Bot
24cc4e6655
Key names now match exactly what current ai/ai.yaml references: AI_OPEN_WEBUI_* (was WEBUI_*/OAUTH_*), AI_LITELLM_* (was LITELLM_*/ DATABASE_URL/POSTGRES_PASSWORD), AI_AWS_REGION_NAME (was AWS_REGION_NAME). MCPO_API_KEY stays unprefixed (ai.yaml references it unprefixed for both mcpo and mcpo-critical). Placeholder names match the CI env vars declared in deploy.yml's provision-secrets block, including the normalized AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET (fixing main's WEB_UI/WEBUI typo that currently renders an EMPTY OAuth client secret into ai.env).
56 lines
3.7 KiB
Bash
56 lines
3.7 KiB
Bash
# ─────────────────────────────────────────────────────────────────────────────
|
|
# ai.env.template — AUTHORITATIVE template for ai/ai.env (rendered by
|
|
# deploy/provision-stack.py per secrets/secrets-map.yaml).
|
|
#
|
|
# - This file IS the complete key list for ai.env. The whole file is
|
|
# rendered on every provisioning run — no line surgery, so a key can
|
|
# never silently go missing again (root cause of the 2026-09-03 outage).
|
|
# - Key names match EXACTLY what ai/ai.yaml references (AI_<SERVICE>_*
|
|
# naming adopted on main 2026-09-06).
|
|
# - Non-secret config lives here as LITERAL values (visible, reviewable).
|
|
# - Secret values are dollar-brace placeholders resolved from the CI env
|
|
# (Woodpecker from_secret vars) at provisioning time. provision-stack.py
|
|
# FAILS HARD if any placeholder is missing/empty.
|
|
# - The rendered ai/ai.env exists only on the host (gitignored).
|
|
# - Rendered by provision-stack.py, NOT Woodpecker's yaml preprocessor —
|
|
# single-dollar placeholders are safe here (deploy.yml's double-dollar
|
|
# rule does NOT apply to this file).
|
|
#
|
|
# Consumed by ai/ai.yaml. DOMAIN_NAME comes from deploy/global.env, not here.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
# ── LiteLLM (non-secret config) ──────────────────────────────────────────────
|
|
AI_AWS_REGION_NAME=us-east-2
|
|
AI_LITELLM_MODIFY_PARAMS=False
|
|
AI_LITELLM_DATABASE_MIGRATIONS=True
|
|
|
|
# ── LiteLLM (secrets) ────────────────────────────────────────────────────────
|
|
AI_AWS_ACCESS_KEY_ID=${AI_AWS_ACCESS_KEY_ID}
|
|
AI_AWS_SECRET_ACCESS_KEY=${AI_AWS_SECRET_ACCESS_KEY}
|
|
AI_LITELLM_MASTER_KEY=${AI_LITELLM_MASTER_KEY}
|
|
AI_LITELLM_SALT_KEY=${AI_LITELLM_SALT_KEY}
|
|
# Full connection URL is itself a secret (ai_litellm_database_url) — the
|
|
# URL structure never appears in git.
|
|
AI_LITELLM_DATABASE_URL=${AI_LITELLM_DATABASE_URL}
|
|
AI_LITELLM_POSTGRES_PASSWORD=${AI_LITELLM_POSTGRES_PASSWORD}
|
|
|
|
# ── Open WebUI (non-secret config) ───────────────────────────────────────────
|
|
AI_OPEN_WEBUI_URL=https://ai.bryanmail.net
|
|
AI_OPEN_WEBUI_ENABLE_OAUTH_SIGNUP=true
|
|
AI_OPEN_WEBUI_OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
|
|
AI_OPEN_WEBUI_OAUTH_PROVIDER_NAME=Authentik
|
|
AI_OPEN_WEBUI_OPENID_PROVIDER_URL=https://auth.bryanmail.net/application/o/open-web-ui/.well-known/openid-configuration
|
|
# OAuth client ID is a public identifier by OAuth2 design (it is sent to the
|
|
# browser); the client SECRET below is the protected credential.
|
|
AI_OPEN_WEBUI_OAUTH_CLIENT_ID=hVmhi1dS3TnG2cUw5QwLOx5FDLSWtnQUdZyeB5zK
|
|
AI_OPEN_WEBUI_OAUTH_SCOPES=openid email profile
|
|
AI_OPEN_WEBUI_OPENID_REDIRECT_URI=https://ai.bryanmail.net/oauth/oidc/callback
|
|
|
|
# ── Open WebUI (secrets) ─────────────────────────────────────────────────────
|
|
AI_OPEN_WEBUI_SECRET_KEY=${AI_OPEN_WEBUI_SECRET_KEY}
|
|
AI_OPEN_WEBUI_DATABASE_URL=${AI_OPEN_WEBUI_DATABASE_URL}
|
|
AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET=${AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET}
|
|
|
|
# ── mcpo / mcpo-critical (secrets) ───────────────────────────────────────────
|
|
MCPO_API_KEY=${AI_MCPO_API_KEY}
|