LightRAG/.env.example at main · render-examples/LightRAG · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# LightRAG on Render — environment variables
# Copy to .env (gitignored) and fill in the REQUIRED values. Everything under
# OPTIONAL already has a working default — override only if you need to.
# Every advanced option lives in env.example.

# ┌──────────────────────────────────────────────────────────┐
# │ REQUIRED — set all three                                  │
# └──────────────────────────────────────────────────────────┘
LIGHTRAG_API_KEY=your-strong-secret-here   # protects the server + Web UI; generate with: openssl rand -base64 32
LLM_BINDING_API_KEY=sk-...                 # OpenAI key; a Restricted key needs only Chat completions + Embeddings capabilities
EMBEDDING_BINDING_API_KEY=sk-...           # same OpenAI API key

# ┌──────────────────────────────────────────────────────────┐
# │ OPTIONAL — defaults shown; change only if you need to     │
# └──────────────────────────────────────────────────────────┘

# Server
HOST=0.0.0.0
PORT=9621
WORKING_DIR=/app/data/rag_storage   # knowledge graph + vector store (on the Render disk)
INPUT_DIR=/app/data/inputs          # uploaded documents

# LLM (OpenAI; swap provider via LLM_BINDING)
LLM_BINDING=openai
LLM_BINDING_HOST=https://api.openai.com/v1
LLM_MODEL=gpt-5.4-mini

# Embeddings (OpenAI; swap provider via EMBEDDING_BINDING)
EMBEDDING_BINDING=openai
EMBEDDING_BINDING_HOST=https://api.openai.com/v1
EMBEDDING_MODEL=text-embedding-3-large
EMBEDDING_DIM=3072                  # must match EMBEDDING_MODEL's output dimension

# CORS: on Render, render.yaml defaults this to the service's own origin. Set an
# explicit allowlist only for a SEPARATE-origin frontend; never "*" with cookies.
# CORS_ORIGINS=https://your-frontend.example.com

# DEMO mode: run as a PUBLIC, READ-ONLY demo. When true, authentication is
# disabled (Web UI loads with no key prompt; LIGHTRAG_API_KEY is ignored) and
# all uploads/inserts/edits/deletes are blocked — visitors can only browse and
# query. Provider keys above are still required (real queries run on your key).
# DEMO=false
# Per-IP cap (per 60s) on LLM query endpoints while DEMO=true; 0 disables.
# DEMO_RATE_LIMIT_PER_MINUTE=20
# Trusted proxy hops in front of the app; the limiter reads X-Forwarded-For
# this many entries from the right. Default 1 (Render's edge). Bump if behind
# an extra proxy (e.g. Cloudflare → Render = 2).
# DEMO_TRUSTED_PROXY_HOPS=1