1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43# Upstream agent library repo — target for agent-suggestion issues.
IRIS_UPSTREAM_REPO=https://github.com/EqualifyEverything/equalify-iris
# REQUIRED. Iris has ONE GitHub identity, and this is it: a fine-grained PAT with
# `Issues: read and write` on IRIS_UPSTREAM_REPO and nothing else. The server holds it;
# no caller ever sends a GitHub token. Iris refuses to start without it.
# Make one at github.com/settings/personal-access-tokens/new. Every issue Iris files is
# filed as this account, so nobody gets individual credit — see docs/github-auth.md.
# It expires and nothing renews it; when it does, filing fails and conversions keep working.
IRIS_GITHUB_TOKEN=
# OPTIONAL shared secret every API caller must present, as `Authorization: Bearer <it>`.
# Blank (default): the deployment is OPEN. Anyone who can reach the port can convert
# documents, spend your model budget, and read any session whose id they have — which is
# also what makes the bundled browser app at / work with no setup.
# Set it (`openssl rand -hex 32`) on anything with a public URL. It is NOT a GitHub token
# and it identifies nobody: everyone who presents it reaches the same deployment account.
# Setting it stops the bundled browser app working, since the page holds no credential.
IRIS_API_TOKEN=
# OPTIONAL shared secret for GET /v1/quality — the deployment-wide quality tally
# the weekly quality-report workflow files issues from.
# Blank (default): the endpoint answers 404 and nothing reads the tally.
# To enable, generate a long random value (`openssl rand -hex 32`), set it here, and
# store the same value as the QUALITY_TOKEN repository secret so the workflow can read it.
IRIS_QUALITY_TOKEN=
# OPTIONAL number of reverse proxies in front of Iris — 1 behind a single
# Caddy/nginx (which is what `docker compose up` behind TLS usually means), 2 if a
# CDN sits in front of that. Blank (default) trusts nothing.
# It decides whose address the per-client rate limits count against: unset behind a
# proxy, every caller presents as the proxy and shares one budget (the log warns
# when it sees an X-Forwarded-For while this is blank).
IRIS_TRUST_PROXY=
# Model provider credentials (see docs/models.md). Set the one(s) your config uses.
OPENROUTER_API_KEY=
# Bedrock uses the standard AWS credential chain (env, profile, or IAM role).
# AWS_ACCESS_KEY_ID=
# AWS_SECRET_ACCESS_KEY=
# AWS_REGION=us-east-2