatively, you can use the listed environment variables with the prefix NEXT_PUBLIC_ (for example, NEXT_PUBLIC_PUBLISH_AS_MIT=false).

Example:

cd src/frontend/apps/impress
NODE_ENV=production NEXT_PUBLIC_PUBLISH_AS_MIT=false yarn build

Option	Description	default
API_ORIGIN	backend domain - it uses the current domain if not initialized
SW_DEACTIVATED	To not install the service worker
PUBLISH_AS_MIT	Removes packages whose licences are incompatible with the MIT licence (see below)	true

Packages with licences incompatible with the MIT licence:

• xl-docx-exporter: GPL,
• xl-pdf-exporter: GPL,
• xl-multi-column: GPL.

In .env.development, PUBLISH_AS_MIT is set to false, allowing developers to test Docs with all its features.

⚠️ If you run Docs in production with PUBLISH_AS_MIT set to false make sure you fulfill your BlockNote licensing or subscription obligations.