paramem/.env.example at main · tiberius1701d/paramem · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
# ParaMem environment variable template.
# Copy this file to .env and fill in the values for your deployment.
# Lines beginning with # are comments and are ignored.
# The server loads .env automatically via python-dotenv on startup.
#
# Export to subprocesses when running scripts directly:
#   export $(grep -v '^#' .env | xargs)
# (plain `source .env` does not export variables to subprocesses)
#
# SECURITY: .env is gitignored. Never commit a file containing real keys.
# Every secret-bearing field in configs/server.yaml uses a ${VAR_NAME}
# placeholder that is resolved from this environment at startup.

# ============================================================================
# PYTORCH / CUDA
# ============================================================================

# Required: reduces CUDA allocator fragmentation under QLoRA training.
PYTORCH_CUDA_ALLOC_CONF=expandable_segments:True

# Optional: disable HuggingFace threaded weight loading.
# Needed on some WSL2 + older driver configurations to prevent
# "CUDA driver error: device not ready" on cold model loads ≥ 4 B params.
# Try without it first — as of NVIDIA driver 596.36 + Windows 11 KB5088467
# (2026-04) the race no longer reproduces on our test host.
# HF_DEACTIVATE_ASYNC_LOAD=1

# ============================================================================
# HUGGINGFACE
# ============================================================================

# Optional: required only for gated models (Llama, some Gemma variants).
# Accept the model licence on huggingface.co before setting this.
# HF_TOKEN=<your-hf-token>

# ============================================================================
# EXPERIMENT TRACKING
# ============================================================================

# Optional: Weights & Biases API key for experiment tracking.
# WANDB_API_KEY=<your-wandb-api-key>

# ============================================================================
# PARAMEM SERVER — REQUIRED FOR DEPLOYMENT
# ============================================================================

# NOT a self-generated secret — PARAMEM_API_TOKEN is a CARRIER for a token
# minted separately into the server's per-user token store. The server does
# not validate this env var's value directly (see paramem/server/auth.py);
# infrastructure callers (the systemd scheduling timer, the HA custom
# component) read it to source their own Authorization header. Mint an
# admin-scope token, then paste its value here:
#   paramem mint-user-token --unattributed --scope admin --force-admin
# PARAMEM_API_TOKEN=<minted-token-value>

# Required when Security-ON (age encryption) is active.
# Unlocks the daily age identity at ~/.config/paramem/daily_key.age.
# Choose a strong passphrase; store it in a password manager.
# PARAMEM_DAILY_PASSPHRASE=<your-passphrase>

# Optional: restrict which interface the server binds to.
# Default: 0.0.0.0 (all interfaces). Set to 127.0.0.1 for localhost-only.
# PARAMEM_LISTEN_IP=<ip-address>

# Optional: restrict access to requests from this NAS/gateway IP only.
# PARAMEM_NAS_IP=<your-nas-or-gateway-ip>

# ============================================================================
# HOME ASSISTANT
# ============================================================================

# Required for HA integration (tools.ha in server.yaml).
HA_URL=http://<your-ha-host>:8123
HA_TOKEN=<your-ha-long-lived-token>
# Generate the HA token: HA → Profile → Long-Lived Access Tokens → Create

# ============================================================================
# SOTA CLOUD PROVIDERS
# ============================================================================
# All cloud providers are optional. Enable the ones you use in server.yaml
# under agents.sota / agents.sota_providers (enabled: true).
# Only providers with a key set AND enabled: true in server.yaml are called.

# Anthropic (Claude)
# ANTHROPIC_API_KEY=<your-anthropic-api-key>

# OpenAI
# OPENAI_API_KEY=<your-openai-api-key>

# Google (Gemini)
# GOOGLE_API_KEY=<your-google-api-key>

# Groq (fast inference)
# GROQ_API_KEY=<your-groq-api-key>

# Mistral AI
# MISTRAL_API_KEY=<your-mistral-api-key>