8aec6aafcc
Users with Google accounts can now sign in without a password. Auth flow: - GET /auth/google → Google consent page (CSRF state cookie) - GET /auth/google/callback → exchange code, lookup user, set JWT - auth.json gains google_sub + google_email fields - set_password() no longer overwrites unrelated auth.json fields Admin setup: python manage_passwords.py google-add <username> <email> # add GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET to .env Per-user Gemini key: - get_user_gemini_key() reads gemini_api_key from auth.json - orchestrator_engine.run() accepts gemini_api_key param - orchestrator router passes user's key, falls back to server key login.html: "Sign in with Google" button above the password form. manage_passwords.py list: now shows auth method columns (pw / google). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
98 lines
5.1 KiB
Plaintext
98 lines
5.1 KiB
Plaintext
# Cortex .env reference — copy to .env and fill in values
|
|
# DO NOT commit .env — it contains secrets
|
|
|
|
# ── Agent identity ───────────────────────────────────────────────────────────
|
|
# Global display names used in distillation prompts and session logs.
|
|
# Individual persona identities live in home/{username}/persona/{name}/IDENTITY.md
|
|
AGENT_NAME=Inara
|
|
USER_NAME=Scott
|
|
|
|
# ── Home directory ────────────────────────────────────────────────────────────
|
|
# Root for all user/persona data. Layout: home/{username}/persona/{name}/
|
|
# Relative paths are resolved from the cortex/ directory.
|
|
# Default: ../home (i.e. Cortex_and_Inara_dev/home/)
|
|
# HOME_DIR=../home
|
|
|
|
# ── Google OAuth — "Sign in with Google" ────────────────────────────────────
|
|
# Create credentials at console.cloud.google.com → APIs & Services → Credentials
|
|
# Application type: Web Application
|
|
# Authorised redirect URI: https://cortex.dgrzone.com/auth/google/callback
|
|
# Pre-register users: cd cortex && .venv/bin/python manage_passwords.py google-add <user> <email>
|
|
# Per-user Gemini key: add "gemini_api_key": "AIza..." to home/{username}/auth.json
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
|
|
# ── Session auth ─────────────────────────────────────────────────────────────
|
|
# Generate with: python3 -c "import secrets; print(secrets.token_hex(32))"
|
|
JWT_SECRET=change-me-in-dotenv
|
|
JWT_EXPIRE_DAYS=30
|
|
|
|
# ── SMTP (invite emails + future notifications) ───────────────────────────────
|
|
SMTP_SERVER=linode.oneskyit.com
|
|
SMTP_PORT=465
|
|
SMTP_USERNAME=send_mail
|
|
SMTP_PASSWORD=
|
|
SMTP_FROM_EMAIL=noreply@oneskyit.com
|
|
SMTP_FROM_NAME=Cortex
|
|
# Base URL included in invite links
|
|
CORTEX_BASE_URL=https://cortex.dgrzone.com
|
|
|
|
# ── Server ──────────────────────────────────────────────────────────────────
|
|
HOST=0.0.0.0
|
|
PORT=8000
|
|
|
|
# ── Google Chat bot ──────────────────────────────────────────────────────────
|
|
# JWT audience for verifying inbound Workspace Add-on Chat webhook requests.
|
|
# For Workspace Add-on Chat apps, the aud claim = the endpoint URL.
|
|
# Leave blank to disable verification (dev/testing only).
|
|
GOOGLE_CHAT_AUDIENCE=https://cortex.dgrzone.com/channels/google-chat
|
|
|
|
# ── Nextcloud Talk bot ───────────────────────────────────────────────────────
|
|
NEXTCLOUD_URL=https://cloud.dgrzone.com
|
|
NEXTCLOUD_TALK_BOT_SECRET=
|
|
|
|
# ── LLM backends ────────────────────────────────────────────────────────────
|
|
# Primary backend: "claude" or "gemini" (other is always fallback)
|
|
PRIMARY_BACKEND=claude
|
|
|
|
# Timeouts in seconds
|
|
TIMEOUT_CLAUDE=60
|
|
TIMEOUT_GEMINI=120
|
|
|
|
# ── Orchestrator (Gemini API — not Gemini CLI) ───────────────────────────────
|
|
# Required for /orchestrate endpoint and tool use
|
|
# Free tier key: https://aistudio.google.com/apikey
|
|
GEMINI_API_KEY=
|
|
|
|
# Model for the orchestration tool loop (not the user-facing response)
|
|
ORCHESTRATOR_MODEL=gemini-2.5-flash
|
|
|
|
# Safety cap on tool loop iterations
|
|
ORCHESTRATOR_MAX_ROUNDS=10
|
|
|
|
# ── DuckDuckGo search ────────────────────────────────────────────────────────
|
|
# Leave blank for free unauthenticated tier
|
|
# Set to your API key for higher rate limits (paid DuckDuckGo account)
|
|
DDG_API_KEY=
|
|
DDG_MAX_RESULTS=5
|
|
|
|
# ── Aether Platform API ───────────────────────────────────────────────────────
|
|
# Used by orchestrator tools: ae_journal_search, ae_journal_entry_create, ae_task_list
|
|
# Same values as agents_sync/mcp/.env — copy from there
|
|
AE_API_URL=https://dev-api.oneskyit.com
|
|
AE_API_KEY=
|
|
AE_ACCOUNT_ID=
|
|
AE_API_TIMEOUT=15
|
|
|
|
# ── Distillation schedule ────────────────────────────────────────────────────
|
|
SCHEDULER_TIMEZONE=America/New_York
|
|
AUTO_DISTILL=true
|
|
AUTO_DISTILL_SHORT=true
|
|
AUTO_DISTILL_MID=true
|
|
AUTO_DISTILL_LONG=false # manual review recommended before enabling
|
|
|
|
# Memory tier token budgets (soft caps)
|
|
MEMORY_BUDGET_SHORT=3000
|
|
MEMORY_BUDGET_MID=2000
|
|
MEMORY_BUDGET_LONG=2000
|