.env.example

# Bootstrap settings only. Everything else is seeded into the database on first
# init and edited from the console afterwards; see docs/design/10-configuration.md.
#
# This file has two halves and the split is not cosmetic. Compose reads it in
# two different ways and only one of them picks this file up on its own:
#
#   * Everything above the line marked BUILD AND COMPOSE reaches the containers
#     through `env_file: ../.env`, whose path compose resolves relative to
#     docker/compose.yml. Copy this file to the repository root as `.env` and
#     those work.
#
#   * Everything below that line is INTERPOLATED into compose.yml itself -
#     image names, the published port, the redis ceiling, the browser pin. That
#     substitution reads `docker/.env` or the shell, NOT the repository root, so
#     a value written there is silently ignored and the built-in default is used
#     instead. Pass them one of these two ways:
#
#         COMPOSE_ENV_FILES=.env docker compose -p dtk -f docker/compose.yml up -d
#         DTK_IMAGE_TAG=5.0.3 docker compose -p dtk -f docker/compose.yml up -d
#
# The failure mode is quiet, which is why it is called out here: an instance
# built without the browser pin comes up healthy and mints nothing.


# ---------------------------------------------------------------------------
# Read by the containers (env_file). These work from the repository root.
# ---------------------------------------------------------------------------

# Generate the secret with: openssl rand -base64 48
# The process refuses to start if it is missing or shorter than 32 characters.
#
# It encrypts every stored cookie jar and proxy URL. Losing it does not lock you
# out of the console - it makes the identity pool unreadable. Back it up with
# the database, not separately from it.
DTK_SECRET_KEY=

POSTGRES_PASSWORD=
REDIS_PASSWORD=

DTK_DATABASE_URL=postgresql+asyncpg://dtk:${POSTGRES_PASSWORD}@postgres:5432/dtk
DTK_REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379/0

# Only with a reverse proxy in front: the address, or comma-separated addresses,
# it connects from. uvicorn then rewrites the peer address from X-Forwarded-For
# for those hops, which is what makes the per-address login failure limit mean
# one caller instead of the whole internet. Leave empty otherwise, and never set
# it to `*`: that would let anyone forge the address. See docker/README.md.
#
# It also decides whether the session cookie gets `Secure`, which is read from
# X-Forwarded-Proto and therefore only trusted from an address listed here. A
# proxy running on the host itself - the usual shape for a tunnel client - is
# 127.0.0.1.
DTK_FORWARDED_ALLOW_IPS=

DTK_LOG_LEVEL=info
DTK_LOG_JSON=true

# The two sidecars, addressed by compose service name on the internal network.
# Both ports are fixed by their containers to match `expose` and the
# healthcheck, so these are the values, not examples: browser-rpc listens on
# 9000 and the downloader on 9100. Getting them wrong fails in a way that reads
# like a network problem - `worker.mint.failed` with "All connection attempts
# failed" - so they are spelled out rather than described.
#
# Empty is a supported deployment, not a degraded one. Without the first,
# automatic minting is off and the pool relies on manual cookie imports; without
# the second, POST /api/v1/downloads answers 501 and says how to turn it on.
# Uncomment the matching one when you run `--profile browser` or
# `--profile downloader`.
DTK_BROWSER_RPC_URL=
# DTK_BROWSER_RPC_URL=http://browser-rpc:9000
DTK_DOWNLOADER_URL=
# DTK_DOWNLOADER_URL=http://downloader:9100

# Optional shared secret for that sidecar. It listens on an internal network no
# other container is on, so this is defence in depth rather than the boundary.
# Generate with: openssl rand -hex 24
DTK_DOWNLOADER_TOKEN=

# Offline FunASR ONNX sidecar. The model path must contain prepared quantized
# asr/, vad/ and punc/ model directories; the container never downloads them.
DTK_TRANSCRIBER_URL=
# DTK_TRANSCRIBER_URL=http://transcriber:9200
DTK_TRANSCRIBER_TOKEN=
DTK_TRANSCRIBER_MODEL_PATH=
DTK_TRANSCRIBER_THREADS=2
DTK_TRANSCRIBER_WORKERS=1
DTK_TRANSCRIBER_QUEUE=8
# Recent terminal jobs kept for worker-restart recovery (minimum: workers + queue).
DTK_TRANSCRIBER_JOB_HISTORY=64
DTK_TRANSCRIBER_PROGRESS_LOG_SECONDS=30
DTK_TRANSCRIBER_TIMEOUT_SECONDS=3600
# fallback or fail
DTK_TRANSCRIBER_NORMALIZATION_FAILURE_POLICY=fallback

# How many files the downloader pulls at once. The first is jobs in parallel,
# the second is files within one job, so the ceiling on concurrent transfers is
# their product. Raise them for a fast connection; they cost goroutines and a
# 32 KiB buffer each, not much else. Lower them on a one- or two-core box, where
# the bottleneck is the CPU the rest of the stack also wants.
DTK_DOWNLOADER_WORKERS=4
DTK_DOWNLOADER_ITEM_WORKERS=4

# How many signing pages the browser container keeps resident, PER PLATFORM.
# Since a signature is only coherent alongside the cookies its page was loaded
# with, a page belongs to one identity at a time: raising this keeps more
# identities warm and avoids a ~4s rebuild when the scheduler rotates to one
# whose page is not resident. It costs memory - roughly 300MB of the container's
# /tmp per page, plus the browser itself - so raise `/tmp` in docker/compose.yml
# alongside it.
DTK_BROWSER_WARM_CONTEXTS=1


# ---------------------------------------------------------------------------
# BUILD AND COMPOSE - interpolated, NOT read from this file's usual location.
#
# Prefix the command with COMPOSE_ENV_FILES=.env, or export them, or put them in
# docker/.env. See the note at the top for why.
# ---------------------------------------------------------------------------

# Where the api container publishes. The default is loopback and serving the
# outside world is meant to be an explicit act - and so is putting TLS in front
# of it, which this stack does not do for you.
DTK_BIND_HOST=127.0.0.1
DTK_BIND_PORT=8000

# Ceiling for the redis container, which holds the queue, the scheduler's
# counters and the response cache. Keep it comfortably under the container's
# mem_limit (512m): once it is reached, keys that carry a TTL are evicted
# oldest-first, and the queue - which carries none - is left alone.
DTK_REDIS_MAXMEMORY=320mb

# Which images to run. The defaults build from this repository, which on a small
# box means compiling the console with npm on the machine that is meant to be
# serving requests. Point them at the published images instead and `pull`:
#
#   DTK_IMAGE=evil0ctal/douyin_tiktok_download_api
#   DTK_IMAGE_TAG=sha-<40-char commit>
#   DTK_DOWNLOADER_IMAGE=evil0ctal/douyin_tiktok_download_api-downloader
#
# A `sha-` tag rather than `latest`: it names one build, so a redeploy is a
# decision rather than whatever was merged since. `pull` is not optional either -
# these services declare both `image` and `build`, so compose builds from source
# whenever the image is not already on the machine.
#
# browser-rpc has no published image on purpose (docker/README.md).
#
# A release tag is written WITHOUT the leading `v`. The git tag is `v5.0.3`; the
# image it publishes is `5.0.3`, because docker/metadata-action's `{{version}}`
# strips the `v`. `DTK_IMAGE_TAG=v5.0.3` asks Docker Hub for something that was
# never pushed, and compose then quietly builds from source instead of failing.
#
DTK_IMAGE=
DTK_IMAGE_TAG=
DTK_DOWNLOADER_IMAGE=

# Which CloakBrowser revision the browser image installs. Read at BUILD time,
# not at run time, and deliberately without a default: several GitHub orgs
# publish identically described "cloakbrowser" repositories, so a floating tag
# would not identify any particular piece of software. An image built with this
# empty contains no browser at all and says so on /rpc/health rather than
# quietly minting synthetic identities no platform accepts.
#
# The value below is the revision this repository has actually been run against
# - CloakBrowser 0.5.10, Chromium 146, verified end to end on 2026-09-08. It is
# here so that a first build has a known-good starting point instead of only an
# error message; change it deliberately, and re-run the live checks in
# docs/design/04-transport-signing.md when you do.
CLOAKBROWSER_COMMIT=f04c23da285b3b3d3cf10c8f9d282e7adc1d52ce
# Defaults to https://github.com/CloakHQ/cloakbrowser; set it only to build from
# a fork. The commit above is meaningless against a different repository.
# CLOAKBROWSER_REPO=