初始化 LibreDesk 本地实例部署仓库

- docker compose 部署：app / db / redis / tls(nginx) / bridge-tools，宿主端口错开避免与本机服务冲突
- bridge-tools 内联进仓库（compose build 路径改为 ./bridge-tools），仓库自包含可部署
- 部署说明 README、crm-new 对照与 bridge-tools 方案文档、备份与隧道脚本
- .gitignore 排除 .env、config.toml、uploads/、tls 私钥/证书、backups/、logs/

config.sample.toml

@@ -0,0 +1,194 @@
+[app]
+# Log level: info, debug, warn, error, fatal
+log_level = "debug"
+# Environment: dev, prod.
+# Setting to "dev" will enable color logging in terminal.
+env = "dev"
+# Whether to automatically check for application updates on start up, app updates are shown as a banner in the admin panel.
+check_updates = true
+# Encryption key. Generate using `openssl rand -hex 16` must be 32 characters long.
+encryption_key = "your-32-char-random-string-here!"
+# Path to a directory with custom static files and templates to override the defaults.
+# The directory structure should mirror the built-in static/ directory.
+# Only the files you provide will be replaced; the rest use built-in defaults.
+# static_dir = "/path/to/custom/static"
+
+# HTTP server.
+[app.server]
+# Address to bind the HTTP server to.
+address = "0.0.0.0:9000"
+# Unix socket path (leave empty to use TCP address instead)
+socket = ""
+# Do NOT disable secure cookies in production environment if you don't know exactly what you're doing!
+disable_secure_cookies = false
+# Session lifetime duration.
+session_lifetime = "9h"
+# Request read and write timeouts.
+read_timeout = "60s"
+write_timeout = "60s"
+# Maximum request body size in bytes (100MB)
+# If you are using proxy, you may need to configure them to allow larger request bodies.
+max_body_size = 104857600
+# Size of the read buffer for incoming requests (also limits max header size).
+read_buffer_size = 65536
+# Keepalive settings.
+keepalive_timeout = "10s"
+
+[auth]
+# Allow users to sign in with their libredesk email and password.
+# Disable this only after configuring and enabling at least one OIDC provider.
+# libredesk automatically keeps local login available when no OIDC provider is enabled to prevent lockout.
+# If an enabled provider is unavailable or misconfigured, set auth.local_login_enabled = true to restore password login.
+local_login_enabled = true
+
+# File upload provider to use, either `fs` or `s3`.
+[upload]
+provider = "fs"
+
+# Filesystem provider.
+[upload.fs]
+# Directory where uploaded files are stored, make sure this directory exists and is writable by the application.
+upload_path = 'uploads'
+# Signed URL expiry duration (e.g., "30m", "1h"). Defaults to 1h if unset.
+expiry = "1h"
+
+# S3 provider.
+[upload.s3]
+# S3 endpoint URL (required only for non-AWS S3-compatible providers like MinIO).
+# Leave empty to use default AWS endpoints.
+url = ""
+
+# AWS S3 credentials, keep empty to use attached IAM roles.
+access_key = ""
+secret_key = ""
+
+# AWS region, e.g., "us-east-1", "eu-west-1", etc.
+region = "ap-south-1"
+# S3 bucket name where files will be stored.
+bucket = "bucket-name"
+# Optional prefix path within the S3 bucket where files will be stored.
+# Example, if set to "uploads/media", files will be stored under that path.
+# Useful for organizing files inside a shared bucket.
+bucket_path = ""
+# S3 signed URL expiry duration (e.g., "30m", "1h")
+expiry = "30m"
+
+# Postgres.
+[db]
+# If running locally, use `localhost`.
+host = "db"
+# Database port, default is 5432.
+port = 5432
+# Update the following values with your database credentials.
+user = "libredesk"
+password = "libredesk"
+database = "libredesk"
+ssl_mode = "disable"
+# Maximum number of open database connections
+max_open = 30
+# Maximum number of idle connections in the pool
+max_idle = 30
+# Maximum time a connection can be reused before being closed
+max_lifetime = "300s"
+
+# Redis.
+[redis]
+# url parameter overrides other redis config options
+# url = "redis://user:password@host:port/db"
+# If running locally, use `localhost:6379`.
+address = "redis:6379"
+user = ""
+password = ""
+db = 0
+
+[message]
+# Number of workers processing outgoing message queue
+outgoing_queue_workers = 10
+# Number of workers processing incoming message queue
+incoming_queue_workers = 10
+# How often to scan for outgoing messages to process, keep it low to process messages quickly.
+message_outgoing_scan_interval = "50ms"
+# Maximum number of messages that can be queued for incoming processing
+incoming_queue_size = 5000
+# Maximum number of messages that can be queued for outgoing processing
+outgoing_queue_size = 5000
+
+[notification]
+# Number of concurrent notification workers
+concurrency = 2
+# Maximum number of notifications that can be queued
+queue_size = 2000
+
+[automation]
+# Number of workers processing automation rules
+worker_count = 10
+# Applies to conversation creation dates. Zero or negative values use 90 days.
+time_trigger_lookback_days = 90
+
+[ai_agent]
+# Number of workers running autonomous AI assistant responses
+worker_count = 10
+# Maximum number of AI assistant response jobs that can be queued
+queue_size = 1000
+# Maximum number of tool calls the assistant can make while working on one reply. (1-20)
+max_steps = 6
+# Conversation messages sent to the model as history. (5-100)
+max_history_messages = 30
+
+[autoassigner]
+# How often to run automatic conversation assignment
+autoassign_interval = "5m"
+
+[webhook]
+# Number of webhook delivery workers
+workers = 5
+# Maximum number of webhook deliveries that can be queued
+queue_size = 10000
+# HTTP timeout for webhook requests
+timeout = "15s"
+
+# SSRF guard for admin-configured outbound URLs (webhooks, OIDC discovery, AI provider and tool calls).
+[ssrf]
+# Block outbound requests to private/loopback/link-local/cloud-metadata IPs.
+# Leave false for self-hosted single-tenant deployments, where internal webhooks,
+# OIDC providers and model endpoints on private IPs are legitimate.
+# Set true for multi-tenant/hosted deployments where those URLs come from untrusted tenants.
+enabled = false
+# CIDR ranges allowed to bypass the guard when enabled, for reaching known internal hosts.
+# Examples: ["10.0.0.0/8", "192.168.1.10/32", "172.16.0.0/12", "fd00::/8"]
+allowed_cidrs = []
+
+[conversation]
+# How often to check for conversations to unsnooze
+unsnooze_interval = "5m"
+# How long to keep drafts before deleting them from the database. (e.g. "360h", "48h")
+draft_retention_duration = "360h"
+# How often to check for offline conversations in database to send continuity emails
+continuity_scan_interval = "5m"
+
+[sla]
+# How often to evaluate SLA compliance for conversations
+evaluation_interval = "5m"
+
+# Per-IP rate limits (requests per minute) for unauthenticated endpoints.
+# Setting enabled = false disables that rule entirely.
+
+# Livechat widget APIs.
+[rate_limit.widget]
+enabled = true
+requests_per_minute = 100
+
+# Login, password reset and other auth endpoints.
+[rate_limit.auth]
+enabled = true
+requests_per_minute = 30
+
+# Public pages and APIs: help center, CSAT, robots.txt/sitemaps.
+[rate_limit.public]
+enabled = true
+requests_per_minute = 100
+
+# Public media downloads (uploaded files, avatars).
+[rate_limit.media]
+enabled = true
+requests_per_minute = 300