westfarn
093e5462a5
## Summary - Closes Phase 4 of [#62](#62): `evals/suite.json` (≥40 graded questions), `run_evals` management command, and manually-triggered `.gitea/workflows/run-evals.yml`. - Emits versioned WS `status` frames during grounded chat (evaluating / searching / reading_sources / refining / writing) for [chat_web_app#96](ai_ml_operations/chat_web_app#96). - Implements [#63](#63): Redis/Celery optional infra, `AgentRun`/`AgentStep`, tool registry (SSRF-safe `fetch_url`, tenant-scoped docs), LangGraph orchestrator, progress frames, REST `GET/POST /api/agent_runs/…`, gated by `ALLOW_AGENTIC_TASKS` (default off). ## Test plan - [x] `SKIP_RAG_INIT=1 uv run python manage.py test` for evals, ws frames, agent tools, consumers, grounding - [ ] Manual: with `ALLOW_AGENTIC_TASKS=false`, chat identical to today - [ ] Manual: status frames visible in FE with #96 branch - [ ] Manual (GPU): `python manage.py run_evals --runs 3` - [ ] Manual: `ALLOW_AGENTIC_TASKS=true` multi-step research prompt creates AgentRun + framesReviewed-on: #71
149 lines
7.1 KiB
Bash
149 lines
7.1 KiB
Bash
# Server-side secrets for server-infra deploy.
|
|
# Copy to the control node (ai-server-4080 — never commit):
|
|
# ~/Documents/secrets/chat_backend/chat_backend_prod.env
|
|
# ~/Documents/secrets/chat_backend/chat_backend_beta.env (optional)
|
|
#
|
|
# server-infra pushes these to /opt/apps/env/chat_backend_<env>.env on each host at deploy time.
|
|
#
|
|
# Docker Compose: if a secret contains $ (e.g. in DATABASE_URL password), escape each
|
|
# $ as $$ or compose will treat $word as a variable (see "pqv1n variable is not set").
|
|
|
|
# =============================================================================
|
|
# PROD template — ports/hosts for production
|
|
# =============================================================================
|
|
DJANGO_ENV=prod
|
|
DJANGO_DEBUG=false
|
|
# Must NOT be empty, must NOT start with django-insecure, must NOT contain "dev-only".
|
|
# If the secret contains $, escape each as $$ (Compose variable expansion).
|
|
DJANGO_SECRET_KEY=replace-with-a-long-random-secret
|
|
DJANGO_ALLOWED_HOSTS=chatbackend.aimloperations.com
|
|
# Optional override; when unset, https:// origins are derived from DJANGO_ALLOWED_HOSTS.
|
|
# Capacitor WebView origins (https://localhost, capacitor://localhost) are always merged in code.
|
|
# DJANGO_CSRF_TRUSTED_ORIGINS=https://chatbackend.aimloperations.com,https://chat.aimloperations.com
|
|
CORS_ALLOWED_ORIGINS=https://chat.aimloperations.com
|
|
CORS_ORIGIN_ALLOW_ALL=false
|
|
USE_TLS_PROXY=true
|
|
|
|
# Shared external Postgres (10.0.0.230) — prod database
|
|
DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/chat_backend
|
|
|
|
# Host port on adama/roslin/ai-server-4080 (must match server-infra host_apps)
|
|
WEB_PORT=8003
|
|
|
|
# Ollama on GPU host (ai-server-4080). Firewall must allow 10.0.0.0/24 → :11434.
|
|
OLLAMA_BASE_URL=http://10.0.0.128:11434
|
|
# Role-scoped models (#62). After changing OLLAMA_EMBED_MODEL, run:
|
|
# python manage.py reindex_embeddings
|
|
OLLAMA_MODEL=gpt-oss:20b
|
|
OLLAMA_MODEL_THINKING=gpt-oss:20b
|
|
OLLAMA_MODEL_FAST=gemma4:latest
|
|
OLLAMA_MODEL_UTILITY=llama3.2
|
|
OLLAMA_EMBED_MODEL=nomic-embed-text
|
|
OLLAMA_NUM_CTX_THINKING=16384
|
|
OLLAMA_NUM_CTX_FAST=8192
|
|
|
|
# Web search (#62) — self-hosted SearxNG (recommended). DDGS is automatic failover.
|
|
ALLOW_INTERNET_ACCESS=true
|
|
SEARCH_PROVIDER=searxng
|
|
SEARCH_FAILOVER_PROVIDER=ddgs
|
|
# Point at the SearxNG container/service on the LAN (see README "SearxNG").
|
|
SEARXNG_BASE_URL=http://10.0.0.128:8088
|
|
|
|
# Email (SMTP2GO)
|
|
EMAIL_HOST=mail.smtp2go.com
|
|
EMAIL_HOST_USER=replace-with-smtp-user
|
|
EMAIL_HOST_PASSWORD=replace-with-smtp-password
|
|
EMAIL_PORT=2525
|
|
EMAIL_USE_TLS=true
|
|
|
|
# Captcha
|
|
CAPTCHA_SECRET_KEY=replace-with-captcha-secret
|
|
|
|
# Self-serve account registration (sign-up). Keep false until ready to open
|
|
# public registration; set true in chat_backend_prod.env / chat_backend_beta.env.
|
|
ENABLE_ACCOUNT_REGISTRATION=false
|
|
|
|
# OAuth SSO — Google / Microsoft (#24). Never commit real secrets.
|
|
# Register redirect URIs:
|
|
# https://chatbackend.aimloperations.com/api/auth/oauth/google/callback/
|
|
# https://chatbackend.aimloperations.com/api/auth/oauth/microsoft/callback/
|
|
# Same client id/secret pair covers Drive linking (#47); no extra IdP app
|
|
# registration needed, but do register the Drive/Graph API + consent screen
|
|
# scopes below in each console (incremental scopes requested at intent time):
|
|
# Google: openid email profile https://www.googleapis.com/auth/drive.readonly
|
|
# Microsoft: openid email profile offline_access Files.Read (personal)
|
|
# openid email profile offline_access Files.Read.All Sites.Read.All (company)
|
|
GOOGLE_OAUTH_CLIENT_ID=
|
|
GOOGLE_OAUTH_CLIENT_SECRET=
|
|
MICROSOFT_OAUTH_CLIENT_ID=
|
|
MICROSOFT_OAUTH_CLIENT_SECRET=
|
|
MICROSOFT_OAUTH_TENANT=common
|
|
OAUTH_CALLBACK_BASE_URL=https://chatbackend.aimloperations.com
|
|
|
|
# Drive / RAG sync (#47-#53) — gated by SubscriptionPlan.allows_rag.
|
|
# Register provider push notifications (Google Drive `watch`, Microsoft
|
|
# Graph subscriptions) against:
|
|
# https://chatbackend.aimloperations.com/api/drive/webhooks/google/
|
|
# https://chatbackend.aimloperations.com/api/drive/webhooks/microsoft/
|
|
# Scheduled sync (cron / server-infra job): `python manage.py sync_drive_connections`
|
|
|
|
# Stripe / monetization
|
|
STRIPE_SECRET_KEY=replace-with-stripe-secret-key
|
|
STRIPE_PUBLISHABLE_KEY=replace-with-stripe-publishable-key
|
|
STRIPE_WEBHOOK_SECRET=replace-with-stripe-webhook-secret
|
|
REVENUECAT_WEBHOOK_SECRET=replace-with-revenuecat-webhook-auth-token
|
|
# REVENUECAT_PRODUCT_PLAN_MAP={"hesychia_founders_monthly":"founders"}
|
|
# Optional: pre-created Stripe Price ID. When empty, Checkout uses
|
|
# SUBSCRIPTION_PRICE_* from settings.py ($10 USD / month by default).
|
|
STRIPE_PRICE_ID=
|
|
FRONTEND_BASE_URL=https://chat.aimloperations.com
|
|
# STRIPE_CHECKOUT_SUCCESS_URL=https://chat.aimloperations.com/billing/success?session_id={CHECKOUT_SESSION_ID}
|
|
# STRIPE_CHECKOUT_CANCEL_URL=https://chat.aimloperations.com/billing/cancel
|
|
# STRIPE_PORTAL_RETURN_URL=https://chat.aimloperations.com/account/
|
|
|
|
# Agentic task execution (#63). Keep false until Redis/Celery worker + Ollama
|
|
# capacity are confirmed on this host; false = identical behavior to #62.
|
|
ALLOW_AGENTIC_TASKS=false
|
|
# Shared Redis (channel layer fan-out across gunicorn/uvicorn workers +
|
|
# Celery broker for agent runs). Point both at the same instance.
|
|
# REDIS_URL=redis://10.0.0.128:6379/0
|
|
# CELERY_BROKER_URL=redis://10.0.0.128:6379/0
|
|
# OLLAMA_MODEL_ORCHESTRATOR=gpt-oss:20b
|
|
# OLLAMA_MODEL_SUBAGENT=llama3.2
|
|
# AGENT_MAX_PLAN_STEPS=8
|
|
# AGENT_MAX_ITERATIONS=12
|
|
# AGENT_WALL_CLOCK_SECONDS=600
|
|
# AGENT_SUBAGENT_CONCURRENCY=3
|
|
# Start the worker (server-infra): docker compose --profile agentic up -d worker
|
|
|
|
# Gunicorn / ASGI (UvicornWorker for WebSockets)
|
|
GUNICORN_WORKERS=2
|
|
GUNICORN_BIND=0.0.0.0:8000
|
|
|
|
# =============================================================================
|
|
# BETA overrides (use separate file: chat_backend_beta.env)
|
|
# Control node: ~/Documents/secrets/chat_backend/chat_backend_beta.env
|
|
# Infra: server-infra#7 (host_apps beta :8013, Postgres chat_backend_beta, NPM)
|
|
# =============================================================================
|
|
# DJANGO_ENV=beta
|
|
# DJANGO_DEBUG=false
|
|
# DJANGO_SECRET_KEY=replace-with-a-different-beta-secret
|
|
# DJANGO_ALLOWED_HOSTS=beta.chatbackend.aimloperations.com
|
|
# Optional; when unset, https:// origins are derived from DJANGO_ALLOWED_HOSTS.
|
|
# DJANGO_CSRF_TRUSTED_ORIGINS=https://beta.chatbackend.aimloperations.com,https://beta.chat.aimloperations.com
|
|
# CORS_ALLOWED_ORIGINS=https://beta.chat.aimloperations.com
|
|
# CORS_ORIGIN_ALLOW_ALL=false
|
|
# USE_TLS_PROXY=true
|
|
# DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/chat_backend_beta
|
|
# WEB_PORT=8013
|
|
# OLLAMA_BASE_URL=http://10.0.0.128:11434
|
|
# OAUTH_CALLBACK_BASE_URL=https://beta.chatbackend.aimloperations.com
|
|
# FRONTEND_BASE_URL=https://beta.chat.aimloperations.com
|
|
# Register beta OAuth redirect URIs in each IdP console:
|
|
# https://beta.chatbackend.aimloperations.com/api/auth/oauth/google/callback/
|
|
# https://beta.chatbackend.aimloperations.com/api/auth/oauth/microsoft/callback/
|
|
#
|
|
# Tianji: backend does not load tracker.js. Beta SPA uses a distinct website ID
|
|
# (chat_web_app .env.beta REACT_APP_TIANJI_WEBSITE_ID). Ensure CORS allows the
|
|
# beta frontend origin so Tianji-instrumented pages can call this API.
|