shaper --help

NAME
  shaper

USAGE
  Version: 0.26.4

  Shaper is a minimal data platform built on top of DuckDB and NATS to create analytics dashboards and embed them into your software.

  All configuration options can be set via command line flags, environment variables or config file.
  All options are optional.

  Environment variables must be prefixed with SHAPER_ and use uppercase letters and underscores.
  For example, --nats-token turns into SHAPER_NATS_TOKEN.
...
FLAGS
  -h, --help                                    show help
  -v, --version                                 show version
      --log-level STRING                        log level: debug, info, warn, error (default: info)
      --addr STRING                             HTTP server address. Not used if --tls-domain is set. In that case, server is automatically listening on the ports 80 and 443. (default: localhost:5454)
  -d, --dir STRING                              directory to store data, by default set to /data in docker container) (default: /root/.shaper)
      --jwt-secret STRING                       Static shared secret for signing and validating JWTs
      --snapshot-s3-bucket STRING               S3 bucket for snapshots (required for snapshots)
  -p, --nats-port INT                           NATS server port. If not specified, NATS will not listen on any port. (default: 0)
      --duckdb STRING                           Override duckdb DSN (default: [--dir]/shaper.duckdb)
      --no-edit                                 Disable editing dashboards via the UI
      --config-file STRING                      path to config file

Config file ./shaper.json not found. Let's create it.

Server URL [Press ENTER to use http://localhost:5454]:
Directory to watch [Press ENTER to use .]:
Saved config to ./shaper.json

--addr STRING          HTTP server address. (default: localhost:5454)
--log-level STRING     log level: debug, info, warn, error (default: info)
--basepath STRING      Base URL the frontend is served from. (default: /)
--cors-domains STRING  Comma-separated list of domains allowed for CORS
--css STRING           CSS string to inject into the frontend
--css-file STRING      Path to CSS file to inject into the frontend (can be reloaded at runtime by sending SIGHUP)
--favicon STRING       path to override favicon. Must end .svg or .ico
--pdf-date-format STRING  Date format for PDF exports, using Go time format (default: 02.01.2006)

-d, --dir STRING                directory to store data (default: /root/.shaper)
--sqlite STRING                 Override sqlite DB file for system state (default: [--dir]/shaper_internal.sqlite)
--duckdb STRING                 Override duckdb DSN (default: [--dir]/shaper.duckdb)
--duckdb-ext-dir STRING         Override DuckDB extension directory (default: ~/.duckdb/extensions/)
--duckdb-secret-dir STRING      Override DuckDB secret directory (default: ~/.duckdb/stored_secrets/)
--allowed-duckdb-extensions STRING  Comma-separated list of allowed DuckDB extensions (e.g. 'httpfs,parquet,json')
--no-duckdb-community-extensions    Disable installing DuckDB community extensions
--init-sql STRING               Execute SQL on startup. Supports environment variables in the format $VAR or ${VAR}
--init-sql-file STRING          Same as init-sql but read SQL from file (default: [--dir]/init.sql)
--deploy STRING                 Directory path containing dashboards and tasks to deploy on startup

shaper --addr 0.0.0.0:5454 --dir /var/lib/shaper --init-sql "CREATE OR REPLACE TABLE sales AS SELECT date '2026-01-01' + INTERVAL (i) DAY AS day, 'channel-' || (i % 3 + 1) AS channel, (random()*1000)::INT AS amount FROM range(90) t(i)"

"tables": [
  {
    "name": "sales",
    "columns": [
      { "name": "day", "type": "TIMESTAMP", "nullable": true },
      { "name": "channel", ...

--jwt-secret STRING     Static shared secret for signing and validating JWTs
--jwtexp DURATION       JWT expiration duration (default: 15m0s)
--sessionexp DURATION   Session expiration duration (default: 720h0m0s)
--inviteexp DURATION    Invite expiration duration (default: 168h0m0s)
--sso-login-url STRING  SSO Login URL to redirect users when authentication is missing or expired
--no-api-keys           Disable API keys

--snapshot-s3-bucket STRING    S3 bucket for snapshots (required for snapshots)
--snapshot-s3-endpoint STRING  S3 endpoint URL (optional, defaults to AWS S3 if not provided)
--snapshot-s3-access-key STRING  S3 access key (optional, can use AWS_ACCESS_KEY_ID environment variable)
--snapshot-s3-secret-key STRING  S3 secret key (optional, can use AWS_SECRET_ACCESS_KEY environment variable)
--snapshot-s3-region STRING    AWS region (optional, can use AWS_REGION environment variable)
--snapshot-time STRING         time to run daily snapshots, format: HH:MM (default: 01:00)
--no-snapshots                 Disable automatic snapshots
--no-auto-restore              Disable automatic restore of latest snapshot on startup

--nats-host STRING     NATS server host (default: 0.0.0.0)
-p, --nats-port INT    NATS server port. If not specified, NATS will not listen on any port. (default: 0)
-t, --nats-token STRING  NATS authentication token
--nats-servers STRING  Use external NATS servers, specify as comma separated list
--nats-max-store STRING  Maximum storage in bytes, set to 0 for unlimited (default: 0)
--nats-js-key STRING   JetStream encryption key
--nats-dir STRING      Override JetStream storage directory (default: [--dir]/nats)
--node-id-file STRING  File to store and lookup node ID (default: [--dir]/node-id.txt)
--stream-prefix STRING Prefix for NATS stream and KV bucket names
--subject-prefix STRING  prefix for NATS subjects. Should probably end with a dot.

--no-edit                        Disable editing dashboards via the UI
--no-tasks                       Disable task functionality
--no-public-sharing              Disable public sharing of dashboards
--no-password-protected-sharing  Disable sharing dashboards protected with a password
--no-ingest                      Disable data ingestion
--no-chrome-sandbox              Disable Chrome sandbox for PDF/PNG generation
--ingest-max-age DURATION        Maximum age of messages in the ingest stream. Set to 0 for indefinite retention (default: 0s)
--state-max-age DURATION         Maximum age of messages in the state stream (default: 0s)
--task-results-max-age DURATION  Maximum age of messages in the task-results stream (default: 0s)
--tmp-dashboards-ttl DURATION    TTL for temporary dashboards (default: 24h0m0s)
--downloads-ttl DURATION         TTL for download intents (default: 10m0s)

--tls-domain STRING   DEPRECATED: Domain name for TLS certificate
--tls-email STRING    DEPRECATED: Email address for Let's Encrypt registration
--tls-cache STRING    DEPRECATED: Path to Let's Encrypt cache directory (default: [--dir]/letsencrypt-cache)
--https-port STRING   DEPRECATED: Overwrite https hostname to not listen on all interfaces

# /etc/shaper/shaper.conf —— Shaper 0.26.4 单机生产基线（16GB 内存 / 200GB SSD）

# —— 服务器基础 ——
addr 0.0.0.0:5454
log-level info
cors-domains dashboard.example.com
pdf-date-format 2006-01-02

# —— 存储与数据 ——
dir /var/lib/shaper
allowed-duckdb-extensions httpfs,parquet,json,postgres
no-duckdb-community-extensions

# —— 认证与会话 ——
jwt-secret q1w2e3r4
sso-login-url https://sso.example.com/shaper-login
sessionexp 24h

# —— 功能开关（纯展示型生产） ——
no-edit
no-tasks

# —— 消息保留（高吞吐摄取防膨胀） ——
ingest-max-age 168h
task-results-max-age 72h

# —— 快照（MinIO 兼容对象存储，凭据经环境变量注入） ——
snapshot-s3-bucket shaper-snapshots
snapshot-s3-endpoint http://10.89.56.10:9000
snapshot-time 02:30

[Service]
Type=simple
Environment=AWS_ACCESS_KEY_ID=shaperbackup
Environment=AWS_SECRET_ACCESS_KEY=q1w2e3r4
Environment=AWS_REGION=us-east-1
ExecStart=/usr/local/bin/shaper --config-file /etc/shaper/shaper.conf
Restart=on-failure
RestartSec=5
LimitNOFILE=65536