# =====================================================================
# owuitools configuration. Copy to .env and fill in.
#   cp .env.example .env && sed -i "s|^OWUITOOLS_AUTH_TOKEN=.*|OWUITOOLS_AUTH_TOKEN=$(openssl rand -hex 32)|" .env
# =====================================================================

# REQUIRED. Bearer token Open WebUI presents to the tool server. Paste the
# same value into the connection's Auth field in Admin -> Integrations.
OWUITOOLS_AUTH_TOKEN=

# Contact string sent as part of the User-Agent. Wikimedia REQUIRES a
# descriptive UA with a contact and returns HTTP 403 without one; OpenAlex
# and Crossref give you a faster "polite pool" when they can see who you are.
OWUITOOLS_CONTACT=owuitools@example.com

# Hard ceiling on any single tool response, in characters. Open WebUI does
# NOT truncate tool results - whatever a tool returns lands in the context
# window verbatim - so this is the only thing standing between one greedy
# fetch and a blown 150k window.
OWUITOOLS_MAX_RESPONSE_CHARS=12000

# Per-user hourly budget for the tools that reach out and touch a named
# host (dns_lookup, inspect_tls, http_headers, lookup_ip_or_asn). Keyed on
# the X-OpenWebUI-User-Id header. Bounds how much scanning a guest account
# can drive; the private-range block in squid is what makes it safe, this
# just makes it polite.
OWUITOOLS_PROBE_RATE_PER_HOUR=30

OWUITOOLS_LOG_LEVEL=INFO

# The Docker network Open WebUI is on. The gateway joins it so that
# `owuitools-gw` resolves by name from the Open WebUI container. Compose
# names a stack's default network <directory>_default, so this is right
# if Open WebUI runs from a directory called `openwebui` - check with
# `docker network ls`.
OWUITOOLS_OWUI_NETWORK=openwebui_default

# Optional. If your Open WebUI is reachable from the internet, putting
# its address here lets a site you fetch from see who is doing it - which
# is what the polite-pool policies at OpenAlex and Crossref ask for.
# Leave it empty if this is a private deployment, which is the usual case.
OWUITOOLS_PUBLIC_URL=

# --- Optional API keys ------------------------------------------------
# All optional; every tool works without them. Each one lifts a limit that
# is genuinely tight for a shared assistant.

# github.com/settings/tokens - no scopes needed for public repos.
# Unauthenticated GitHub is 60 requests/hour PER IP for the whole stack.
# A bare read-only token takes that to 5000/hour.
OWUITOOLS_GITHUB_TOKEN=

# stackapps.com/apps/oauth/register - free, instant.
# Keyless Stack Exchange is 300 requests/day/IP. A key makes it 10000.
OWUITOOLS_STACKEXCHANGE_KEY=

# nvd.nist.gov/developers/request-an-api-key - free, arrives in minutes.
# Keyless NVD is documented at 5 requests/30s. Only matters if you lean on
# CVSS detail; lookup_cve prefers CIRCL, which has no hard limit.
OWUITOOLS_NVD_KEY=

# --- VM sub-agent (vm_agent) ------------------------------------------
# Everything here is optional; without OWUITOOLS_OWUI_API_KEY the agent
# still runs, the user just loses the live view of it working.

# NOTE: there is deliberately no Open WebUI API key here any more.
# Live progress used to be posted to /api/v1/chats/.../event, which
# refuses anything less than an ADMIN key - because anyone may invoke
# vm_agent and the chat belongs to whoever is talking. That key is gone:
# the agent writes progress to the shared job volume and the
# `vm_agent_progress` filter, running inside Open WebUI where the event
# emitter is already bound to the requesting user, reads it from there.
# The filter's only credential is OWUITOOLS_AUTH_TOKEN, entered as one of
# its Valves - the same token the tool server already uses.

# How long one vm_agent call may block, in seconds. Three clocks have to
# agree or the turn dies at the shortest: this one, proxy_read_timeout on
# the /tools/vm_agent location in configs/services/gateway.nginx.conf,
# AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER on the open-webui container - which
# defaults to 300 when unset, NOT to "no timeout". Keep this the smallest
# of the three so the app is what answers rather than a proxy.
OWUITOOLS_VM_WAIT_SECONDS=7000

# THE SUB-AGENT'S OWN SETTINGS ARE NOT HERE.
#
# Its model, context, sampling and session bounds live with its prompts
# and tool definitions, in configs/agent/params.env - one place for
# everything about the second model, rather than half of it here and
# half of it there. See docs/advanced-params.md.