mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-24 02:05:11 +08:00
0849ce4022
* fix: prevent X-Forwarded-For bypass of login rate limit * fix: update drift-guard test to include forwarded_allow_ips key --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>
199 lines
6.8 KiB
Plaintext
199 lines
6.8 KiB
Plaintext
# Description: Example of .env file
|
||
# Usage: Copy this file to .env and change the values
|
||
# according to your needs
|
||
# Do not commit .env file to git
|
||
# Do not change .env.example file
|
||
|
||
# Config directory
|
||
# Directory where files, logs and database will be stored
|
||
# Example: LANGFLOW_CONFIG_DIR=~/.langflow
|
||
LANGFLOW_CONFIG_DIR=
|
||
|
||
# Save database in the config directory
|
||
# Values: true, false
|
||
# If false, the database will be saved in Langflow's root directory
|
||
# This means that the database will be deleted when Langflow is uninstalled
|
||
# and that the database will not be shared between different virtual environments
|
||
# Example: LANGFLOW_SAVE_DB_IN_CONFIG_DIR=true
|
||
LANGFLOW_SAVE_DB_IN_CONFIG_DIR=
|
||
|
||
# Database URL
|
||
# Postgres example: LANGFLOW_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/langflow # pragma: allowlist secret
|
||
# SQLite example:
|
||
LANGFLOW_DATABASE_URL=sqlite:///./langflow.db
|
||
|
||
# Alembic logs path flag. If set to true, Alembic will log to stdout.
|
||
LANGFLOW_ALEMBIC_LOG_TO_STDOUT=False
|
||
|
||
# mem0 creates a directory
|
||
# for chat history, vector stores, and other artifacts
|
||
# its default path is ~/.mem0.
|
||
# we can change this path with
|
||
# environment variable "MEM0_DIR"
|
||
# Example: MEM0_DIR=/tmp/.mem0
|
||
|
||
# composio creates a cache directory
|
||
# for file uploads/downloads.
|
||
# its default path is ~/.composio
|
||
# we can change this path with
|
||
# environment variable "COMPOSIO_CACHE_DIR"
|
||
# Example: COMPOSIO_CACHE_DIR=/tmp/.composio
|
||
|
||
|
||
# Database connection retry
|
||
# Values: true, false
|
||
# If true, the database will retry to connect to the database if it fails
|
||
# Example: LANGFLOW_DATABASE_CONNECTION_RETRY=true
|
||
LANGFLOW_DATABASE_CONNECTION_RETRY=false
|
||
|
||
# Cache type
|
||
LANGFLOW_LANGCHAIN_CACHE=SQLiteCache
|
||
|
||
# Server host
|
||
# Example: LANGFLOW_HOST=localhost
|
||
LANGFLOW_HOST=
|
||
|
||
# Worker processes
|
||
# Example: LANGFLOW_WORKERS=1
|
||
LANGFLOW_WORKERS=
|
||
|
||
# Server port
|
||
# Example: LANGFLOW_PORT=7860
|
||
LANGFLOW_PORT=
|
||
|
||
# Logging level
|
||
# Example: LANGFLOW_LOG_LEVEL=critical
|
||
LANGFLOW_LOG_LEVEL=
|
||
|
||
# Path to the log file
|
||
# Example: LANGFLOW_LOG_FILE=logs/langflow.log
|
||
LANGFLOW_LOG_FILE=
|
||
|
||
# Time/Size for log to rotate
|
||
# Example: LANGFLOW_LOG_ROTATION=‘10 MB’/‘1 day’
|
||
LANGFLOW_LOG_ROTATION=
|
||
|
||
# Path to the frontend directory containing build files
|
||
# Example: LANGFLOW_FRONTEND_PATH=/path/to/frontend/build/files
|
||
LANGFLOW_FRONTEND_PATH=
|
||
|
||
# Whether to open the browser after starting the server
|
||
# Values: true, false
|
||
# Example: LANGFLOW_OPEN_BROWSER=true
|
||
LANGFLOW_OPEN_BROWSER=
|
||
|
||
# Whether to remove API keys from the projects saved in the database
|
||
# Values: true, false
|
||
# Example: LANGFLOW_REMOVE_API_KEYS=false
|
||
LANGFLOW_REMOVE_API_KEYS=
|
||
|
||
# Whether to use RedisCache or ThreadingInMemoryCache or AsyncInMemoryCache
|
||
# Values: async, memory, redis
|
||
# Example: LANGFLOW_CACHE_TYPE=memory
|
||
# If you want to use redis then the following environment variables must be set:
|
||
# LANGFLOW_REDIS_HOST (default: localhost)
|
||
# LANGFLOW_REDIS_PORT (default: 6379)
|
||
# LANGFLOW_REDIS_DB (default: 0)
|
||
# LANGFLOW_REDIS_CACHE_EXPIRE (default: 3600)
|
||
LANGFLOW_CACHE_TYPE=
|
||
|
||
# Set LANGFLOW_AUTO_LOGIN to false if you want to disable auto login
|
||
# and use the login form to login. LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD
|
||
# must be set if AUTO_LOGIN is set to false
|
||
# Values: true, false
|
||
LANGFLOW_AUTO_LOGIN=
|
||
|
||
# SET LANGFLOW_ENABLE_SUPERUSER_CLI to false to disable
|
||
# superuser creation via the CLI
|
||
LANGFLOW_ENABLE_SUPERUSER_CLI=
|
||
|
||
# Superuser username
|
||
# Example: LANGFLOW_SUPERUSER=admin
|
||
LANGFLOW_SUPERUSER=
|
||
|
||
# Superuser password
|
||
# Example: LANGFLOW_SUPERUSER_PASSWORD=123456
|
||
LANGFLOW_SUPERUSER_PASSWORD=
|
||
|
||
# API Key Source
|
||
# Controls how API keys are validated for the x-api-key header
|
||
# Values: db, env
|
||
# - db (default): Validates against API keys stored in the database
|
||
# - env: Validates against the LANGFLOW_API_KEY environment variable
|
||
# Example: LANGFLOW_API_KEY_SOURCE=db
|
||
LANGFLOW_API_KEY_SOURCE=
|
||
|
||
# API Key (only used when LANGFLOW_API_KEY_SOURCE=env)
|
||
# The API key to use for authentication when API_KEY_SOURCE is set to 'env'
|
||
# This allows injecting a pre-defined API key via environment variables
|
||
# (useful for Kubernetes Secrets, CI/CD pipelines, etc.)
|
||
# Example: LANGFLOW_API_KEY=your-secure-api-key
|
||
LANGFLOW_API_KEY=
|
||
|
||
# Rate Limiting Configuration
|
||
# Controls rate limiting for login endpoint to prevent brute force attacks
|
||
# LANGFLOW_RATE_LIMIT_PER_MINUTE: Number of login attempts allowed per minute per IP
|
||
# Values: positive integer (default: 5)
|
||
# Example: LANGFLOW_RATE_LIMIT_PER_MINUTE=10
|
||
LANGFLOW_RATE_LIMIT_PER_MINUTE=
|
||
|
||
# LANGFLOW_RATE_LIMIT_STORAGE_URI: Storage backend for rate limit counters
|
||
# Values: memory:// (default, single server) or redis://host:port (production, multiple servers)
|
||
# - memory://: Fast, in-memory storage (not shared between server instances, lost on restart)
|
||
# - redis://localhost:6379: Persistent, shared storage (required for load-balanced deployments)
|
||
# Example: LANGFLOW_RATE_LIMIT_STORAGE_URI=redis://localhost:6379
|
||
LANGFLOW_RATE_LIMIT_STORAGE_URI=
|
||
|
||
# LANGFLOW_RATE_LIMIT_TRUST_PROXY: Trust X-Forwarded-For header for client IP
|
||
# Values: true, false (default: false)
|
||
# When true, uses rightmost X-Forwarded-For IP (the trusted proxy before us)
|
||
# When false, uses direct connection IP (prevents header spoofing in non-proxy deployments)
|
||
#
|
||
# SECURITY WARNING: Only enable if behind a trusted proxy (nginx, load balancer, etc.)
|
||
# This setting controls BOTH the application rate limiter AND uvicorn's proxy header processing.
|
||
# When false (default), uvicorn will NOT trust X-Forwarded-For headers, preventing IP spoofing.
|
||
# When true, uvicorn trusts ALL proxy headers - ensure your proxy is properly configured to
|
||
# prevent client-supplied X-Forwarded-For values from reaching Langflow.
|
||
#
|
||
# Example: LANGFLOW_RATE_LIMIT_TRUST_PROXY=true
|
||
LANGFLOW_RATE_LIMIT_TRUST_PROXY=
|
||
|
||
# Should store environment variables in the database
|
||
# Values: true, false
|
||
LANGFLOW_STORE_ENVIRONMENT_VARIABLES=
|
||
|
||
# SSRF (Server-Side Request Forgery) Protection
|
||
# When enabled, blocks requests to private IP ranges, localhost, and cloud metadata endpoints
|
||
# Values: true, false
|
||
# Default: false (for backward compatibility)
|
||
# Set to true to enable protection against SSRF attacks
|
||
LANGFLOW_SSRF_PROTECTION_ENABLED=
|
||
|
||
# SSRF Allowed Hosts
|
||
# Comma-separated list of hosts/IPs/CIDR ranges to allow despite SSRF protection
|
||
# Supports: exact hostnames, wildcard domains (*.example.com), exact IPs, CIDR ranges
|
||
# Example: LANGFLOW_SSRF_ALLOWED_HOSTS=internal-api.company.local,192.168.1.0/24,*.dev.internal
|
||
# Note: Only takes effect when LANGFLOW_SSRF_PROTECTION_ENABLED=true
|
||
LANGFLOW_SSRF_ALLOWED_HOSTS=
|
||
|
||
# Should enable the MCP composer feature in MCP projects
|
||
# Values: true, false
|
||
# Default: true
|
||
LANGFLOW_MCP_COMPOSER_ENABLED=
|
||
|
||
# STORE_URL
|
||
# Example: LANGFLOW_STORE_URL=https://api.langflow.store
|
||
# LANGFLOW_STORE_URL=
|
||
|
||
# DOWNLOAD_WEBHOOK_URL
|
||
#
|
||
# LANGFLOW_DOWNLOAD_WEBHOOK_URL=
|
||
|
||
# LIKE_WEBHOOK_URL
|
||
#
|
||
# LANGFLOW_LIKE_WEBHOOK_URL=
|
||
|
||
# Value must finish with slash /
|
||
#BACKEND_URL=http://localhost:7860/
|
||
BACKEND_URL=
|