# portfolio-optimiser — environment template. Copy to `.env` and fill in. NEVER commit `.env`.
#
# Two backend profiles (D2): LOCAL (OpenAI-compatible local endpoint, dev default — D6) and
# AZURE (Foundry, for targeted minimal verification against the private tenant).
#
# Named `env.template` (no leading dot) on purpose: a leading-dot `.env.template` is blocked by
# the llm-security pre-write pathguard. Copy to `.env` locally (`.env` is gitignored).

# --- LOCAL profile (dev default) — OpenAI-compatible local endpoint (Ollama / LM Studio) ---
# No-egress notes (research 03): the endpoint MUST be loopback; a model pull is the ONLY
# legitimate egress and is explicit. Harden Ollama: bind to 127.0.0.1, pin >= 0.17.1, and
# leave OLLAMA_DEBUG unset.
PORTFOLIO_LOCAL_BASE_URL=http://127.0.0.1:11434/v1   # loopback only — never a remote host
PORTFOLIO_LOCAL_API_KEY=ollama                       # local servers accept any non-empty key
# Recommended Ollama hardening (set in the Ollama service environment, not here):
#   OLLAMA_HOST=127.0.0.1:11434   # bind loopback only
#   (pin Ollama >= 0.17.1; leave OLLAMA_DEBUG unset)

# --- AZURE / Foundry profile (targeted verification only — D6) ---
# Deployment (model) names are tenant-specific and live in data/model_map.json (azure.*).
# Credential resolves via Azure DefaultAzureCredential (`az login` / managed identity).
PORTFOLIO_FOUNDRY_PROJECT_ENDPOINT=   # tenant-specific Foundry project endpoint (operator supplies)