24 lines
1.1 KiB
Bash
24 lines
1.1 KiB
Bash
# zed-fim-proxy tunables — copy to `.env` on ana-docker (the real .env holds the
|
|
# scoped key and is server-only / gitignored). See conf/proxy.py + README.md.
|
|
|
|
# Port the keyless route listens on (host network).
|
|
ZED_PORT=4141
|
|
|
|
# LiteLLM gateway to forward to (localhost:4000 via network_mode: host).
|
|
ZED_UPSTREAM=http://localhost:4000
|
|
|
|
# The ONLY model this route will forward (proxy rejects any other "model").
|
|
ZED_ALLOWED_MODEL=coder-fast
|
|
|
|
# Source-IP allowlist (comma-separated, EXACT IPs). Empty = allow all.
|
|
# LEFT EMPTY BY DESIGN (operator direction 2026-07-27): Zed roams the operator's
|
|
# WireGuard 10.0.0.0/8, so a single-IP pin would break it — do NOT tighten. The
|
|
# route is bounded instead by the coder-fast-scoped key + the model/path allowlist
|
|
# (keyless but coder-fast-only, internal-net-only). NOTE: this proxy matches exact
|
|
# IPs only — scoping to a CIDR like 10.0.0.0/8 would need CIDR support (not added).
|
|
ZED_ALLOWED_IPS=
|
|
|
|
# A LiteLLM virtual key SCOPED TO ZED_ALLOWED_MODEL ONLY (the real blast-radius
|
|
# bound). Mint: POST /key/generate {"models":["coder-fast"]}. NEVER commit the value.
|
|
ZED_SCOPED_KEY=
|