vh
e9362de065
Replacement candidate for the hand-rolled gateway-chat HTML surface, which the operator does not want to keep improving -- it has already produced two defects tonight. Chosen over Open WebUI on weight, measured from the registries rather than recalled: Lobe 143 MB compressed / 1 layer vs Open WebUI 1,825 MB / 19 layers, a 12.8x difference. Open WebUI was declined in June 2026 on weight and that still holds; its secondary recorded objection (empty-tools 400 against vLLM) is now moot since strip_empty_tools covers the normal API path and only missed LiteLLM's built-in playground. CREDENTIAL POSTURE: deliberately NOT the shared all-agents key, which reaches the paid GLM/Kimi passthroughs -- a LAN-exposed chat UI holding it would let anyone reaching the port spend vendor credits from a pool shared across every project. Minted a scoped LiteLLM virtual key (key_alias lobe-chat-esh) limited to the 20 free local models, and verified the scoping BOTH ways: gen answers, glm-5.2 / kimi-k3 / gen-frontier all return 'key not allowed to access model'. Secrets vaulted, host .env 0600. Verified from INSIDE the container, not just from the host: /v1/models returns the fleet seats and a gen round-trip returns 'ok', so the app's own network path and key both work. Container healthy, / -> 307 -> /chat -> 200. Documents the open question this deploy exists to answer: whether Lobe's TTS is ENV-configurable or UI-only. That is the operator's deciding criterion and is NOT yet established -- Open WebUI has dedicated AUDIO_TTS_* vars, Lobe documents a shared OPENAI_PROXY_URL which should carry TTS since LiteLLM serves audio/speech on the same base, but that is inference. Also records the ext-tts voice foot-gun: unknown voices 404 and can trip the router cooldown, so the voice must be pinned rather than left at a UI default.
43 lines
1.0 KiB
Plaintext
43 lines
1.0 KiB
Plaintext
# Secrets — real .env files must never land here, only .env.example templates.
|
|
.env
|
|
.env.local
|
|
.env.*.local
|
|
**/.env
|
|
!**/.env.example
|
|
|
|
# Live mirror of server /opt/docker/{compose,conf}/ trees pulled by
|
|
# sync-stacks.sh. Contains upstream compose files that can carry embedded
|
|
# plaintext credentials (e.g. legacy seafile/paperless configs), so we
|
|
# don't track them in git. Audited, hand-curated copies live under
|
|
# stacks/<name>/ and are the source of truth.
|
|
stacks-mirror/
|
|
|
|
# Staged htpasswd / secrets files that might get written to /tmp during
|
|
# helper scripts.
|
|
htpasswd-new
|
|
*.netrc
|
|
|
|
# Editor / OS cruft
|
|
.DS_Store
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
|
|
# Logs
|
|
*.log
|
|
*.log.*
|
|
|
|
# Claude Code runtime state — locks, scheduled-task ledgers, etc.
|
|
# Per-machine, not interesting cross-checkout.
|
|
.claude/scheduled_tasks.lock
|
|
.claude/*.lock
|
|
|
|
# graphify: commit only the lightweight labeled map; ignore heavy/regenerable artifacts
|
|
graphify-out/*
|
|
!graphify-out/GRAPH_REPORT.md
|
|
|
|
# Python bytecode (e.g. from local py_compile of stack wrappers)
|
|
__pycache__/
|
|
*.pyc
|
|
stacks/lobe-chat/.env
|