westfarnandCursor
c21f052d5b
Image uploads were treated as unknown documents and never shown to the model. PNG, JPEG, WebP, and GIF now go to Ollama vision, and history returns the image bytes. Co-authored-by: Cursor <cursoragent@cursor.com>
157 lines
7.4 KiB
Bash
157 lines
7.4 KiB
Bash
# Server-side secrets for server-infra deploy.
|
|
# Copy to the control node (ai-server-4080 — never commit):
|
|
# ~/Documents/secrets/chat_backend/chat_backend_prod.env
|
|
# ~/Documents/secrets/chat_backend/chat_backend_beta.env (optional)
|
|
#
|
|
# server-infra pushes these to /opt/apps/env/chat_backend_<env>.env on each host at deploy time.
|
|
#
|
|
# Docker Compose: if a secret contains $ (e.g. in DATABASE_URL password), escape each
|
|
# $ as $$ or compose will treat $word as a variable (see "pqv1n variable is not set").
|
|
|
|
# =============================================================================
|
|
# PROD template — ports/hosts for production
|
|
# =============================================================================
|
|
DJANGO_ENV=prod
|
|
DJANGO_DEBUG=false
|
|
# Must NOT be empty, must NOT start with django-insecure, must NOT contain "dev-only".
|
|
# If the secret contains $, escape each as $$ (Compose variable expansion).
|
|
DJANGO_SECRET_KEY=replace-with-a-long-random-secret
|
|
DJANGO_ALLOWED_HOSTS=chatbackend.aimloperations.com
|
|
# Optional override; when unset, https:// origins are derived from DJANGO_ALLOWED_HOSTS.
|
|
# Capacitor WebView origins (https://localhost, capacitor://localhost) are always merged in code.
|
|
# DJANGO_CSRF_TRUSTED_ORIGINS=https://chatbackend.aimloperations.com,https://chat.aimloperations.com
|
|
CORS_ALLOWED_ORIGINS=https://chat.aimloperations.com
|
|
CORS_ORIGIN_ALLOW_ALL=false
|
|
USE_TLS_PROXY=true
|
|
|
|
# Shared external Postgres (10.0.0.230) — prod database
|
|
DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/chat_backend
|
|
|
|
# Host port on adama/roslin/ai-server-4080 (must match server-infra host_apps)
|
|
WEB_PORT=8003
|
|
|
|
# Ollama on GPU host (ai-server-4080). Firewall must allow 10.0.0.0/24 → :11434.
|
|
OLLAMA_BASE_URL=http://10.0.0.128:11434
|
|
# Role-scoped models (#62). After changing OLLAMA_EMBED_MODEL, run:
|
|
# python manage.py reindex_embeddings
|
|
OLLAMA_MODEL=gpt-oss:20b
|
|
OLLAMA_MODEL_THINKING=gpt-oss:20b
|
|
OLLAMA_MODEL_FAST=gemma4:latest
|
|
# Vision (image + prompt). Must be a vision-capable tag.
|
|
OLLAMA_MODEL_VISION=gemma4:latest
|
|
OLLAMA_MODEL_UTILITY=llama3.2
|
|
OLLAMA_EMBED_MODEL=nomic-embed-text
|
|
OLLAMA_NUM_CTX_THINKING=16384
|
|
OLLAMA_NUM_CTX_FAST=8192
|
|
|
|
# Web search (#62) — self-hosted SearxNG (recommended). DDGS is automatic failover.
|
|
ALLOW_INTERNET_ACCESS=true
|
|
SEARCH_PROVIDER=searxng
|
|
SEARCH_FAILOVER_PROVIDER=ddgs
|
|
# Point at the SearxNG container/service on the LAN (see README "SearxNG").
|
|
SEARXNG_BASE_URL=http://10.0.0.128:8088
|
|
|
|
# Email (SMTP2GO)
|
|
EMAIL_HOST=mail.smtp2go.com
|
|
EMAIL_HOST_USER=replace-with-smtp-user
|
|
EMAIL_HOST_PASSWORD=replace-with-smtp-password
|
|
EMAIL_PORT=2525
|
|
EMAIL_USE_TLS=true
|
|
|
|
# Captcha
|
|
CAPTCHA_SECRET_KEY=replace-with-captcha-secret
|
|
|
|
# Password self-serve sign-up. Default true. Set false in
|
|
# chat_backend_prod.env / chat_backend_beta.env to close public registration.
|
|
# An explicit false in that secret overrides the code default.
|
|
ENABLE_ACCOUNT_REGISTRATION=true
|
|
# Browser SSO stays off. OAuth client ids below are for Drive linking until
|
|
# this is set true.
|
|
ENABLE_SSO=false
|
|
|
|
# OAuth SSO — Google / Microsoft (#24). Never commit real secrets.
|
|
# Register redirect URIs:
|
|
# https://chatbackend.aimloperations.com/api/auth/oauth/google/callback/
|
|
# https://chatbackend.aimloperations.com/api/auth/oauth/microsoft/callback/
|
|
# Same client id/secret pair covers Drive linking (#47); no extra IdP app
|
|
# registration needed, but do register the Drive/Graph API + consent screen
|
|
# scopes below in each console (incremental scopes requested at intent time):
|
|
# Google: openid email profile https://www.googleapis.com/auth/drive.readonly
|
|
# Microsoft: openid email profile offline_access Files.Read (personal)
|
|
# openid email profile offline_access Files.Read.All Sites.Read.All (company)
|
|
GOOGLE_OAUTH_CLIENT_ID=
|
|
GOOGLE_OAUTH_CLIENT_SECRET=
|
|
MICROSOFT_OAUTH_CLIENT_ID=
|
|
MICROSOFT_OAUTH_CLIENT_SECRET=
|
|
MICROSOFT_OAUTH_TENANT=common
|
|
OAUTH_CALLBACK_BASE_URL=https://chatbackend.aimloperations.com
|
|
|
|
# Drive / RAG sync (#47-#53) — gated by SubscriptionPlan.allows_rag.
|
|
# Register provider push notifications (Google Drive `watch`, Microsoft
|
|
# Graph subscriptions) against:
|
|
# https://chatbackend.aimloperations.com/api/drive/webhooks/google/
|
|
# https://chatbackend.aimloperations.com/api/drive/webhooks/microsoft/
|
|
# Scheduled sync (cron / server-infra job): `python manage.py sync_drive_connections`
|
|
|
|
# Stripe / monetization
|
|
STRIPE_SECRET_KEY=replace-with-stripe-secret-key
|
|
STRIPE_PUBLISHABLE_KEY=replace-with-stripe-publishable-key
|
|
STRIPE_WEBHOOK_SECRET=replace-with-stripe-webhook-secret
|
|
APPLE_IAP_BUNDLE_ID=ai.hesychia.chat
|
|
GOOGLE_PLAY_PACKAGE_NAME=ai.hesychia.chat
|
|
GOOGLE_PLAY_SERVICE_ACCOUNT_JSON=replace-with-play-console-service-account-json
|
|
# REVENUECAT_PRODUCT_PLAN_MAP={"hesychia_founders_monthly":"founders"}
|
|
# Optional: pre-created Stripe Price ID. When empty, Checkout uses
|
|
# SUBSCRIPTION_PRICE_* from settings.py ($10 USD / month by default).
|
|
STRIPE_PRICE_ID=
|
|
FRONTEND_BASE_URL=https://chat.aimloperations.com
|
|
# STRIPE_CHECKOUT_SUCCESS_URL=https://chat.aimloperations.com/billing/success?session_id={CHECKOUT_SESSION_ID}
|
|
# STRIPE_CHECKOUT_CANCEL_URL=https://chat.aimloperations.com/billing/cancel
|
|
# STRIPE_PORTAL_RETURN_URL=https://chat.aimloperations.com/account/
|
|
|
|
# Agentic task execution (#63). Keep false until Redis/Celery worker + Ollama
|
|
# capacity are confirmed on this host; false = identical behavior to #62.
|
|
ALLOW_AGENTIC_TASKS=false
|
|
# Shared Redis (channel layer fan-out across gunicorn/uvicorn workers +
|
|
# Celery broker for agent runs). Point both at the same instance.
|
|
# REDIS_URL=redis://10.0.0.128:6379/0
|
|
# CELERY_BROKER_URL=redis://10.0.0.128:6379/0
|
|
# OLLAMA_MODEL_ORCHESTRATOR=gpt-oss:20b
|
|
# OLLAMA_MODEL_SUBAGENT=llama3.2
|
|
# AGENT_MAX_PLAN_STEPS=8
|
|
# AGENT_MAX_ITERATIONS=12
|
|
# AGENT_WALL_CLOCK_SECONDS=600
|
|
# AGENT_SUBAGENT_CONCURRENCY=3
|
|
# Start the worker (server-infra): docker compose --profile agentic up -d worker
|
|
|
|
# Gunicorn / ASGI (UvicornWorker for WebSockets)
|
|
GUNICORN_WORKERS=2
|
|
GUNICORN_BIND=0.0.0.0:8000
|
|
|
|
# =============================================================================
|
|
# BETA overrides (use separate file: chat_backend_beta.env)
|
|
# Control node: ~/Documents/secrets/chat_backend/chat_backend_beta.env
|
|
# Infra: server-infra#7 (host_apps beta :8013, Postgres chat_backend_beta, NPM)
|
|
# =============================================================================
|
|
# DJANGO_ENV=beta
|
|
# DJANGO_DEBUG=false
|
|
# DJANGO_SECRET_KEY=replace-with-a-different-beta-secret
|
|
# DJANGO_ALLOWED_HOSTS=beta.chatbackend.aimloperations.com
|
|
# Optional; when unset, https:// origins are derived from DJANGO_ALLOWED_HOSTS.
|
|
# DJANGO_CSRF_TRUSTED_ORIGINS=https://beta.chatbackend.aimloperations.com,https://beta.chat.aimloperations.com
|
|
# CORS_ALLOWED_ORIGINS=https://beta.chat.aimloperations.com
|
|
# CORS_ORIGIN_ALLOW_ALL=false
|
|
# USE_TLS_PROXY=true
|
|
# DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/chat_backend_beta
|
|
# WEB_PORT=8013
|
|
# OLLAMA_BASE_URL=http://10.0.0.128:11434
|
|
# OAUTH_CALLBACK_BASE_URL=https://beta.chatbackend.aimloperations.com
|
|
# FRONTEND_BASE_URL=https://beta.chat.aimloperations.com
|
|
# Register beta OAuth redirect URIs in each IdP console:
|
|
# https://beta.chatbackend.aimloperations.com/api/auth/oauth/google/callback/
|
|
# https://beta.chatbackend.aimloperations.com/api/auth/oauth/microsoft/callback/
|
|
#
|
|
# Tianji: backend does not load tracker.js. Beta SPA uses a distinct website ID
|
|
# (chat_web_app .env.beta REACT_APP_TIANJI_WEBSITE_ID). Ensure CORS allows the
|
|
# beta frontend origin so Tianji-instrumented pages can call this API.
|