[app]
# Log level: info, debug, warn, error, fatal
log_level = "debug"
# Environment: dev, prod.
# Setting to "dev" will enable color logging in terminal.
env = "dev"
# Whether to automatically check for application updates on start up, app updates are shown as a banner in the admin panel.
check_updates = true
# Encryption key. Generate using `openssl rand -hex 16` must be 32 characters long.
encryption_key = "your-32-char-random-string-here!"
# Path to a directory with custom static files and templates to override the defaults.
# The directory structure should mirror the built-in static/ directory.
# Only the files you provide will be replaced; the rest use built-in defaults.
# static_dir = "/path/to/custom/static"

# HTTP server.
[app.server]
# Address to bind the HTTP server to.
address = "0.0.0.0:9000"
# Unix socket path (leave empty to use TCP address instead)
socket = ""
# Do NOT disable secure cookies in production environment if you don't know exactly what you're doing!
disable_secure_cookies = false
# Session lifetime duration.
session_lifetime = "9h"
# Request read and write timeouts.
read_timeout = "60s"
write_timeout = "60s"
# Maximum request body size in bytes (100MB)
# If you are using proxy, you may need to configure them to allow larger request bodies.
max_body_size = 104857600
# Size of the read buffer for incoming requests (also limits max header size).
read_buffer_size = 65536
# Keepalive settings.
keepalive_timeout = "10s"

[auth]
# Allow users to sign in with their libredesk email and password.
# Disable this only after configuring and enabling at least one OIDC provider.
# libredesk automatically keeps local login available when no OIDC provider is enabled to prevent lockout.
# If an enabled provider is unavailable or misconfigured, set auth.local_login_enabled = true to restore password login.
local_login_enabled = true

# File upload provider to use, either `fs` or `s3`.
[upload]
provider = "fs"

# Filesystem provider.
[upload.fs]
# Directory where uploaded files are stored, make sure this directory exists and is writable by the application.
upload_path = 'uploads'
# Signed URL expiry duration (e.g., "30m", "1h"). Defaults to 1h if unset.
expiry = "1h"

# S3 provider.
[upload.s3]
# S3 endpoint URL (required only for non-AWS S3-compatible providers like MinIO).
# Leave empty to use default AWS endpoints.
url = ""

# AWS S3 credentials, keep empty to use attached IAM roles.
access_key = ""
secret_key = ""

# AWS region, e.g., "us-east-1", "eu-west-1", etc.
region = "ap-south-1"
# S3 bucket name where files will be stored.
bucket = "bucket-name"
# Optional prefix path within the S3 bucket where files will be stored.
# Example, if set to "uploads/media", files will be stored under that path.
# Useful for organizing files inside a shared bucket.
bucket_path = ""
# S3 signed URL expiry duration (e.g., "30m", "1h")
expiry = "30m"

# Postgres.
[db]
# If running locally, use `localhost`.
host = "db"
# Database port, default is 5432.
port = 5432
# Update the following values with your database credentials.
user = "libredesk"
password = "libredesk"
database = "libredesk"
ssl_mode = "disable"
# Maximum number of open database connections
max_open = 30
# Maximum number of idle connections in the pool
max_idle = 30
# Maximum time a connection can be reused before being closed
max_lifetime = "300s"

# Redis.
[redis]
# url parameter overrides other redis config options
# url = "redis://user:password@host:port/db"
# If running locally, use `localhost:6379`.
address = "redis:6379"
user = ""
password = ""
db = 0

[message]
# Number of workers processing outgoing message queue
outgoing_queue_workers = 10
# Number of workers processing incoming message queue
incoming_queue_workers = 10
# How often to scan for outgoing messages to process, keep it low to process messages quickly.
message_outgoing_scan_interval = "50ms"
# Maximum number of messages that can be queued for incoming processing
incoming_queue_size = 5000
# Maximum number of messages that can be queued for outgoing processing
outgoing_queue_size = 5000

[notification]
# Number of concurrent notification workers
concurrency = 2
# Maximum number of notifications that can be queued
queue_size = 2000

[automation]
# Number of workers processing automation rules
worker_count = 10

[ai_agent]
# Number of workers running autonomous AI assistant responses
worker_count = 10
# Maximum number of AI assistant response jobs that can be queued
queue_size = 1000
# Maximum number of tool calls the assistant can make while working on one reply. (1-20)
max_steps = 6
# Conversation messages sent to the model as history. (5-100)
max_history_messages = 30

[autoassigner]
# How often to run automatic conversation assignment
autoassign_interval = "5m"

[webhook]
# Number of webhook delivery workers
workers = 5
# Maximum number of webhook deliveries that can be queued
queue_size = 10000
# HTTP timeout for webhook requests
timeout = "15s"

# SSRF guard for admin-configured outbound URLs (webhooks, OIDC discovery, AI provider and tool calls).
[ssrf]
# Block outbound requests to private/loopback/link-local/cloud-metadata IPs.
# Leave false for self-hosted single-tenant deployments, where internal webhooks,
# OIDC providers and model endpoints on private IPs are legitimate.
# Set true for multi-tenant/hosted deployments where those URLs come from untrusted tenants.
enabled = false
# CIDR ranges allowed to bypass the guard when enabled, for reaching known internal hosts.
# Examples: ["10.0.0.0/8", "192.168.1.10/32", "172.16.0.0/12", "fd00::/8"]
allowed_cidrs = []

[conversation]
# How often to check for conversations to unsnooze
unsnooze_interval = "5m"
# How long to keep drafts before deleting them from the database. (e.g. "360h", "48h")
draft_retention_duration = "360h"
# How often to check for offline conversations in database to send continuity emails
continuity_scan_interval = "5m"

[sla]
# How often to evaluate SLA compliance for conversations
evaluation_interval = "5m"

# Per-IP rate limits (requests per minute) for unauthenticated endpoints.
# Setting enabled = false disables that rule entirely.

# Livechat widget APIs.
[rate_limit.widget]
enabled = true
requests_per_minute = 100

# Login, password reset and other auth endpoints.
[rate_limit.auth]
enabled = true
requests_per_minute = 30

# Public pages and APIs: help center, CSAT, robots.txt/sitemaps.
[rate_limit.public]
enabled = true
requests_per_minute = 100

# Public media downloads (uploaded files, avatars).
[rate_limit.media]
enabled = true
requests_per_minute = 300