Artur Mukhamadiev
c853fff995
scripts/make-tls.sh creates a CA whose critical nameConstraints permit only the listed IPv4 addresses (and the .invalid DNS subtree), plus an end-entity server certificate; run-backend.sh passes CONFLUENCE_WEB_TLS_CERT/KEY to uvicorn.
53 lines
2.9 KiB
Plaintext
53 lines
2.9 KiB
Plaintext
# Confluence Research Web UI: backend deployment configuration.
|
|
# Copy to deploy/confluence-web.env (git-ignored) and adjust. Values are read by
|
|
# scripts/run-backend.sh and exported only into the backend process. Nothing in
|
|
# this file is ever passed to the agent container.
|
|
|
|
# --- Confluence (read-only, user PAT is supplied in the browser at query time) ---
|
|
# Approved base origins (comma separated, include context path if any).
|
|
# Include the Confluence context path (collab.lge.com serves REST under /main).
|
|
CONFLUENCE_WEB_APPROVED_ORIGINS=https://collab.lge.com/main
|
|
# Optional outbound proxy for Confluence only (socks5://, socks5h://, http://, https://).
|
|
CONFLUENCE_WEB_CONFLUENCE_PROXY=socks5://127.0.0.1:1560
|
|
# Optional corporate CA bundle (PEM). Leave unset to use the system trust store.
|
|
#CONFLUENCE_WEB_CORPORATE_CA_PATH=/etc/ssl/certs/corporate-ca.pem
|
|
|
|
# --- Model provider (OpenAI-compatible Chat Completions; backend-held key) ---
|
|
CONFLUENCE_WEB_MODEL_PROVIDER=openai
|
|
# llama.cpp server tunnel; the endpoint is the full chat completions URL.
|
|
CONFLUENCE_WEB_MODEL_ENDPOINT=http://127.0.0.1:4901/v1/chat/completions
|
|
# llama-server accepts any bearer token; a real provider needs its real key here.
|
|
CONFLUENCE_WEB_MODEL_API_KEY=llama-cpp
|
|
CONFLUENCE_WEB_MODEL_NAME=Qwen3.6-35B-A3B
|
|
# Provider token limits (separate from the application byte limits in CONTRACTS.md).
|
|
CONFLUENCE_WEB_MODEL_CONTEXT_WINDOW_TOKENS=131072
|
|
CONFLUENCE_WEB_MODEL_MAX_OUTPUT_TOKENS=8192
|
|
# Per-call HTTP timeout; keep below the 180 s query deadline.
|
|
CONFLUENCE_WEB_MODEL_TIMEOUT_SECONDS=170
|
|
|
|
# --- Agent runtime container (rootless Docker) ---
|
|
# Use the exact built tag or, better, the image ID printed by `make build-image`.
|
|
CONFLUENCE_WEB_RUNTIME_IMAGE=confluence-pi-agent:rev1
|
|
# Unique per deployment; startup/periodic reconciliation removes containers with this label value.
|
|
CONFLUENCE_WEB_CONTAINER_LABEL_VALUE=confluence-web-local
|
|
#CONFLUENCE_WEB_DOCKER_HOST=unix:///run/user/1000/docker.sock
|
|
|
|
# --- HTTP / storage ---
|
|
# Loopback only by default. To serve colleagues on an internal network, bind the
|
|
# host's LAN address AND enable TLS below (PATs must not cross the network in clear).
|
|
CONFLUENCE_WEB_BIND_HOST=127.0.0.1
|
|
CONFLUENCE_WEB_BIND_PORT=8000
|
|
# Optional TLS termination by Uvicorn. Generate with: scripts/make-tls.sh <lan-ip>
|
|
# (name-constrained private CA; distribute deploy/tls/ca.crt to colleagues).
|
|
#CONFLUENCE_WEB_TLS_CERT=./deploy/tls/server.crt
|
|
#CONFLUENCE_WEB_TLS_KEY=./deploy/tls/server.key
|
|
# Absolute path to the frontend tree (index.html, css/, js/, vendor/).
|
|
CONFLUENCE_WEB_FRONTEND_DIST_DIR=./frontend
|
|
# Private artifact storage (created 0700; purged on startup).
|
|
CONFLUENCE_WEB_ARTIFACT_DIR=/tmp/confluence_web_artifacts
|
|
CONFLUENCE_WEB_QUERY_TIMEOUT_SECONDS=180
|
|
CONFLUENCE_WEB_CLEANUP_TIMEOUT_SECONDS=10
|
|
|
|
# Never set in production. Substitutes the container, model and Confluence with fakes.
|
|
CONFLUENCE_WEB_DEV_MODE=false
|