Environment Variables

Full reference from .env.example.

Security and JWT

Variable	Default	Description
SECRET_KEY	—	JWT secret (≥32 characters). Required
ALGORITHM	HS256	JWT algorithm
ACCESS_TOKEN_EXPIRE_HOURS	1	Access JWT lifetime (hours)
REFRESH_TOKEN_EXPIRE_DAYS	7	Refresh JWT lifetime (days)
ACCESS_TOKEN_EXPIRE_DAYS	7	Legacy name; use ACCESS_TOKEN_EXPIRE_HOURS

Database and storage

Variable	Default	Description
DATABASE_URL	sqlite:///./medinsight.db	SQLite or PostgreSQL URL
STORAGE_PATH	./storage	Encrypted documents directory

Application

Variable	Default	Description
APP_PORT	8001	uvicorn port
REDIS_HOST_PORT	6380	Redis host port (compose)
ENVIRONMENT	development	development / production
APP_VERSION	1.0.0	Version in /health
CORS_ORIGINS	localhost	Origins comma-separated
DEFAULT_LANGUAGE	en	Default UI/content language
SPACY_MODEL	ru_core_news_lg	spaCy NLP model
LOG_LEVEL	INFO	Log level
LOG_JSON_FORMAT	true	JSON logs
GRACEFUL_SHUTDOWN_TIMEOUT	30	Drain on shutdown (sec)

MEDICAL_ASSISTANT / RAG

Variable	Default	Description
MEDICAL_ASSISTANT_ENABLED	true	Learning modules (tutor, cases, exam, progress)
RAG_ENABLED	true	RAG for the AI tutor
RAG_COLLECTION_NAME	medical_knowledge	Chroma collection
RAG_MODE	local	local / external / hybrid
RAG_EXTERNAL_URL	—	External search API base URL
RAG_EXTERNAL_API_KEY	—	Bearer for external RAG
RAG_EXTERNAL_TIMEOUT_SECONDS	8.0	External search timeout
RAG_HYBRID_LOCAL_WEIGHT	0.5	Local weight in hybrid mode
MOCK_RAG_API_KEY	—	Key for scripts/mock_rag_server.py / profile mock-rag

Traefik / HTTPS (prod)

Variable	Description
DOMAIN	Domain for Let's Encrypt
ACME_EMAIL	Email for ACME

Redis and Celery

Variable	Default	Description
REDIS_URL	redis://redis:6379/0	Celery broker
CELERY_RESULT_BACKEND	redis://redis:6379/1	Result backend

GPT (ProxyAPI)

Variable	Description
OPENAI_API_KEY	ProxyAPI key
OPENAI_BASE_URL	https://api.proxyapi.ru/openai/v1
OPENAI_MODEL	gpt-4o-mini

Multi-tenancy and encryption

Variable	Default	Description
TENANT_MODE	true	Enable multi-tenant
ENCRYPTION_ENABLED	true	File encryption
ENCRYPTION_KEY	—	age key (or via file)
ENCRYPTION_KEY_PATH	secrets/encryption_key.txt	Key file path
SUPER_ADMIN_EMAIL	—	Superadmin email
SUPER_ADMIN_PASSWORD	—	Password (first run)
DEFAULT_TENANT_NAME	Default Clinic	Default tenant name
DEFAULT_TENANT_SUBDOMAIN	default	Default subdomain

Self-healing RAG

Variable	Default	Description
SELF_HEALING_ENABLED	true	Auto-recovery
CHROMA_PERSIST_DIR	./chroma_data	ChromaDB
EMBEDDING_MODEL	all-MiniLM-L6-v2	Embeddings
SIMILARITY_THRESHOLD	0.75	Similarity threshold
MAX_RETRY_ATTEMPTS	2	GPT retry

Webhooks

Variable	Default	Description
WEBHOOK_ENABLED	true	Outbound webhooks
WEBHOOK_TIMEOUT_SECONDS	10	HTTP timeout
WEBHOOK_RETRY_COUNT	3	Retries
WEBHOOK_PUBLIC_BASE_URL	—	Base URL for callbacks

Billing

Variable	Description
BILLING_ENABLED	false = no limits (test)
STRIPE_*	Stripe keys and price IDs
YOOKASSA_*	YooKassa
FREEMIUM_ANALYSIS_LIMIT	5
PRO_ANALYSIS_LIMIT	100
ENTERPRISE_ANALYSIS_LIMIT	999999
PRO_PRICE_RUB/USD	Prices in kopecks/cents

Export

Variable	Default	Description
EXPORT_MAX_ROWS	10000	Excel row limit
EXPORT_MAX_COLUMNS	50	Column limit
EXPORT_TEMP_DIR	./storage/exports	Temp files

Backup

Variable	Default	Description
BACKUP_ENABLED	true	Auto backup
BACKUP_DIR	/backups	Archive directory
BACKUP_RETENTION_DAYS	7	Days
BACKUP_RETENTION_WEEKS	4	Weeks
BACKUP_RETENTION_MONTHS	12	Months
BACKUP_SCHEDULE_FULL	0 2 * * *	Full backup (cron)
BACKUP_SCHEDULE_DB	0 * * * *	DB hourly
BACKUP_ENCRYPTION_ENABLED	false	Archive encryption
BACKUP_ALERT_MAX_AGE_HOURS	48	Alert if no backup

Telegram

Variable	Description
TELEGRAM_BOT_TOKEN	Bot token
TELEGRAM_CHAT_ID	Chat for alerts
TELEGRAM_BOT_ENABLED	false
TELEGRAM_BOT_WEBHOOK_URL	Webhook URL
TELEGRAM_LINK_CODE_TTL	600 sec

UI

Variable	Default	Description
DEFAULT_THEME	light	light / dark / system

DICOM

Variable	Default	Description
DICOM_ENABLED	true	DICOM module
DICOM_MAX_FILE_SIZE_MB	500	Upload limit
DICOM_STORAGE_PATH	./storage/dicom	Storage
DICOM_THUMBNAIL_SIZE	256x256	Thumbnail size

OpenTelemetry

Variable	Description
OTEL_ENABLED	Tracing
OTEL_SERVICE_NAME	medinsight
OTEL_EXPORTER_OTLP_ENDPOINT	Collector URL

WebSocket

Variable	Default	Description
WEBSOCKET_ENABLED	true	Real-time
WEBSOCKET_HEARTBEAT_INTERVAL	30	Heartbeat (sec)
WEBSOCKET_MAX_CONNECTIONS	1000	Connection limit

Rate limiting

Variable	Default	Description
RATE_LIMIT_ENABLED	true	Limits
RATE_LIMIT_LOGIN_PER_MINUTE	10	Login
RATE_LIMIT_REGISTER_PER_HOUR	5	Registration
RATE_LIMIT_RESET_PER_HOUR	3	Password reset

Password policy & login lockout

Variable	Default	Description
PASSWORD_MIN_LENGTH	12	Minimum password length
PASSWORD_REQUIRE_COMPLEXITY	true	Require mixed character classes
PASSWORD_HIBP_CHECK_ENABLED	false	Have I Been Pwned check
LOGIN_LOCKOUT_MAX_ATTEMPTS	5	Failed attempts before lockout
LOGIN_LOCKOUT_DURATION_SECONDS	900	Lockout duration (15 min)

Lockout state is stored in Redis and cleared on successful login.

Two-factor authentication (2FA / TOTP)

Variable	Default	Description
MFA_ENFORCED	true	Enforce 2FA for configured roles
MFA_REQUIRED_ROLES	admin,doctor	Comma-separated roles (tenant may override via settings.mfa_required_roles)

When MFA_ENFORCED=true, super_admin must enable TOTP in production. Set MFA_ENFORCED=false only temporarily for maintenance; recreate containers after changing .env (see Russian doc section).

Email

Variable	Description
SMTP_HOST, SMTP_PORT	SMTP server
SMTP_USER, SMTP_PASSWORD	Auth
SMTP_FROM	From address
EMAIL_ENABLED	Enable email
FRONTEND_URL	Frontend base URL

Example .env.production

SECRET_KEY=$(openssl rand -hex 32)
DATABASE_URL=sqlite:////app/data/medinsight.db
REDIS_URL=redis://redis:6379/0
APP_ENV=production
CORS_ORIGINS=https://fileguardian.com.ru
ENCRYPTION_ENABLED=true
OPENAI_API_KEY=sk-...
FRONTEND_URL=https://fileguardian.com.ru