Initial Commit

configs/owuitools.env.example

@@ -0,0 +1,88 @@
+# =====================================================================
+# owuitools configuration. Copy to .env and fill in.
+#   cp .env.example .env && sed -i "s|^OWUITOOLS_AUTH_TOKEN=.*|OWUITOOLS_AUTH_TOKEN=$(openssl rand -hex 32)|" .env
+# =====================================================================
+
+# REQUIRED. Bearer token Open WebUI presents to the tool server. Paste the
+# same value into the connection's Auth field in Admin -> Integrations.
+OWUITOOLS_AUTH_TOKEN=
+
+# Contact string sent as part of the User-Agent. Wikimedia REQUIRES a
+# descriptive UA with a contact and returns HTTP 403 without one; OpenAlex
+# and Crossref give you a faster "polite pool" when they can see who you are.
+OWUITOOLS_CONTACT=owuitools@example.com
+
+# Hard ceiling on any single tool response, in characters. Open WebUI does
+# NOT truncate tool results - whatever a tool returns lands in the context
+# window verbatim - so this is the only thing standing between one greedy
+# fetch and a blown 150k window.
+OWUITOOLS_MAX_RESPONSE_CHARS=12000
+
+# Per-user hourly budget for the tools that reach out and touch a named
+# host (dns_lookup, inspect_tls, http_headers, lookup_ip_or_asn). Keyed on
+# the X-OpenWebUI-User-Id header. Bounds how much scanning a guest account
+# can drive; the private-range block in squid is what makes it safe, this
+# just makes it polite.
+OWUITOOLS_PROBE_RATE_PER_HOUR=30
+
+OWUITOOLS_LOG_LEVEL=INFO
+
+# The Docker network Open WebUI is on. The gateway joins it so that
+# `owuitools-gw` resolves by name from the Open WebUI container. Compose
+# names a stack's default network <directory>_default, so this is right
+# if Open WebUI runs from a directory called `openwebui` - check with
+# `docker network ls`.
+OWUITOOLS_OWUI_NETWORK=openwebui_default
+
+# Optional. If your Open WebUI is reachable from the internet, putting
+# its address here lets a site you fetch from see who is doing it - which
+# is what the polite-pool policies at OpenAlex and Crossref ask for.
+# Leave it empty if this is a private deployment, which is the usual case.
+OWUITOOLS_PUBLIC_URL=
+
+# --- Optional API keys ------------------------------------------------
+# All optional; every tool works without them. Each one lifts a limit that
+# is genuinely tight for a shared assistant.
+
+# github.com/settings/tokens - no scopes needed for public repos.
+# Unauthenticated GitHub is 60 requests/hour PER IP for the whole stack.
+# A bare read-only token takes that to 5000/hour.
+OWUITOOLS_GITHUB_TOKEN=
+
+# stackapps.com/apps/oauth/register - free, instant.
+# Keyless Stack Exchange is 300 requests/day/IP. A key makes it 10000.
+OWUITOOLS_STACKEXCHANGE_KEY=
+
+# nvd.nist.gov/developers/request-an-api-key - free, arrives in minutes.
+# Keyless NVD is documented at 5 requests/30s. Only matters if you lean on
+# CVSS detail; lookup_cve prefers CIRCL, which has no hard limit.
+OWUITOOLS_NVD_KEY=
+
+# --- VM sub-agent (vm_agent) ------------------------------------------
+# Everything here is optional; without OWUITOOLS_OWUI_API_KEY the agent
+# still runs, the user just loses the live view of it working.
+
+# NOTE: there is deliberately no Open WebUI API key here any more.
+# Live progress used to be posted to /api/v1/chats/.../event, which
+# refuses anything less than an ADMIN key - because anyone may invoke
+# vm_agent and the chat belongs to whoever is talking. That key is gone:
+# the agent writes progress to the shared job volume and the
+# `vm_agent_progress` filter, running inside Open WebUI where the event
+# emitter is already bound to the requesting user, reads it from there.
+# The filter's only credential is OWUITOOLS_AUTH_TOKEN, entered as one of
+# its Valves - the same token the tool server already uses.
+
+# How long one vm_agent call may block, in seconds. Three clocks have to
+# agree or the turn dies at the shortest: this one, proxy_read_timeout on
+# the /tools/vm_agent location in configs/services/gateway.nginx.conf,
+# AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER on the open-webui container - which
+# defaults to 300 when unset, NOT to "no timeout". Keep this the smallest
+# of the three so the app is what answers rather than a proxy.
+OWUITOOLS_VM_WAIT_SECONDS=7000
+
+# THE SUB-AGENT'S OWN SETTINGS ARE NOT HERE.
+#
+# Its model, context, sampling and session bounds live with its prompts
+# and tool definitions, in configs/agent/params.env - one place for
+# everything about the second model, rather than half of it here and
+# half of it there. See docs/advanced-params.md.