Merge branch 'main' of github.com:langflow-ai/openrag into feat-docling-frontier-vlm

Author: mfortman11

.dockerignore

@@ -41,6 +41,7 @@ README.md
 # Logs
 *.log
 logs/
+frontend/tests/logs/
 
 # OS files
 .DS_Store

.env.example

@@ -173,6 +173,26 @@ MICROSOFT_GRAPH_OAUTH_CLIENT_SECRET=
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
 
+# --- IBM Cloud Object Storage connector (Enterprise/SaaS) ------------------
+# Enterprise/SaaS-only bucket connector, gated by IBM_AUTH_ENABLED (like the
+# AWS S3 / Azure Blob connectors). Credentials are normally entered per-connection
+# in the UI; these env vars are OPTIONAL fallbacks / defaults. Two auth modes are
+# supported: IAM (api_key + service_instance_id, default) or HMAC (access key +
+# secret, S3-compatible -- works against MinIO for local testing).
+IBM_COS_ENDPOINT=
+IBM_COS_API_KEY=
+IBM_COS_SERVICE_INSTANCE_ID=
+IBM_COS_HMAC_ACCESS_KEY_ID=
+IBM_COS_HMAC_SECRET_ACCESS_KEY=
+#
+# Local dev / MinIO testing: set OPENRAG_DEV_IBM_COS=true to enable the
+# connector without IBM_AUTH_ENABLED. NEVER use in production.
+# OPENRAG_DEV_IBM_COS=false
+# Frontend counterpart: also set NEXT_PUBLIC_DEV_IBM_COS=true so the Connectors
+# tab and admin Connectors Permission page show IBM COS locally (requires a
+# frontend restart to take effect -- Next.js reads NEXT_PUBLIC_* at startup).
+# NEXT_PUBLIC_DEV_IBM_COS=false
+
 # --- Azure Blob Storage connector (Enterprise/SaaS) ------------------------
 # Enterprise/SaaS-only bucket connector, gated by IBM_AUTH_ENABLED (like the
 # AWS S3 / IBM COS connectors). Credentials are normally entered per-connection
@@ -391,6 +411,12 @@ SESSION_SECRET=
 # - "on_prem": Private Cloud
 OPENRAG_RUN_MODE=oss
 
+# Feature flag for the preview-mode ingest backend (default: false = disabled).
+# When true, the frontend can request preview ingests that show progress and a
+# live index proof without persisting Docling layout JSON. AND-ed with the run
+# mode: preview is only ever available in the "oss" and "saas" run modes above.
+# OPENRAG_INGEST_PREVIEW_ENABLED=false
+
 # Permission/identity cache backend. Only "memory" is currently wired.
 # When CACHE_BACKEND=memory the RBAC permission cache and OAuth-subject
 # cache are per-process, so OpenRAG must run with UVICORN_WORKERS=1 (and