环境变量全表
环境变量是启动时的初始值。部分设置可以在控制台的「运维 → 运行设置」里热改，运行设置会覆盖环境变量而不需要重启。 默认值列来自 internal/config/config.go 里的字面量。显示为空表示该变量没有字面量默认值（例如 MASTER_KEY 必须显式提供）；显示为包限定名（如 time.Minute）表示默认值在代码里是计算得出的。 必填项（ADMIN_TOKEN、MASTER_KEY）由启动校验强制，缺失会让进程直接退出——compose 文件刻意没有兜底凭据。
共 105 个环境变量。
| 变量 | 类型 | 默认值 | 说明 |
|---|---|---|---|
ADMIN_RATE_BURST | 整数 | 50 | — |
ADMIN_RATE_PER_MINUTE | 整数 | 300 | — |
ADMIN_TOKEN | 字符串 | — | — |
ADMIN_TOKENS | 字符串 | — | — |
ADMIN_TOKEN_LOGIN | 字符串 | "" | AdminTokenLogin re-opens the ADMIN_TOKEN-as-password login after the deployment has claimed an owner account. Empty (the default) means the token only works while no owner credential exists, which is what makes the first-run claim close the upgrade path by itself; "break-glass" is the documented recovery hatch for a deployment whose owner forgot the password. |
ADMIN_USERNAME | 字符串 | admin | — |
ALERT_CONFIG_JSON | 字符串 | "" | AlertConfigJSON is the multi-channel alert matrix config (bark/serverchan/ telegram/smtp + cooldown + daily summary flag), JSON-encoded. |
ALERT_DAILY_SUMMARY_INTERVAL_SECONDS | 整数（秒） | 0 | AlertDailySummaryInterval is how often the daily digest runs (0 = off). |
ALERT_SWEEP_INTERVAL_SECONDS | 整数（秒） | 0 | AlertSweepInterval is how often the proactive health sweep runs (0 = off). |
AUDIT_RETENTION_DAYS | 整数 | 90 | — |
AUDIT_RETENTION_ROWS | 整数 | 100000 | — |
BACKUP_DIR | 字符串 | — | — |
BACKUP_RETENTION_COUNT | 整数 | 30 | — |
BALANCE_HISTORY_RETENTION_DAYS | 整数 | 90 | BalanceHistoryRetentionDays and DecisionSnapshotRetentionDays control the other daily maintenance pruners. Zero disables each pruner. |
CHANNEL_AUTO_DISABLE_THRESHOLD | 整数 | 5 | ChannelAutoDisableThreshold: consecutive member failures before a channel is auto-disabled. 0 disables the feature. |
CHANNEL_RETRY_TIMES | 整数 | 1 | ChannelRetryTimes is how many times the same upstream key is re-sent after a retryable failure before moving to the next key/channel. Network errors (transport) fail fast after these retries instead of fanning out across every channel. |
CHECKIN_CRON | 字符串 | 0 8 * * * | — |
CHECKIN_ENABLED | 布尔 | false | — |
CHECKIN_TZ | 字符串 | "" | CheckinTZ is the IANA timezone (e.g. "Asia/Shanghai") the check-in cron is interpreted in. Empty means the process local timezone (UTC in containers). |
COOLDOWN_SECONDS | 整数 | 30 | — |
CORS_ALLOWED_ORIGINS | 字符串 | — | CORSAllowedOrigins opens the downstream /v1 surface to browser callers. Empty means any origin (""), which is the zero-config default; entries are exact origins or ".example.com" subdomain patterns. |
CROSS_CHANNEL_FAILOVER_ENABLED | 布尔 | true | — |
DATA_DIR | 字符串 | ./data | — |
DECISION_SNAPSHOT_RETENTION_DAYS | 整数 | 7 | — |
EXCHANGE_ALLOW_SECRET_EXPORT | 布尔 | true | ExchangeAllowSecretExport gates include_secrets on export (default true for compat). |
FAULT_PROTECTION_ENABLED | 布尔 | true | FaultProtectionEnabled gates fixed cooldown and channel auto-disable. |
HEALTH_HISTORY_RETENTION_DAYS | 整数 | 90 | HealthHistoryRetentionDays bounds channel_health_history rows (default 90). |
HEALTH_SWEEP_CONCURRENCY | 整数 | 4 | HealthSweepConcurrency caps simultaneous probes. |
HEALTH_SWEEP_DEGRADED_MS | 整数 | 2000 | HealthSweepDegradedMs: latency above this grades the channel degraded. |
HEALTH_SWEEP_ENABLED | 布尔 | true | HealthSweepEnabled enables the periodic channel health sweep (jittered probes grading operational/degraded/error with transition alerts). |
HEALTH_SWEEP_INTERVAL_SECONDS | 整数 | 300 | HealthSweepIntervalSeconds is the base probe interval. |
HEALTH_SWEEP_JITTER_SECONDS | 整数 | 30 | HealthSweepJitterSeconds is the per-round random jitter ceiling. |
HEALTH_SWEEP_TIMEOUT_SECONDS | 整数 | 15 | HealthSweepTimeoutSeconds bounds one probe. |
HTTP_ADDR | 字符串 | :4100 | — |
IMAGES_FAILOVER_ENABLED | 布尔 | false | ImagesFailoverEnabled is the deployment default for the opt-in escape hatch on image writes (the console can override it at runtime as images_failover_enabled). The default (false) keeps the rule that a billable generation is never replayed, because the upstream may have accepted and charged it before the failure reached us. When true, only failures that provably preceded generation (429/503/529/530 and outright request rejections) are replayed; 5xx, 504 and timeouts still stop after one attempt. |
IMAGES_FAILOVER_INCLUDE_AMBIGUOUS | 布尔 | false | ImagesFailoverIncludeAmbiguous is the warned tier: with ImagesFailover enabled, also replay 5xx answers other than 504, which may arrive after the picture was generated and billed. 504, transport timeouts, dead streams and empty 2xx stay fatal in both tiers. |
IMAGES_FAILOVER_INCLUDE_UNCERTAIN | 布尔 | false | ImagesFailoverIncludeUncertain is the blunt tier: with ImagesFailover enabled, also replay 504, transport timeouts, streams that died mid-flight and empty 2xx — every case where the upstream may already hold a finished picture and a charge. It is "retry until a picture comes back, and send it to every channel", which is a deliberate trade of a possible duplicate bill for a second attempt. Default false. |
KEEPALIVE_CHECK_INTERVAL_SECONDS | 整数 | 3600 | KeepaliveCheckIntervalSeconds / KeepaliveDefaultIdleDays are the env bootstrap for the hot-reloadable keepalive settings: how often a round asks whether anything is due, and the window used by a site that was never given one. The per-site window itself is data, not configuration — 15 days here and 30 days there is the site's rule, not the deployment's. |
KEEPALIVE_DEFAULT_IDLE_DAYS | 整数 | 15 | — |
MASTER_KEY | 字符串 | "" | — |
MAX_ADMIN_BODY_BYTES | 整数 | — | — |
MAX_HEADER_BYTES | 整数 | — | — |
METRICS_TOKEN | 字符串 | "" | — |
MODEL_CATALOG_SOURCES | 逗号分隔列表 | — | — |
MODEL_CATALOG_SYNC_INTERVAL_HOURS | 整数 | 24 | — |
MODEL_CATALOG_SYNC_PRICES | 布尔 | true | ModelCatalogSyncPrices lets a sync fill in per-1k prices it finds. It only ever fills columns the gateway has left at zero, so an operator's own price always wins; set false to keep every price hand-managed. |
MODEL_CHANGE_AUTO_IGNORE_DAYS | 整数 | 0 | — |
MODEL_CHANGE_RETENTION_DAYS | 整数 | 90 | ModelChangeRetentionDays bounds finished model_changes rows (default 90); ModelChangeAutoIgnoreDays auto-ignores pending removals with no route impact after that many days (0 = off by default). |
OUTBOUND_ALLOW_CIDRS | 逗号分隔 CIDR | — | — |
OUTBOUND_ALLOW_HOSTS | 逗号分隔主机名 | — | — |
OUTBOUND_CONNECT_TIMEOUT_SECONDS | 整数（秒） | 10 | — |
OUTBOUND_HEADER_TIMEOUT_SECONDS | 整数（秒） | 60 | — |
OUTBOUND_IMAGE_HEADER_TIMEOUT_SECONDS | 整数（秒） | 300 | OutboundImageHeaderTimeout is the response-header ceiling for the image endpoints, which are slower by nature and never retried. |
OUTBOUND_MAX_IDLE_CONNS | 整数 | 512 | OutboundMaxIdleConns is the total outbound idle connection ceiling. |
OUTBOUND_MAX_IDLE_CONNS_PER_HOST | 整数 | 64 | OutboundMaxIdleConnsPerHost is the per-upstream-host idle connection ceiling. |
OUTBOUND_TLS_TIMEOUT_SECONDS | 整数（秒） | 10 | — |
PLUGINS_DIR | 字符串 | — | — |
PLUGIN_CATALOG_URL | 字符串 | "" | — |
PLUGIN_MARKET_URLS | 逗号分隔列表 | — | PluginMarketURLs appends extra plugin market registry URLs (comma-separated; the built-in official registry is always included). |
READINESS_TIMEOUT_SECONDS | 整数（秒） | 2 | — |
RECOVERY_PROBE_ENABLED | 布尔 | true | RecoveryProbeEnabled enables the passive-recovery loop for auto-disabled channels. |
RECOVERY_PROBE_INTERVAL_SECONDS | 整数 | 600 | RecoveryProbeIntervalSeconds is the recovery-loop cadence. |
RELAY_MAX_BODY_MB | 整数 | 32 | — |
RELAY_MAX_IMAGE_MB | 整数 | 64 | — |
RELAY_MODEL_RATE_BURST | 整数 | 0 | — |
RELAY_MODEL_RATE_PER_MINUTE | 整数 | 0 | — |
RELAY_RATE_BURST | 整数 | 100 | — |
RELAY_RATE_PER_MINUTE | 整数 | 600 | — |
RETRY_TIMES | 整数 | 2 | — |
ROUTING_CONCURRENCY_AWARE | 布尔 | true | RoutingConcurrencyEnabled enables the in-flight burst guard. |
ROUTING_CONCURRENCY_LIMIT | 整数 | 64 | RoutingConcurrencyLimit is the per-channel in-flight ceiling. |
ROUTING_ERROR_AWARE | 布尔 | true | RoutingErrorAware penalizes channels with a high EWMA failure propensity. |
ROUTING_LATENCY_AWARE | 布尔 | true | RoutingLatencyAware enables latency-weighted channel selection. |
SERVER_IDLE_TIMEOUT_SECONDS | 整数（秒） | 120 | — |
SERVER_READ_HEADER_TIMEOUT_SECONDS | 整数（秒） | 10 | — |
SERVER_READ_TIMEOUT_SECONDS | 整数（秒） | 300 | — |
SERVER_SHUTDOWN_TIMEOUT_SECONDS | 整数（秒） | 15 | — |
SITE_NEWS_INTERVAL_SECONDS | 整数 | 300 | SiteNewsIntervalSeconds is the env bootstrap for the upstream notice-board reader (internal/sitenews; default 300 = 5 minutes). Same contract as the site-probe cadence next door — a hot-reloadable runtime setting — except that the console may also set it to 0, which turns the background reader off rather than falling back here. |
SITE_PROBE_CATALOG_URL | 字符串 | "" | SiteProbeCatalogURL is the third-party monitoring directory the scheduled third-party health snapshot is read from. Empty keeps the shipped default (siteprobe.DefaultCatalogURL). |
SITE_PROBE_INTERVAL_SECONDS | 整数 | 900 | SiteProbeIntervalSeconds / SiteProbeJitterSeconds are the external site-probe collection cadence (defaults 900 + 120). They are the env bootstrap for a hot-reloadable runtime setting, so an operator can speed the round up for sites that publish heartbeats every minute without a restart. |
SITE_PROBE_JITTER_SECONDS | 整数 | 120 | — |
SITE_PROBE_RETENTION_DAYS | 整数 | 7 | SiteProbeRetentionDays bounds external site-probe rounds and their samples (default 7): one row per monitored model per site per round. |
SQLITE_MAX_OPEN_CONNS | 整数 | 4 | SQLiteMaxOpenConns is the SQLite connection-pool ceiling (WAL allows concurrent readers). Default 4; 1 restores the fully serialized behavior. |
STABLE_FIRST_DENOMINATOR | 整数 | 25 | StableFirstDenominator is the draw base (25 = grayscale gets 1/25). |
STABLE_FIRST_ENABLED | 布尔 | false | StableFirstEnabled gates the 1/N grayscale pool. |
STABLE_FIRST_PROMOTE_REQUESTS | 整数 | 100 | StableFirstPromoteRequests is the successful-attempt threshold for automatic promotion out of the grayscale pool. |
STICKY_ENABLED | 布尔 | false | StickyEnabled enables sticky-session routing (same conversation prefers the previously successful channel). |
STICKY_TTL_MINUTES | 整数 | 30 | — |
TRUSTED_PROXY_CIDRS | 逗号分隔 CIDR | — | — |
TRUSTED_SCRAPER_CIDRS | 逗号分隔 CIDR | — | — |
UPDATE_CHECK_ENABLED | 布尔 | true | UpdateCheckEnabled lets the gateway query GitHub for newer releases to power the console update badge. |
WEBDAV_BACKUP_PASSWORD | 字符串 | "" | — |
WEBDAV_CRON | 字符串 | 0 */6 * * * | — |
WEBDAV_MAX_BYTES | 整数 | — | — |
WEBDAV_PASSWORD | 字符串 | "" | — |
WEBDAV_SYNC_ENABLED | 布尔 | false | — |
WEBDAV_UPLOAD_BACKUP_PASSWORD | 字符串 | "" | — |
WEBDAV_UPLOAD_ENABLED | 布尔 | false | — |
WEBDAV_UPLOAD_PASSWORD | 字符串 | "" | — |
WEBDAV_UPLOAD_URL | 字符串 | "" | Upload direction owns its own connection; each WEBDAV_UPLOAD_* falls back to the matching shared variable when unset. |
WEBDAV_UPLOAD_USERNAME | 字符串 | "" | — |
WEBDAV_URL | 字符串 | "" | — |
WEBDAV_USERNAME | 字符串 | "" | — |
WEBHOOK_THROTTLE_SECONDS | 整数 | 300 | WebhookThrottleSeconds coalesces repeated events within the window. |
WEBHOOK_URL | 字符串 | "" | WebhookURL is the operational notification endpoint ("" disables). |
怎么读这张表
- 类型 列决定值的写法：
逗号分隔列表不是 JSON 数组，整数（秒）是秒数而不是 Go duration 字符串。 - 说明 列取自
Config结构体字段的文档注释。本表共 105 个变量，47 个在代码里带注释，其余 58 个显示为———那是代码里的文档缺口，不是生成器失败。 0在多数保留期与阈值项里表示「关闭该功能」，具体见各项说明。