---
#==============================================================#
# File : insforge.yml
# Desc : pigsty config for running 1-node insforge app
# Ctime : 2026-03-10
# Mtime : 2026-10-08
# Docs : https://pigsty.io/docs/app/insforge
# License : Apache-2.0 @ https://pigsty.io/docs/about/license/
# Copyright : 2018-2026 Ruohang Feng / Vonng ([email protected])
#==============================================================#
# InsForge: Open-source Backend-as-a-Service for AI coding agents
# GitHub: https://github.com/InsForge/InsForge
# Target InsForge Version: v2.3.3
# Runtime validated: v2.3.3 on 2026-10-08 (isolated M3 VM, external PG18, amd64)
# Historical runtime validation: v2.3.1 on 2026-08-27 (Pigsty PG18, arm64)
#
# how to use this template:
#
# curl -fsSL https://repo.pigsty.io/get | bash; cd ~/pigsty
# ./bootstrap # prepare local repo & ansible
# ./configure -c app/insforge # use this insforge config template
# vi pigsty.yml # IMPORTANT: CHANGE CREDENTIALS!!
# ./infra.yml # create the CA and initialize infrastructure first
# ./node.yml -l pg-meta # provision the PostgreSQL nodes
# ./pgsql.yml -l pg-meta -t pg_install # install PostgreSQL packages, without initializing
# # On EACH PostgreSQL node install make, gcc, curl, patch, and matching PG development headers,
# # then run the helper (Debian example; see app/insforge/README.md for RPM systems):
# sudo env PG_CONFIG=/usr/lib/postgresql/18/bin/pg_config bash app/insforge/pgutils/install.sh
# ./deploy.yml # install pigsty & pgsql, with insforge_pg_utils preloaded
# ./docker.yml # install docker & docker-compose
# ./app.yml # install insforge with docker-compose
#
# To replace domain name:
# sed -ie 's/isf.pigsty/isf.yourdomain.com/g' pigsty.yml
all:
children:
# the insforge application
insforge:
hosts: { 10.10.10.10: {} }
vars:
app: insforge # specify app name to be installed (in the apps)
apps: # define all applications
insforge: # app name, should have corresponding ~/pigsty/app/insforge folder
conf: # override /opt/insforge/.env config file
# secrets (CHANGE THESE!)
JWT_SECRET: your-secret-key-here-must-be-32-char-or-above
ENCRYPTION_KEY: your-encryption-key-here-must-be-32-char-or-above
ROOT_ADMIN_USERNAME: [email protected]
ROOT_ADMIN_PASSWORD: pigsty
# legacy aliases for older InsForge images
ADMIN_EMAIL: [email protected]
ADMIN_PASSWORD: pigsty
# database credentials (must match pg_users below)
POSTGRES_HOST: 10.10.10.10
POSTGRES_PORT: 5432
POSTGRES_DB: insforge
POSTGRES_USER: dbuser_insforge
POSTGRES_PASSWORD: DBUser.Insforge
# optional: image overrides, useful when ghcr.io is slow or blocked
#INSFORGE_IMAGE: ghcr.io/insforge/insforge-oss:v2.3.3
#DENO_RUNTIME_IMAGE: denoland/deno:alpine-2.0.6
# optional: LLM model gateway via OpenRouter
#OPENROUTER_API_KEY: sk-or-xxxxx
#MAX_COMPLETION_TOKENS: 16384
# optional: MCP / Cloud API access
#ACCESS_API_KEY: ik_xxxxx
#ACCESS_ANON_KEY: anon_xxxxx
#CLOUD_API_HOST: https://api.insforge.dev
# optional: object storage / CDN
#AWS_ACCESS_KEY_ID:
#AWS_SECRET_ACCESS_KEY:
#AWS_REGION:
#AWS_S3_BUCKET:
#S3_ACCESS_KEY_ID:
#S3_SECRET_ACCESS_KEY:
#S3_ENDPOINT_URL:
#S3_FORCE_PATH_STYLE: true
#AWS_CONFIG_BUCKET:
#AWS_CONFIG_REGION:
#AWS_CLOUDFRONT_URL:
#AWS_CLOUDFRONT_KEY_PAIR_ID:
#AWS_CLOUDFRONT_PRIVATE_KEY:
#MAX_FILE_SIZE:
#MAX_JSON_BODY_SIZE: 100mb
#MAX_URLENCODED_BODY_SIZE: 10mb
# optional: Deno edge functions
#DENO_DEPLOY_TOKEN:
#DENO_DEPLOY_ORG_ID:
#FUNCTIONS_DOMAIN:
# legacy aliases for older InsForge images
#DENO_SUBHOSTING_TOKEN:
#DENO_SUBHOSTING_ORG_ID:
# optional: site deployment / compute
#VERCEL_TOKEN:
#VERCEL_TEAM_ID:
#VERCEL_PROJECT_ID:
#FLY_API_TOKEN:
#FLY_ORG:
#COMPUTE_DOMAIN:
# optional: payments
#STRIPE_TEST_SECRET_KEY:
#STRIPE_LIVE_SECRET_KEY:
#RAZORPAY_TEST_KEY_ID:
#RAZORPAY_TEST_KEY_SECRET:
#RAZORPAY_LIVE_KEY_ID:
#RAZORPAY_LIVE_KEY_SECRET:
# optional: managed / hybrid cloud metadata
#DEPLOYMENT_ID:
#PROJECT_ID:
#APP_KEY:
#INSFORGE_TELEMETRY_DISABLED: 1
# optional: OAuth providers
#GOOGLE_CLIENT_ID:
#GOOGLE_CLIENT_SECRET:
#GITHUB_CLIENT_ID:
#GITHUB_CLIENT_SECRET:
pg-meta:
hosts: { 10.10.10.10: { pg_seq: 1, pg_role: primary } }
vars:
pg_cluster: pg-meta
pg_users:
- { name: dbuser_insforge ,password: DBUser.Insforge ,pgbouncer: true ,roles: [dbrole_admin] ,superuser: true ,comment: 'insforge superuser' }
- { name: anon ,login: false ,comment: 'insforge anonymous role for PostgREST' }
- { name: authenticated ,login: false ,comment: 'insforge authenticated role' }
- { name: project_admin ,login: false ,bypassrls: true ,comment: 'insforge project admin with RLS bypass' }
pg_databases:
- name: insforge
owner: dbuser_insforge
baseline: insforge.sql
extensions: [pgcrypto, http, pg_cron]
comment: InsForge BaaS database
# Install app/insforge/pgutils/install.sh on every PG node before initialization.
pg_libs: 'pg_cron, insforge_pg_utils, pg_stat_statements, auto_explain'
pg_parameters:
cron.database_name: insforge
# Execute jobs as background workers; no passwordless loopback HBA is needed.
cron.use_background_workers: true
app.encryption_key: your-encryption-key-here-must-be-32-char-or-above
insforge.policy_grant_role: project_admin
insforge.extension_grant_role: project_admin
insforge.policy_grant_tables: 'storage.objects,realtime.channels,realtime.messages,payments.stripe_checkout_sessions,payments.stripe_customer_portal_sessions,payments.razorpay_orders,payments.razorpay_subscriptions'
insforge.internal_schemas: 'ai,auth,compute,deployments,email,functions,memory,payments,realtime,schedules,storage,system'
pg_extensions: [ pg_cron, pg_http ]
pg_hba_rules:
- { user: dbuser_insforge ,db: all ,addr: 172.16.0.0/12 ,auth: pwd ,title: 'allow insforge access from local docker networks' }
pg_crontab: [ '00 01 * * * /pg/bin/pg-backup full' ] # make a full backup every 1am
infra: { hosts: { 10.10.10.10: { infra_seq: 1 } } }
etcd: { hosts: { 10.10.10.10: { etcd_seq: 1 } }, vars: { etcd_cluster: etcd } }
#minio: { hosts: { 10.10.10.10: { minio_seq: 1 } }, vars: { minio_cluster: minio } }
vars: # global variables
version: v4.5.0 # pigsty version string
admin_ip: 10.10.10.10 # admin node ip address
region: default # upstream mirror region: default|china|europe
node_tune: oltp # node tuning specs: oltp,olap,tiny,crit
pg_conf: oltp.yml # pgsql tuning specs: {oltp,olap,tiny,crit}.yml
docker_enabled: true # enable docker on app group
#docker_registry_mirrors: ["https://docker.1panel.live","https://docker.1ms.run","https://docker.xuanyuan.me","https://registry-1.docker.io"]
proxy_env: # global proxy env when downloading packages & pull docker images
no_proxy: "localhost,127.0.0.1,10.0.0.0/8,192.168.0.0/16,*.pigsty,*.aliyun.com,mirrors.*,*.tsinghua.edu.cn"
#http_proxy: 127.0.0.1:12345 # add your proxy env here for downloading packages or pull images
#https_proxy: 127.0.0.1:12345 # usually the proxy is format as http://user:[email protected]
#all_proxy: 127.0.0.1:12345
infra_portal: # domain names and upstream servers
home : { domain: i.pigsty }
insforge: # nginx server config for insforge
domain: isf.pigsty # REPLACE WITH YOUR OWN DOMAIN!
endpoint: "10.10.10.10:7130" # insforge API+dashboard endpoint: IP:PORT
websocket: true # add websocket support
certbot: isf.pigsty # certbot cert name, apply with `make cert`
repo_enabled: false
node_repo_modules: node,infra,pgsql
pg_version: 18
#----------------------------------------------#
# PASSWORD : https://pigsty.io/docs/setup/security/
#----------------------------------------------#
grafana_admin_password: pigsty
grafana_view_password: DBUser.Viewer
pg_admin_password: DBUser.DBA
pg_monitor_password: DBUser.Monitor
pg_replication_password: DBUser.Replicator
patroni_password: Patroni.API
haproxy_admin_password: pigsty
minio_secret_key: S3User.MinIO
etcd_root_password: Etcd.Root
...