Self-host open-managed-agents

open-managed-agents README

How to install open-managed-agents

ANTHROPIC_API_KEY, BETTER_AUTH_SECRET, PLATFORM_ROOT_SECRET, SANDBOX_PROVIDER, PUBLIC_BASE_URL, DATABASE_URL, OMA_PORT

How to configure open-managed-agents

• ANTHROPIC_API_KEYRequired for harness turns (any Anthropic-compatible API key).

  Required for harness turns (any Anthropic-compatible API key).

• ANTHROPIC_BASE_URLOptional: point at an Anthropic-compatible proxy. The SDK appends `/messages` to whatever you set, so include `/v1` (provider.ts will append /v1 automatically if missing — but being explicit is clearer).

  Optional: point at an Anthropic-compatible proxy. The SDK appends `/messages` to whatever you set, so include `/v1` (provider.ts will append /v1 automatically if missing — but being explicit is clearer).

• ANTHROPIC_CUSTOM_HEADERSOptional: extra HTTP headers comma-separated. Used when the proxy requires e.g. a sub-module gating header.

  Optional: extra HTTP headers comma-separated. Used when the proxy requires e.g. a sub-module gating header.

• ASANA_OAUTH_CLIENT_ID
• ASANA_OAUTH_CLIENT_SECRET
• AUTH_DISABLEDOptional: bypass auth entirely. Every request becomes tenant_id="default". Use ONLY for local single-user demos. Production must leave this unset.

  Optional: bypass auth entirely. Every request becomes tenant_id="default". Use ONLY for local single-user demos. Production must leave this unset.

• BETTER_AUTH_SECRETAuth secret. Required for prod — sessions are signed with it; sessions don't survive restart if missing. Generate one with: openssl rand -hex 32

  Auth secret. Required for prod — sessions are signed with it; sessions don't survive restart if missing. Generate one with: openssl rand -hex 32

• CLICKUP_OAUTH_CLIENT_ID
• CLICKUP_OAUTH_CLIENT_SECRET
• DATABASE_URLOptional: switch the SQL backend from sqlite (default) to Postgres or MySQL. DATABASE_URL takes precedence over DATABASE_PATH. MySQL support requires MySQL 8.x; its native schema and CAS adapter are selected by URL.

  Optional: switch the SQL backend from sqlite (default) to Postgres or MySQL. DATABASE_URL takes precedence over DATABASE_PATH. MySQL support requires MySQL 8.x; its native schema and CAS adapter are selected by URL.

• DAYTONA_API_KEY
• DAYTONA_API_URL
• E2B_API_KEY
• FEISHU_OAUTH_CLIENT_ID
• FEISHU_OAUTH_CLIENT_SECRET
• GATEWAY_ORIGIN─── Integrations (Linear / GitHub / Slack on self-host) ──────────────── All three are optional. Only set the providers you intend to wire up. When PLATFORM_ROOT_SECRET is unset, the entire integrations write surface (OAuth callbacks, setup pages, webhooks, Linear MCP, GitHub refresh) is disabled — read-side CRUD still works against any pre-seeded rows. Public origin for the integrations gateway (

  ─── Integrations (Linear / GitHub / Slack on self-host) ──────────────── All three are optional. Only set the providers you intend to wire up. When PLATFORM_ROOT_SECRET is unset, the entire integrations write surface (OAuth callbacks, setup pages, webhooks, Linear MCP, GitHub refresh) is disabled — read-side CRUD still works against any pre-seeded rows. Public origin for the integrations gateway (

• GITHUB_CLIENT_ID
• GITHUB_CLIENT_SECRET
• GITHUB_OAUTH_CLIENT_ID
• GITHUB_OAUTH_CLIENT_SECRET
• GOOGLE_CLIENT_IDOptional: account sign-in OAuth. Register callbacks at: ${PUBLIC_BASE_URL}/auth/callback/google ${PUBLIC_BASE_URL}/auth/callback/github A provider is advertised by /auth-info only when both values are set.

  Optional: account sign-in OAuth. Register callbacks at: ${PUBLIC_BASE_URL}/auth/callback/google ${PUBLIC_BASE_URL}/auth/callback/github A provider is advertised by /auth-info only when both values are set.

• GOOGLE_CLIENT_SECRET
• INTEGRATIONS_INTERNAL_TOKENInternal token gating /github/internal/* (refresh-by-vault). Treat as a secret. Required for the session-create credential refresh path to work. Generate with: openssl rand -hex 32

  Internal token gating /github/internal/* (refresh-by-vault). Treat as a secret. Required for the session-create credential refresh path to work. Generate with: openssl rand -hex 32

• LARK_OAUTH_CLIENT_ID
• LARK_OAUTH_CLIENT_SECRET
• LINEAR_OAUTH_CLIENT_IDProvider OAuth client credentials. Each provider's "create app" wizard emits the values; paste them here. CLIENT_SECRETs go through PLATFORM_ROOT_SECRET-derived AES-GCM at rest in the per-app row, but the wrangler-provided env values themselves are operator-owned.

  Provider OAuth client credentials. Each provider's "create app" wizard emits the values; paste them here. CLIENT_SECRETs go through PLATFORM_ROOT_SECRET-derived AES-GCM at rest in the per-app row, but the wrangler-provided env values themselves are operator-owned.

• LINEAR_OAUTH_CLIENT_SECRET
• LITEBOX_CPUS
• LITEBOX_MEMORY_MIB
• MATTER_OMA_TENANT_IDMATTER_PROXY_SECRET= # openssl rand -hex 32; shared by oma-server and matter MATTER_SECRET_KEY= # openssl rand -hex 32; seals Feishu app secrets and GitLab tokens at rest MATTER_OMA_API_KEY= # an API key of the workspace Matter serves (Console → API keys) MATTER_OMA_ENVIRONMENT_ID= # environment chat sessions run in (Console → Environments)

  MATTER_PROXY_SECRET= # openssl rand -hex 32; shared by oma-server and matter MATTER_SECRET_KEY= # openssl rand -hex 32; seals Feishu app secrets and GitLab tokens at rest MATTER_OMA_API_KEY= # an API key of the workspace Matter serves (Console → API keys) MATTER_OMA_ENVIRONMENT_ID= # environment chat sessions run in (Console → Environments)

• MATTER_URL─── Feishu (OpenMatter) — `docker compose --profile feishu up` ───────── Needs PLATFORM_ROOT_SECRET (above): Matter stores each chat's MCP bearer in a Vault.

  ─── Feishu (OpenMatter) — `docker compose --profile feishu up` ───────── Needs PLATFORM_ROOT_SECRET (above): Matter stores each chat's MCP bearer in a Vault.

• MEMORY_S3_ACCESS_KEY
• MEMORY_S3_BUCKET
• MEMORY_S3_ENDPOINTMemory bucket config for remote sandboxes (daytona / e2b). When all four are set, those backends mount the bucket via s3fs at /mnt/_oma_storage and symlink per-store prefixes under /mnt/memory/<storeName>. Without them, mountMemoryStore on remote sandboxes throws — the operator must either provide an s3-compatible store or use litebox, which can use the local LocalFsBlobStore directly.

  Memory bucket config for remote sandboxes (daytona / e2b). When all four are set, those backends mount the bucket via s3fs at /mnt/_oma_storage and symlink per-store prefixes under /mnt/memory/<storeName>. Without them, mountMemoryStore on remote sandboxes throws — the operator must either provide an s3-compatible store or use litebox, which can use the local LocalFsBlobStore directly.

• MEMORY_S3_SECRET_KEY
• OMA_PORTOptional: override the listening port (host side). Defaults to 8787.

  Optional: override the listening port (host side). Defaults to 8787.

• PLATFORM_ROOT_SECRETRequired: at-rest encryption key for credentials.auth and model_cards.api_key_cipher. The Cloudflare worker build refuses to start without it (and the Node self-host is moving the same direction). Generate with: openssl rand -base64 32

  Required: at-rest encryption key for credentials.auth and model_cards.api_key_cipher. The Cloudflare worker build refuses to start without it (and the Node self-host is moving the same direction). Generate with: openssl rand -base64 32

• PUBLIC_BASE_URLPublic base URL — used for cookie domain + OAuth redirect URLs. Defaults to "*" trusted-origins if missing (only OK for local dev).

  Public base URL — used for cookie domain + OAuth redirect URLs. Defaults to "*" trusted-origins if missing (only OK for local dev).

• SANDBOX_IMAGE
• SANDBOX_PROVIDERSandbox provider. Required by deployable Node entrypoints. Only isolated backends are accepted: daytona — Daytona Cloud (managed Linux VM per session). Set DAYTONA_API_KEY (and optionally DAYTONA_API_URL, SANDBOX_IMAGE). litebox — BoxLite local micro-VM (Firecracker per box). Hardware isolation, no daemon. Optional: LITEBOX_MEMORY_MIB, LITEBOX_CPUS, SANDBOX_IMAGE. e2b

  Sandbox provider. Required by deployable Node entrypoints. Only isolated backends are accepted: daytona — Daytona Cloud (managed Linux VM per session). Set DAYTONA_API_KEY (and optionally DAYTONA_API_URL, SANDBOX_IMAGE). litebox — BoxLite local micro-VM (Firecracker per box). Hardware isolation, no daemon. Optional: LITEBOX_MEMORY_MIB, LITEBOX_CPUS, SANDBOX_IMAGE. e2b

• SLACK_OAUTH_CLIENT_ID
• SLACK_OAUTH_CLIENT_SECRET