1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43# GitHub auth. No scope is requested — Iris is a GitHub App, whose
# `issues: write` comes from installing it on IRIS_UPSTREAM_REPO rather than from
# each user's consent screen.
# Both can be left blank: the service falls back to the bundled GitHub App and
# the device flow, which needs no setup and no secret (like the `gh` CLI).
# Set CLIENT_ID only to use your own GitHub App (register it with device flow
# enabled and user-token expiry off, then install it on your upstream repo).
# CLIENT_SECRET is needed ONLY for the web redirect flow — never commit a real secret.
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
# Upstream agent library repo — target for agent-suggestion issues.
IRIS_UPSTREAM_REPO=https://github.com/EqualifyEverything/equalify-iris
# OPTIONAL override for who authors auto-filed agent-suggestion issues.
# Blank (default): issues are filed as the logged-in user (their token).
# Set to a service-account PAT (needs issue-write access to the upstream repo) to file everything
# under that bot account instead.
IRIS_GITHUB_TOKEN=
# OPTIONAL shared secret for GET /v1/quality — the deployment-wide quality tally
# the weekly quality-report workflow files issues from.
# Blank (default): the endpoint answers 404 and nothing reads the tally.
# To enable, generate a long random value (`openssl rand -hex 32`), set it here, and
# store the same value as the QUALITY_TOKEN repository secret so the workflow can read it.
IRIS_QUALITY_TOKEN=
# OPTIONAL number of reverse proxies in front of Iris — 1 behind a single
# Caddy/nginx (which is what `docker compose up` behind TLS usually means), 2 if a
# CDN sits in front of that. Blank (default) trusts nothing.
# It decides whose address the per-client rate limits count against: unset behind a
# proxy, every caller presents as the proxy and shares one budget (the log warns
# when it sees an X-Forwarded-For while this is blank).
IRIS_TRUST_PROXY=
# Model provider credentials (see docs/models.md). Set the one(s) your config uses.
OPENROUTER_API_KEY=
# Bedrock uses the standard AWS credential chain (env, profile, or IAM role).
# AWS_ACCESS_KEY_ID=
# AWS_SECRET_ACCESS_KEY=
# AWS_REGION=us-east-2