From fb58f9a23d1b7b6bb50e45a90cb03270b2caa1af Mon Sep 17 00:00:00 2001 From: Kjell Tore Guttormsen Date: Fri, 26 Jun 2026 00:43:26 +0200 Subject: [PATCH] docs(fase2): add env.template documenting both profiles + no-egress notes --- env.template | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 env.template diff --git a/env.template b/env.template new file mode 100644 index 0000000..65ba9be --- /dev/null +++ b/env.template @@ -0,0 +1,22 @@ +# portfolio-optimiser — environment template. Copy to `.env` and fill in. NEVER commit `.env`. +# +# Two backend profiles (D2): LOCAL (OpenAI-compatible local endpoint, dev default — D6) and +# AZURE (Foundry, for targeted minimal verification against the private tenant). +# +# Named `env.template` (no leading dot) on purpose: a leading-dot `.env.template` is blocked by +# the llm-security pre-write pathguard. Copy to `.env` locally (`.env` is gitignored). + +# --- LOCAL profile (dev default) — OpenAI-compatible local endpoint (Ollama / LM Studio) --- +# No-egress notes (research 03): the endpoint MUST be loopback; a model pull is the ONLY +# legitimate egress and is explicit. Harden Ollama: bind to 127.0.0.1, pin >= 0.17.1, and +# leave OLLAMA_DEBUG unset. +PORTFOLIO_LOCAL_BASE_URL=http://127.0.0.1:11434/v1 # loopback only — never a remote host +PORTFOLIO_LOCAL_API_KEY=ollama # local servers accept any non-empty key +# Recommended Ollama hardening (set in the Ollama service environment, not here): +# OLLAMA_HOST=127.0.0.1:11434 # bind loopback only +# (pin Ollama >= 0.17.1; leave OLLAMA_DEBUG unset) + +# --- AZURE / Foundry profile (targeted verification only — D6) --- +# Deployment (model) names are tenant-specific and live in data/model_map.json (azure.*). +# Credential resolves via Azure DefaultAzureCredential (`az login` / managed identity). +PORTFOLIO_FOUNDRY_PROJECT_ENDPOINT= # tenant-specific Foundry project endpoint (operator supplies)