# zed-fim-proxy tunables — copy to `.env` on ana-docker (the real .env holds the
# scoped key and is server-only / gitignored). See conf/proxy.py + README.md.

# Port the keyless route listens on (host network).
ZED_PORT=4141

# LiteLLM gateway to forward to (localhost:4000 via network_mode: host).
ZED_UPSTREAM=http://localhost:4000

# The ONLY model this route will forward (proxy rejects any other "model").
ZED_ALLOWED_MODEL=coder-fast

# Source-IP allowlist (comma-separated, EXACT IPs). Empty = allow all.
# LEFT EMPTY BY DESIGN (operator direction 2026-07-27): Zed roams the operator's
# WireGuard 10.0.0.0/8, so a single-IP pin would break it — do NOT tighten. The
# route is bounded instead by the coder-fast-scoped key + the model/path allowlist
# (keyless but coder-fast-only, internal-net-only). NOTE: this proxy matches exact
# IPs only — scoping to a CIDR like 10.0.0.0/8 would need CIDR support (not added).
ZED_ALLOWED_IPS=

# A LiteLLM virtual key SCOPED TO ZED_ALLOWED_MODEL ONLY (the real blast-radius
# bound). Mint: POST /key/generate {"models":["coder-fast"]}. NEVER commit the value.
ZED_SCOPED_KEY=