claude
35c6ff5a71
Persist reminder presentations and retry state, atomically complete collapsed deliveries, fall back across away reaches, and block permanent failures visibly (V-715, V-678). Fail closed when enabled integrations lack credentials and keep remote arms explicitly dark (V-691). Give mavweb one sanitized, request-correlated error contract (V-689). Owner explicitly requested direct commits to master.
50 lines
2.4 KiB
Bash
50 lines
2.4 KiB
Bash
# Secrets for mavend's away-channel reaches. The file is still called
|
|
# telegram.env because compose names it that; it holds both reaches now.
|
|
# Copy this file to deploy/telegram.env and fill in real values.
|
|
# deploy/telegram.env is gitignored — never commit the real secrets.
|
|
TELEGRAM_BOT_TOKEN=
|
|
TELEGRAM_CHAT_ID=
|
|
|
|
# ntfy access token for the `maven` topic, the second reach (V-649). Mint it on
|
|
# the ntfy server with write access to that topic and nothing else:
|
|
# ntfy token add --expires=never maven
|
|
# Read access is not needed — mavend publishes and never subscribes.
|
|
NTFY_TOKEN=
|
|
|
|
# Bearer token for mavgpud, the workstation's GPU supervisor (V-673). It fronts
|
|
# the big model on a LAN port, so the token is the whole boundary in front of
|
|
# the card. Any long random string; mint one with:
|
|
# openssl rand -hex 32
|
|
# The same value goes in a file on workpc, named by token_file in
|
|
# deploy/mavgpud.json. Empty is valid only while workstation.model_disabled is
|
|
# true; enabling the LAN model arm without it fails Maven's config validation.
|
|
MAVEN_GPU_TOKEN=
|
|
|
|
# Bearer token used by Maven when it sends audio to the workstation's
|
|
# CrisperWhisper service. The matching CW2_TOKEN is installed on workpc; these
|
|
# two values must be identical. Leaving both unset is only safe while that
|
|
# remote STT service is bound to loopback or its STT block is disabled.
|
|
MAVEN_STT_TOKEN=
|
|
|
|
# Home Assistant is currently explicitly disabled in deploy/mavend.json. Keep
|
|
# this name in the canonical inventory so enabling that block cannot turn into
|
|
# a valid-looking configuration with an expanded-empty token.
|
|
HA_TOKEN=
|
|
|
|
# docker compose reads these from the repository-root `.env`, before it starts
|
|
# containers; they are listed here even though their destination differs so
|
|
# this remains the complete deployment inventory. Copy both lines to `.env`.
|
|
# Enabling with an empty token fails startup; false is the explicit dark state.
|
|
# MAVEN_AMBIENT_ENABLED=false
|
|
# MAVEN_AMBIENT_TOKEN=
|
|
|
|
# Workstation-side counterpart to MAVEN_STT_TOKEN. Install this line in the
|
|
# EnvironmentFile named by deploy/mavgpud.service (currently
|
|
# %h/Programs/cw2-service/cw2.env), not in homesrv's telegram.env.
|
|
# CW2_TOKEN=
|
|
|
|
# The encrypted database key has its own narrowly mounted file,
|
|
# deploy/db_key.env, and its own generator in deploy/README.md. It is named
|
|
# here so an operator auditing this one inventory sees every deployed secret.
|
|
# MAVEN_DB_KEY=
|