clawsec/.env.example at master · mohnishbasha/clawsec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
# ===========================================================================
# ClawSec — Environment Variable Reference
#
# Copy this file to .env and fill in all values before starting the stack.
# Never commit .env to version control.
# ===========================================================================

# ---------------------------------------------------------------------------
# Security — REQUIRED in production
# ---------------------------------------------------------------------------

# 256-bit (64 hex characters) random secret for JWT signing.
# Generate with: python3 -c "import secrets; print(secrets.token_hex(32))"
# NEVER use the default value in production.
JWT_SECRET_KEY=change-me-in-production-use-a-256-bit-secret

# ---------------------------------------------------------------------------
# LLM Backend — pick ONE provider and fill in its values
# ---------------------------------------------------------------------------

# Leave LLM_API_URL blank to use mock mode (safe canned responses, no API key needed).

# ── Option A: OpenAI ────────────────────────────────────────────────────────
LLM_API_URL=https://api.openai.com/v1/chat/completions
LLM_API_KEY=sk-...
LLM_MODEL=gpt-4o

# ── Option B: Groq (free tier — https://console.groq.com) ──────────────────
# LLM_API_URL=https://api.groq.com/openai/v1/chat/completions
# LLM_API_KEY=gsk_...
# LLM_MODEL=llama3-8b-8192

# ── Option C: Anthropic via proxy (e.g. LiteLLM) ───────────────────────────
# LLM_API_URL=http://litellm:4000/v1/chat/completions
# LLM_API_KEY=your-litellm-key
# LLM_MODEL=claude-sonnet-4-6

# ── Option D: Ollama (local, free, no key) ──────────────────────────────────
# Uncomment the ollama service in docker-compose.yml first, then:
# LLM_API_URL=http://ollama:11434/v1/chat/completions
# LLM_API_KEY=ollama
# LLM_MODEL=llama3.2

# Maximum tokens in the model response.
LLM_MAX_TOKENS=2048

# ---------------------------------------------------------------------------
# Database
# ---------------------------------------------------------------------------

# SQLAlchemy-compatible connection string for the audit database.
# SQLite (default, single-node): sqlite:///./data/clawsec_audit.db
# PostgreSQL (production):       postgresql+psycopg2://user:pass@host:5432/clawsec
DATABASE_URL=sqlite:///./data/clawsec_audit.db

# ---------------------------------------------------------------------------
# Observability
# ---------------------------------------------------------------------------

# OpenTelemetry Collector gRPC endpoint for span export.
OTLP_ENDPOINT=http://otel-collector:4317

# ---------------------------------------------------------------------------
# Gateway / Proxy
# ---------------------------------------------------------------------------

# Comma-separated IPs/hostnames of trusted reverse proxies (Traefik, nginx, etc.).
# When set, X-Forwarded-For and X-Real-IP headers are trusted from these addresses
# to extract the real client IP. Leave blank to use the direct TCP peer address.
TRUSTED_PROXIES=traefik

# Outbound proxy for LLM API calls (optional — for corporate proxy / inspection gateway).
# These override HTTP_PROXY / HTTPS_PROXY for LLM traffic only.
# Leave blank for direct outbound connections.
LLM_HTTP_PROXY=
LLM_HTTPS_PROXY=
# Comma-separated hostnames to bypass the outbound proxy.
LLM_NO_PROXY=localhost,127.0.0.1

# ---------------------------------------------------------------------------
# API Server
# ---------------------------------------------------------------------------

# Comma-separated list of allowed CORS origins.
ALLOWED_ORIGINS=http://localhost:3000

# ---------------------------------------------------------------------------
# Grafana
# ---------------------------------------------------------------------------

# Admin password for the Grafana dashboard.
GRAFANA_PASSWORD=change-me-grafana-password