forked from NVIDIA/nemoclaw-community
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.example
More file actions
185 lines (172 loc) · 9.92 KB
/
Copy path.env.example
File metadata and controls
185 lines (172 loc) · 9.92 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
# Copy to .env and fill in real values, then:
# bash scripts/00-host-services.sh # phoenix, postgres, ETLs, postgrest (+ relay when ATIF_EXPORT_MODE=relay; + minio when ATIF_RELAY_BACKEND=minio)
# bash scripts/bring-up.sh # OpenShell gateway, v2 providers, sandbox
#
# Both scripts auto-source .env, so `cp .env.example .env` and run is enough.
# Prereq: `openshell settings set --global --key providers_v2_enabled --value true --yes` (02-providers.sh enforces this and prints the command if missing).
# ── Inference (the agent's LLM) ──────────────────────────────────────────
# At least one API key is required for the agent to call any LLM. Bring-up
# validates the endpoint, credential, and model before building the sandbox.
# COMPATIBLE_API_KEY is preferred; OPENAI_API_KEY is also accepted.
#
# For the default NemoClaw endpoint, get a key from https://build.nvidia.com:
# sign in, open any model page, and click "Get API Key". The key may start
# with `nvapi-` or `sk-` depending on the backend.
COMPATIBLE_API_KEY=
NEMOCLAW_MODEL=nvidia/nemotron-3-super-120b-a12b
# Preflight sends one bounded structured-tool request (default timeout: 10s),
# then confirms that OpenShell activated the requested provider and model.
# Remote endpoints must use HTTPS; loopback HTTP is allowed for local proxies.
# Set to 0 only for intentional offline setup or an endpoint that cannot
# support OpenAI-compatible verification.
NEMOCLAW_INFERENCE_PREFLIGHT=1
# NEMOCLAW_INFERENCE_PREFLIGHT_TIMEOUT_SECONDS=10
#
# Optional override for the inference endpoint (default
# https://integrate.api.nvidia.com/v1). Any OpenAI-compatible URL works
# — local vLLM, alternative NIM, or scripts/host-tls-proxy.py for
# corporate VPNs (see docs/host-tls-proxy.md).
# NEMOCLAW_ENDPOINT_URL=http://host.openshell.internal:18080/v1
# Optional: required only when the endpoint above uses the host TLS proxy.
# The proxy is installed separately after first bring-up; see docs/auto-heal.md.
# NEMOCLAW_HOST_TLS_PROXY_UPSTREAM=https://your-openai-compatible-api.example.com
# NEMOCLAW_HOST_TLS_PROXY_PORT=18080
# Optional absolute path to the managed host CA bundle mounted read-only into
# the GitHub/forum ETL and ATIF relay containers. Startup requires a readable
# regular file. The default is correct on the supported Ubuntu Omnistation
# image; override only when the host stores its trusted bundle elsewhere.
# NEMOCLAW_HOST_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
# ── Outlook (optional — recommended primary channel) ─────────────────────
# Outlook is opt-in: fill ALL FOUR OUTLOOK_* vars below to enable, or leave
# the entire block empty for a Slack-only setup. Partial configuration is
# rejected at bring-up. At least one of Outlook or Slack must be configured.
#
# Tenant + client IDs come from your Azure app registration. First bring-up
# runs a device-code login (see docs/set-up-outlook-bridge.md) and caches the
# refresh token to .bootstrap/cache/ms-graph-token.json (mode 0600).
#
# Cache control (default: 1):
# 0 — off (device-code login every bring-up, nothing on disk).
# 1 — use cache, auto-refresh on staleness. [default]
# 2 — force device-code login and rewrite the cache.
OUTLOOK_LOGIN_CACHE=1
OUTLOOK_TENANT_ID=
OUTLOOK_CLIENT_ID=
# Mailbox the agent reads/sends from, and the From: address it uses on replies.
# Example values: agent@yourcompany.com / you@yourcompany.com
OUTLOOK_TARGET_MAILBOX=
OUTLOOK_REPLY_TO=
# Optional: comma-separated allowlist of senders the agent will respond to.
# Leave empty to fall back to OUTLOOK_REPLY_TO.
OUTLOOK_ALLOWED_SENDERS=
# ── Slack ────────────────────────────────────────────────────────────────
# Both tokens are required to enable the Slack channel. SLACK_ALLOWED_IDS
# is an optional comma-separated allowlist of Slack user IDs (e.g.
# UR0A4QL5N) that can DM the agent; empty means anyone in the workspace.
SLACK_BOT_TOKEN=
SLACK_APP_TOKEN=
SLACK_ALLOWED_IDS=
# Optional native Slack Block Kit rendering for supported Markdown, including
# tables. Accepted values are exactly true or false. Default: false.
NEMOCLAW_SLACK_RICH_BLOCKS=true
# ── GitHub (live read-only REST) ─────────────────────────────────────────
# Resolved by the proxy on egress; policy.yaml constrains usage to read-only
# api.github.com routes for GITHUB_READONLY_REPO. Also authenticates the
# host-side GitHub mirror ETL (better rate limits) if enabled.
GITHUB_TOKEN=
# Live sandbox GitHub read-only scope (owner/repo). Sandbox-create reads
# this from .env; recreate the sandbox after changing it:
# bash scripts/tear-down.sh && bash scripts/bring-up.sh
GITHUB_READONLY_REPO=NVIDIA/OpenShell
# Optional host-side GitHub mirror. It is disabled by default so ordinary
# bring-up makes no GitHub ETL requests. Set the enable flag to 1 for deliberate
# authenticated or anonymous mirroring. This does not change live sandbox access.
# SOURCE_ETL_GITHUB_ENABLED=1
# SOURCE_ETL_GITHUB_REPO=NVIDIA/NemoClaw
# ── Optional: Telegram / Discord ─────────────────────────────────────────
# TELEGRAM_BOT_TOKEN=
# TELEGRAM_ALLOWED_IDS=
# DISCORD_BOT_TOKEN=
# ── Optional: Phoenix OpenInference egress ───────────────────────────────
# Set PHOENIX_COLLECTOR_ENDPOINT to stream OpenInference traces to a
# Phoenix collector for live inspection. 00-host-services.sh already runs
# Phoenix on host port 6006; the URL below routes the sandbox through the
# OpenShell host bridge to it.
# PHOENIX_COLLECTOR_ENDPOINT=http://host.openshell.internal:6006/v1/traces
# Phoenix project name (openinference.project.name on each span). Defaults
# to "default"; override to keep deployments separate in one Phoenix.
# PHOENIX_PROJECT_NAME=developer-community-chief-of-staff
# ── Optional: ATIF trace export ──────────────────────────────────────────
# Completed agent trajectories (ATIF) go either to the sandbox's local
# /tmp/atif (default; recover with scripts/download-traces.sh) or, in relay
# mode, through the host-side atif-export-relay to S3-compatible storage. The
# relay owns the bucket, key prefix, AND credentials — none enter the sandbox.
# All ATIF_RELAY_* vars below are read by the relay on the HOST.
# Full reference: docs/atif-export.md.
#
# Export mode (deployment-wide switch):
# local: traces stay in the sandbox at /tmp/atif. Default when unset.
# relay: route through atif-export-relay. Requires ATIF_RELAY_BACKEND.
# ATIF_EXPORT_MODE=local
#
# Relay downstream backend (only when ATIF_EXPORT_MODE=relay):
# minio: local MinIO container (dev/testing; no AWS infra).
# s3: real AWS S3 via host EC2 instance profile / IMDS (needs
# s3:PutObject, + kms:GenerateDataKey for SSE-KMS buckets).
# s3-compatible: external S3 store via explicit endpoint + static creds
# (OCI, Nebius, GCS XML, self-hosted). Set ATIF_RELAY_S3_* below.
# ATIF_RELAY_BACKEND=s3
#
# Downstream bucket the relay writes every object to. REQUIRED for backend=s3
# and s3-compatible (bring-up fails loud if unset). For backend=minio it
# defaults to nemo-relay-traces (the dev bucket).
# ATIF_RELAY_BUCKET=nemo-relay-traces
#
# AWS region for backend=s3 (signing region for s3-compatible). Default us-west-2.
# ATIF_RELAY_S3_REGION=us-west-2
#
# Endpoint + static creds for minio and s3-compatible (AWS s3 uses IMDS, not these):
# minio: optional; empty → http://localhost:9000 + minioadmin/minioadmin.
# s3-compatible: required (relay won't start without them).
# A remote endpoint must be https:// (http:// is allowed only for loopback MinIO).
# ATIF_RELAY_S3_ENDPOINT=
# ATIF_RELAY_S3_ACCESS_KEY=
# ATIF_RELAY_S3_SECRET_KEY=
#
# Object key = <prefixer output> + ATIF_RELAY_KEY_PREFIX + <bare key from sandbox>.
# ATIF_RELAY_PREFIXER picks the dynamic leading segment:
# none (default) no dynamic segment.
# ec2-instance-id prefix every key with "<instance-id>/" (resolved via IMDSv2;
# relay refuses to start off-EC2). Use when the bucket's IAM
# policy scopes PutObject to .../<instance-id>/*.
# Add your own in extras/atif-export-relay/backends/prefixers.py.
# ATIF_RELAY_PREFIXER=none
#
# Optional static segment after the prefixer output (add a trailing "/" to
# separate): prefixer=none + "hermes/" → "hermes/<key>".
# ATIF_RELAY_KEY_PREFIX=
#
# Per-VM bearer token for the relay. Normally leave UNSET — bring-up generates
# it into .bootstrap/cache/atif-relay-token and reuses it (rotate by deleting
# that file + .registered). Set here only to pin a value.
# ATIF_RELAY_AUTH_TOKEN=
#
# HTTP header the relay reads the bearer from (default matches the AWS-SDK client).
# ATIF_RELAY_AUTH_HEADER=X-Amz-Security-Token
#
# Public endpoint the sandbox connects to — single source of truth for the
# relay port, bridge upstream, policy egress rule, provider, and TLS cert SAN.
# Changing the host regenerates the cert on next bring-up (ATIF_RELAY_FORCE_CERT=1).
# ATIF_RELAY_ENDPOINT=https://host.openshell.internal:18443
# ── Optional: bring-up overrides ─────────────────────────────────────────
# SANDBOX_NAME=hermes-direct
#
# Gateway registration. Default (`openshell`) targets the package-managed
# install at https://127.0.0.1:17670. For snap installs, uncomment both
# lines (see deploy/snap/README.md):
# OPENSHELL_GATEWAY=openshell
# OPENSHELL_GATEWAY=snap-docker
# OPENSHELL_GATEWAY_ENDPOINT=http://127.0.0.1:17670
#
# SOURCE_ETL_API_HOST=host.openshell.internal
# SOURCE_ETL_API_PORT=3100