# open-webui on esh-docker-vm. Real .env lives on the host and is NEVER committed.
# Populate secrets from the vault:
#   secret get esh-docker-vm/open-webui-litellm-key   -> OPENAI_API_KEY
#   secret get esh-docker-vm/open-webui-secret-key     -> WEBUI_SECRET_KEY
#
# ⚠️ ENABLE_PERSISTENT_CONFIG=False is load-bearing (G1): env is re-read every
#    boot, UI changes do NOT persist across restart. Change config HERE + bounce.

OPENWEBUI_PORT=3211
OPENWEBUI_TAG=main
OPENWEBUI_ENV=prod

# --- The deal-sealer ---
ENABLE_PERSISTENT_CONFIG=False

# --- Auth / signup (G6). Signup is OFF in steady state; the first/admin account
#     (lkraven / vh@phasefinal.com) was created during deploy with signup briefly
#     enabled, then locked. To add a user: create via Admin UI (signup stays off). ---
WEBUI_AUTH=True
WEBUI_SECRET_KEY=
ENABLE_SIGNUP=False
ENABLE_LOGIN_FORM=True
DEFAULT_USER_ROLE=pending
# Open WebUI v0.11.0 env var is ENABLE_API_KEYS (plural); singular is inert.
ENABLE_API_KEYS=True

# --- Model source: LiteLLM gateway, NO pins (G2 auto-tracks the live roster). ---
ENABLE_OPENAI_API=True
OPENAI_API_BASE_URL=http://10.250.50.70:4000/v1
OPENAI_API_KEY=
ENABLE_OLLAMA_API=False

# --- Background task model (G5): summarizer (gen seat @ temp 0). ---
TASK_MODEL_EXTERNAL=summarizer

# --- RAG embeddings via the gateway (avoids boot-time HF download). ---
RAG_EMBEDDING_ENGINE=openai
RAG_EMBEDDING_MODEL=qwen3-embedding
RAG_OPENAI_API_BASE_URL=http://10.250.50.70:4000/v1

# --- TTS (G4 — tts-dev tunes model/voice). Direct at the dots gateway, no LiteLLM. ---
AUDIO_TTS_ENGINE=openai
AUDIO_TTS_OPENAI_API_BASE_URL=http://10.100.79.3:8198/v1
AUDIO_TTS_OPENAI_API_KEY=sk-no-auth-lan-seat
AUDIO_TTS_MODEL=tts-1
AUDIO_TTS_VOICE=nova

# --- Telemetry off ---
ANONYMIZED_TELEMETRY=False
DO_NOT_TRACK=True
SCARF_NO_ANALYTICS=True