89 lines
4.4 KiB
Bash
89 lines
4.4 KiB
Bash
# =====================================================================
|
|
# owuitools configuration. Copy to .env and fill in.
|
|
# cp .env.example .env && sed -i "s|^OWUITOOLS_AUTH_TOKEN=.*|OWUITOOLS_AUTH_TOKEN=$(openssl rand -hex 32)|" .env
|
|
# =====================================================================
|
|
|
|
# REQUIRED. Bearer token Open WebUI presents to the tool server. Paste the
|
|
# same value into the connection's Auth field in Admin -> Integrations.
|
|
OWUITOOLS_AUTH_TOKEN=
|
|
|
|
# Contact string sent as part of the User-Agent. Wikimedia REQUIRES a
|
|
# descriptive UA with a contact and returns HTTP 403 without one; OpenAlex
|
|
# and Crossref give you a faster "polite pool" when they can see who you are.
|
|
OWUITOOLS_CONTACT=owuitools@example.com
|
|
|
|
# Hard ceiling on any single tool response, in characters. Open WebUI does
|
|
# NOT truncate tool results - whatever a tool returns lands in the context
|
|
# window verbatim - so this is the only thing standing between one greedy
|
|
# fetch and a blown 150k window.
|
|
OWUITOOLS_MAX_RESPONSE_CHARS=12000
|
|
|
|
# Per-user hourly budget for the tools that reach out and touch a named
|
|
# host (dns_lookup, inspect_tls, http_headers, lookup_ip_or_asn). Keyed on
|
|
# the X-OpenWebUI-User-Id header. Bounds how much scanning a guest account
|
|
# can drive; the private-range block in squid is what makes it safe, this
|
|
# just makes it polite.
|
|
OWUITOOLS_PROBE_RATE_PER_HOUR=30
|
|
|
|
OWUITOOLS_LOG_LEVEL=INFO
|
|
|
|
# The Docker network Open WebUI is on. The gateway joins it so that
|
|
# `owuitools-gw` resolves by name from the Open WebUI container. Compose
|
|
# names a stack's default network <directory>_default, so this is right
|
|
# if Open WebUI runs from a directory called `openwebui` - check with
|
|
# `docker network ls`.
|
|
OWUITOOLS_OWUI_NETWORK=openwebui_default
|
|
|
|
# Optional. If your Open WebUI is reachable from the internet, putting
|
|
# its address here lets a site you fetch from see who is doing it - which
|
|
# is what the polite-pool policies at OpenAlex and Crossref ask for.
|
|
# Leave it empty if this is a private deployment, which is the usual case.
|
|
OWUITOOLS_PUBLIC_URL=
|
|
|
|
# --- Optional API keys ------------------------------------------------
|
|
# All optional; every tool works without them. Each one lifts a limit that
|
|
# is genuinely tight for a shared assistant.
|
|
|
|
# github.com/settings/tokens - no scopes needed for public repos.
|
|
# Unauthenticated GitHub is 60 requests/hour PER IP for the whole stack.
|
|
# A bare read-only token takes that to 5000/hour.
|
|
OWUITOOLS_GITHUB_TOKEN=
|
|
|
|
# stackapps.com/apps/oauth/register - free, instant.
|
|
# Keyless Stack Exchange is 300 requests/day/IP. A key makes it 10000.
|
|
OWUITOOLS_STACKEXCHANGE_KEY=
|
|
|
|
# nvd.nist.gov/developers/request-an-api-key - free, arrives in minutes.
|
|
# Keyless NVD is documented at 5 requests/30s. Only matters if you lean on
|
|
# CVSS detail; lookup_cve prefers CIRCL, which has no hard limit.
|
|
OWUITOOLS_NVD_KEY=
|
|
|
|
# --- VM sub-agent (vm_agent) ------------------------------------------
|
|
# Everything here is optional; without OWUITOOLS_OWUI_API_KEY the agent
|
|
# still runs, the user just loses the live view of it working.
|
|
|
|
# NOTE: there is deliberately no Open WebUI API key here any more.
|
|
# Live progress used to be posted to /api/v1/chats/.../event, which
|
|
# refuses anything less than an ADMIN key - because anyone may invoke
|
|
# vm_agent and the chat belongs to whoever is talking. That key is gone:
|
|
# the agent writes progress to the shared job volume and the
|
|
# `vm_agent_progress` filter, running inside Open WebUI where the event
|
|
# emitter is already bound to the requesting user, reads it from there.
|
|
# The filter's only credential is OWUITOOLS_AUTH_TOKEN, entered as one of
|
|
# its Valves - the same token the tool server already uses.
|
|
|
|
# How long one vm_agent call may block, in seconds. Three clocks have to
|
|
# agree or the turn dies at the shortest: this one, proxy_read_timeout on
|
|
# the /tools/vm_agent location in configs/services/gateway.nginx.conf,
|
|
# AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER on the open-webui container - which
|
|
# defaults to 300 when unset, NOT to "no timeout". Keep this the smallest
|
|
# of the three so the app is what answers rather than a proxy.
|
|
OWUITOOLS_VM_WAIT_SECONDS=7000
|
|
|
|
# THE SUB-AGENT'S OWN SETTINGS ARE NOT HERE.
|
|
#
|
|
# Its model, context, sampling and session bounds live with its prompts
|
|
# and tool definitions, in configs/agent/params.env - one place for
|
|
# everything about the second model, rather than half of it here and
|
|
# half of it there. See docs/advanced-params.md.
|