.env.example

# ── VPS target (used by: make deploy / make connect) ─────────────────────────
# SSH destination for deploy and tunnel commands.
# Example: VPS_HOST=root@1.2.3.4
VPS_HOST=
# Local port bound by the SSH tunnel (docker binds this on the VPS loopback)
PROXY_PORT=5555

# ── Proxy ─────────────────────────────────────────────────────────────────────
PORT=8080
HOST=0.0.0.0
# Shared secret — if set, Claude Code must use:
#   export ANTHROPIC_BASE_URL=http://localhost:8080/<PROXY_SECRET>
# Requests without the token in the path are rejected with 403.
# Generate a strong secret: openssl rand -hex 24
PROXY_SECRET=

# ── Anthropic ─────────────────────────────────────────────────────────────────
ANTHROPIC_API_URL=https://api.anthropic.com
# ANTHROPIC_API_KEY is forwarded transparently from Claude Code — do not set here

# ── Ollama (local LLM — second anonymization layer) ───────────────────────────
OLLAMA_HOST=http://localhost:11434
OLLAMA_MODEL=qwen3:1.7b        # qwen3:4b for better quality, slower
OLLAMA_TIMEOUT=30
LLM_ENABLED=true

# ── Engagement isolation ──────────────────────────────────────────────────────
# Change this for each new client. Keeps surrogate mappings isolated per engagement.
ENGAGEMENT_ID=default

# ── Storage ───────────────────────────────────────────────────────────────────
DATA_DIR=./data
DATABASE_PATH=./data/pii_vault.db

# ── Chunking (for long tool outputs like nmap scans) ─────────────────────────
LLM_CHUNK_SIZE=1500
LLM_CHUNK_OVERLAP=150