22 lines
1.5 KiB
Text
22 lines
1.5 KiB
Text
# portfolio-optimiser — environment template. Copy to `.env` and fill in. NEVER commit `.env`.
|
|
#
|
|
# Two backend profiles (D2): LOCAL (OpenAI-compatible local endpoint, dev default — D6) and
|
|
# AZURE (Foundry, for targeted minimal verification against the private tenant).
|
|
#
|
|
# Named `env.template` (no leading dot) on purpose: a leading-dot `.env.template` is blocked by
|
|
# the llm-security pre-write pathguard. Copy to `.env` locally (`.env` is gitignored).
|
|
|
|
# --- LOCAL profile (dev default) — OpenAI-compatible local endpoint (Ollama / LM Studio) ---
|
|
# No-egress notes (research 03): the endpoint MUST be loopback; a model pull is the ONLY
|
|
# legitimate egress and is explicit. Harden Ollama: bind to 127.0.0.1, pin >= 0.17.1, and
|
|
# leave OLLAMA_DEBUG unset.
|
|
PORTFOLIO_LOCAL_BASE_URL=http://127.0.0.1:11434/v1 # loopback only — never a remote host
|
|
PORTFOLIO_LOCAL_API_KEY=ollama # local servers accept any non-empty key
|
|
# Recommended Ollama hardening (set in the Ollama service environment, not here):
|
|
# OLLAMA_HOST=127.0.0.1:11434 # bind loopback only
|
|
# (pin Ollama >= 0.17.1; leave OLLAMA_DEBUG unset)
|
|
|
|
# --- AZURE / Foundry profile (targeted verification only — D6) ---
|
|
# Deployment (model) names are tenant-specific and live in data/model_map.json (azure.*).
|
|
# Credential resolves via Azure DefaultAzureCredential (`az login` / managed identity).
|
|
PORTFOLIO_FOUNDRY_PROJECT_ENDPOINT= # tenant-specific Foundry project endpoint (operator supplies)
|