open/portfolio-optimiser
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions

docs(fase2): add env.template documenting both profiles + no-egress notes

Browse source
This commit is contained in:
Kjell Tore Guttormsen 2026-06-26 00:43:26 +02:00
commit fb58f9a23d
1 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

22
env.template Normal file
View file

@ -0,0 +1,22 @@
# portfolio-optimiser — environment template. Copy to `.env` and fill in. NEVER commit `.env`.
#
# Two backend profiles (D2): LOCAL (OpenAI-compatible local endpoint, dev default — D6) and
# AZURE (Foundry, for targeted minimal verification against the private tenant).
#
# Named `env.template` (no leading dot) on purpose: a leading-dot `.env.template` is blocked by
# the llm-security pre-write pathguard. Copy to `.env` locally (`.env` is gitignored).
# --- LOCAL profile (dev default) — OpenAI-compatible local endpoint (Ollama / LM Studio) ---
# No-egress notes (research 03): the endpoint MUST be loopback; a model pull is the ONLY
# legitimate egress and is explicit. Harden Ollama: bind to 127.0.0.1, pin >= 0.17.1, and
# leave OLLAMA_DEBUG unset.
PORTFOLIO_LOCAL_BASE_URL=http://127.0.0.1:11434/v1 # loopback only — never a remote host
PORTFOLIO_LOCAL_API_KEY=ollama # local servers accept any non-empty key
# Recommended Ollama hardening (set in the Ollama service environment, not here):
# OLLAMA_HOST=127.0.0.1:11434 # bind loopback only
# (pin Ollama >= 0.17.1; leave OLLAMA_DEBUG unset)
# --- AZURE / Foundry profile (targeted verification only — D6) ---
# Deployment (model) names are tenant-specific and live in data/model_map.json (azure.*).
# Credential resolves via Azure DefaultAzureCredential (`az login` / managed identity).
PORTFOLIO_FOUNDRY_PROJECT_ENDPOINT= # tenant-specific Foundry project endpoint (operator supplies)