|
1 | | -# Azure Search for storing the processed documents |
2 | | -AZURE_SEARCH_SERVICE= |
3 | | -AZURE_SEARCH_INDEX= |
4 | | -AZURE_SEARCH_KEY= |
5 | | -AZURE_SEARCH_USE_SEMANTIC_SEARCH=False |
6 | | -AZURE_SEARCH_SEMANTIC_SEARCH_CONFIG=default |
7 | | -AZURE_SEARCH_TOP_K=5 |
8 | | -AZURE_SEARCH_ENABLE_IN_DOMAIN=False |
9 | | -AZURE_SEARCH_FIELDS_ID=id |
10 | | -AZURE_SEARCH_CONTENT_COLUMN=content |
11 | | -AZURE_SEARCH_CONTENT_VECTOR_COLUMN=content_vector |
12 | | -AZURE_SEARCH_DIMENSIONS=1536 |
13 | | -AZURE_SEARCH_FIELDS_TAG=tag |
14 | | -AZURE_SEARCH_FIELDS_METADATA=metadata |
15 | | -AZURE_SEARCH_FILENAME_COLUMN=filepath |
16 | | -AZURE_SEARCH_TITLE_COLUMN=title |
17 | | -AZURE_SEARCH_SOURCE_COLUMN=source |
18 | | -AZURE_SEARCH_TEXT_COLUMN=text |
19 | | -AZURE_SEARCH_LAYOUT_TEXT_COLUMN=layoutText |
20 | | -AZURE_SEARCH_URL_COLUMN=url |
21 | | -AZURE_SEARCH_CONVERSATIONS_LOG_INDEX=conversations-log |
22 | | -AZURE_SEARCH_USE_INTEGRATED_VECTORIZATION=false |
23 | | -AZURE_SEARCH_INDEXER_NAME= |
24 | | -AZURE_SEARCH_DATASOURCE_NAME= |
25 | | -# Azure OpenAI for generating the answer and computing the embedding of the documents |
26 | | -AZURE_OPENAI_RESOURCE= |
27 | | -AZURE_OPENAI_API_KEY= |
28 | | -AZURE_OPENAI_MODEL=gpt-4o |
29 | | -AZURE_OPENAI_MODEL_NAME=gpt-4o |
30 | | -AZURE_OPENAI_EMBEDDING_MODEL=text-embedding-3-small |
31 | | -AZURE_OPENAI_TEMPERATURE=0 |
32 | | -AZURE_OPENAI_TOP_P=1.0 |
33 | | -AZURE_OPENAI_MAX_TOKENS=1000 |
34 | | -AZURE_OPENAI_STOP_SEQUENCE= |
35 | | -AZURE_OPENAI_SYSTEM_MESSAGE=You are an AI assistant that helps people find information. |
36 | | -AZURE_OPENAI_API_VERSION=2024-02-01 |
37 | | -AZURE_OPENAI_STREAM=True |
38 | | -# Backend for processing the documents and application logging in the app |
39 | | -AzureWebJobsStorage= |
40 | | -BACKEND_URL=http://localhost:7071 |
| 1 | +# CWYD v2 local dev environment template. |
| 2 | +# |
| 3 | +# Copy to .env (gitignored) and fill in values for any external services you |
| 4 | +# want to hit. Every variable name below matches the canonical AppSettings field |
| 5 | +# in src/backend/core/settings.py and the corresponding Bicep output in |
| 6 | +# infra/main.bicep -- no v1 aliases. Pydantic-settings ignores unknown |
| 7 | +# variables, so a typo here silently does nothing; double-check spelling. |
| 8 | +# |
| 9 | +# Single source of truth at repo root (CU-008a, 2026-05-05). The previous |
| 10 | +# docker/.env.dev.example file was deleted; do not recreate it. |
| 11 | +# |
| 12 | +# Defaults: docker-compose.dev.yml hard-codes the local stack (azurite + a |
| 13 | +# pgvector-enabled postgres container) by overriding AZURE_DB_TYPE, |
| 14 | +# AZURE_INDEX_STORE, AZURE_POSTGRES_ENDPOINT, AZURE_STORAGE_BLOB_URL, and |
| 15 | +# AZURE_STORAGE_QUEUE_URL on the backend service. Setting those four here has |
| 16 | +# no effect on the default profile -- only matters if you override compose. |
41 | 17 |
|
42 | | -# Enhanced logging configuration (optional) |
43 | | -LOGLEVEL=INFO |
44 | | -PACKAGE_LOGGING_LEVEL=WARNING |
45 | | -# AZURE_LOGGING_PACKAGES=azure.core,azure.identity |
46 | | -DOCUMENT_PROCESSING_QUEUE_NAME= |
47 | | -AZURE_BLOB_ACCOUNT_NAME= |
48 | | -AZURE_BLOB_ACCOUNT_KEY= |
49 | | -AZURE_BLOB_CONTAINER_NAME= |
50 | | -# Azure Form Recognizer for extracting the text from the documents |
51 | | -AZURE_FORM_RECOGNIZER_ENDPOINT= |
52 | | -AZURE_FORM_RECOGNIZER_KEY= |
53 | | -# Azure AI Content Safety for filtering out the inappropriate questions or answers |
54 | | -AZURE_CONTENT_SAFETY_ENDPOINT= |
55 | | -AZURE_CONTENT_SAFETY_KEY= |
56 | | -# Orchestration strategy. Use Azure OpenAI Functions (openai_function), Semantic Kernel (semantic_kernel), LangChain (langchain) or Prompt Flow (prompt_flow) for messages orchestration. If you are using a new model version 0613 select any strategy, if you are using a 0314 model version select "langchain". Note that both `openai_function` and `semantic_kernel` use OpenAI function calling. |
57 | | -ORCHESTRATION_STRATEGY=openai_function |
58 | | -# If selected Prompt Flow as orchestration strategy, please provide the following environment variables. Note that Prompt Flow does not support RBAC authentication currently. |
59 | | -AZURE_ML_WORKSPACE_NAME= |
60 | | -PROMPT_FLOW_DEPLOYMENT_NAME= |
61 | | -PROMPT_FLOW_ENDPOINT_NAME= |
62 | | -#Speech-to-text feature |
63 | | -AZURE_SPEECH_SERVICE_KEY= |
| 18 | +# --- Azure AI / Foundry IQ (required for real LLM calls; mocked otherwise) --- |
| 19 | +# FoundrySettings.services_endpoint -- host of the unified AI Services account |
| 20 | +# (kind=AIServices). Drives the Document Intelligence ingestion parser |
| 21 | +# (Functions batch_push) and the Foundry IQ embeddings client. MUST be a |
| 22 | +# non-empty https:// URL or PDF/DOCX ingestion fails fast with an actionable |
| 23 | +# error (BUG-0034). Bicep output: AZURE_AI_SERVICES_ENDPOINT in infra/main.bicep. |
| 24 | +AZURE_AI_SERVICES_ENDPOINT= |
| 25 | +# FoundrySettings.project_endpoint -- Agent Framework + LangGraph both use this. |
| 26 | +AZURE_AI_PROJECT_ENDPOINT= |
| 27 | +# OpenAISettings.* -- model deployment names exposed via the Foundry account. |
| 28 | +AZURE_OPENAI_GPT_DEPLOYMENT=gpt-5.1 |
| 29 | +AZURE_OPENAI_EMBEDDING_DEPLOYMENT=text-embedding-3-large |
| 30 | +AZURE_OPENAI_API_VERSION=2024-12-01-preview |
| 31 | + |
| 32 | +# --- Azure AI Search (cosmosdb-mode only; ignored in pgvector dev default) --- |
| 33 | +# SearchSettings.endpoint -- full https URL of the search service. |
| 34 | +AZURE_AI_SEARCH_ENDPOINT= |
| 35 | +AZURE_AI_SEARCH_INDEX=cwyd-index |
| 36 | +# SearchSettings.knowledge_base_* -- Foundry IQ Knowledge Base over the index |
| 37 | +# (grounds the agent_framework orchestrator). The KB REST API version is pinned |
| 38 | +# here so it can be bumped without a code change. |
| 39 | +AZURE_AI_SEARCH_KNOWLEDGE_BASE_NAME=cwyd-kb |
| 40 | +AZURE_AI_SEARCH_KNOWLEDGE_SOURCE_NAME=cwyd-index-ks |
| 41 | +AZURE_AI_SEARCH_KNOWLEDGE_BASE_API_VERSION=2025-11-01-preview |
| 42 | + |
| 43 | +# --- Identity (optional locally; uses AzureCliCredential when unset) --- |
| 44 | +# IdentitySettings.* -- AppSettings reads AZURE_TENANT_ID + AZURE_UAMI_CLIENT_ID. |
| 45 | +AZURE_TENANT_ID= |
| 46 | +AZURE_UAMI_CLIENT_ID= |
| 47 | + |
| 48 | +# --- Orchestrator selection (runtime-tunable; CWYD_ namespace by design) --- |
| 49 | +# OrchestratorSettings.name -- "langgraph" or "agent_framework". Both |
| 50 | +# orchestrators ground on either index store and are switchable from the admin |
| 51 | +# UI without a redeploy. On pgvector (AZURE_DB_TYPE=postgresql) both run |
| 52 | +# app-side RAG over the pgvector index; on Azure AI Search (cosmosdb mode) |
| 53 | +# agent_framework additionally grounds on a Foundry IQ Knowledge Base over that |
| 54 | +# index, while langgraph runs client-side RAG. ADR 0027 supersedes the ADR 0022 |
| 55 | +# pgvector + agent_framework block, so neither pairing is rejected. The local |
| 56 | +# dev compose default database is pgvector. |
| 57 | +CWYD_ORCHESTRATOR_NAME=agent_framework |
| 58 | +# |
| 59 | +# Foundry agent identity is NOT configured here (CU-009, ADR 0008). |
| 60 | +# Agents are bootstrapped lazily on first request and cached in the |
| 61 | +# application database (Cosmos in cosmosdb mode, Postgres in postgresql |
| 62 | +# mode). To force re-creation, delete the row in the `agents` table. |
| 63 | +# See v2/docs/agents.md for details. |
| 64 | + |
| 65 | +# --- Observability --- |
| 66 | +# ObservabilitySettings.log_level -- AppSettings env_prefix is AZURE_, so the |
| 67 | +# var name is AZURE_LOG_LEVEL (bare LOG_LEVEL in v1 is silently ignored). |
| 68 | +AZURE_LOG_LEVEL=INFO |
| 69 | +# ObservabilitySettings.app_insights_connection_string -- when set, |
| 70 | +# azure-monitor-opentelemetry exports directly to App Insights. AppSettings |
| 71 | +# reads the AZURE_-prefixed name (env_prefix=AZURE_); the legacy bare |
| 72 | +# `APPLICATIONINSIGHTS_CONNECTION_STRING` is intentionally not honored |
| 73 | +# post-CU-002b -- use the typed name only. |
| 74 | +AZURE_APP_INSIGHTS_CONNECTION_STRING= |
| 75 | + |
| 76 | +# --- Backend HTTP (CORS, etc.) --- |
| 77 | +# Comma-separated list of allowed origins for the FastAPI CORSMiddleware. |
| 78 | +# Wired into NetworkSettings.cors_origins via CU-002. |
| 79 | +BACKEND_CORS_ORIGINS=http://localhost:5173 |
| 80 | + |
| 81 | +# --- Speech-to-text (S1 / SPEECH-MVP, optional) --- |
| 82 | +# Populate to enable the `/api/speech` route used by the browser |
| 83 | +# microphone button. Empty -> route returns 503 (feature disabled). |
| 84 | +# AAD-only: the workload identity (UAMI in production, AzureCli / |
| 85 | +# DefaultAzureCredential locally) must hold `Cognitive Services Speech |
| 86 | +# User` on the Speech account. NO subscription key (Hard Rule #2). |
| 87 | +AZURE_SPEECH_SERVICE_NAME= |
64 | 88 | AZURE_SPEECH_SERVICE_REGION= |
65 | | -# Auth type environment variables. |
66 | | -# When AZURE_AUTH_TYPE=rbac, please make sure variable USE_KEY_VAULT=false |
67 | | -# When USE_KEY_VAULT=true, please make sure to set AZURE_KEY_VAULT_ENDPOINT |
68 | | -AZURE_AUTH_TYPE=keys |
69 | | -USE_KEY_VAULT=true |
70 | | -AZURE_KEY_VAULT_ENDPOINT= |
71 | | -# Application environment (e.g., dev, prod) |
72 | | -APP_ENV="dev" |
73 | | -# Chat conversation type to decide between custom or byod (bring your own data) conversation type |
74 | | -CONVERSATION_FLOW= |
75 | | -# Chat History CosmosDB Integration Settings |
76 | | -AZURE_COSMOSDB_ACCOUNT_NAME= |
77 | | -AZURE_COSMOSDB_ACCOUNT_KEY= |
78 | | -AZURE_COSMOSDB_DATABASE_NAME= |
79 | | -AZURE_COSMOSDB_CONVERSATIONS_CONTAINER_NAME= |
80 | | -AZURE_COSMOSDB_ENABLE_FEEDBACK= |
81 | | -AZURE_POSTGRESQL_HOST_NAME= |
82 | | -AZURE_POSTGRESQL_DATABASE_NAME= |
83 | | -AZURE_POSTGRESQL_USER= |
84 | | -DATABASE_TYPE="CosmosDB" |
| 89 | +# Full ARM resource id of the Speech account; goes in the |
| 90 | +# `x-ms-cognitiveservices-resource-id` header during AAD token mint. |
| 91 | +AZURE_SPEECH_ACCOUNT_RESOURCE_ID= |
| 92 | +# Comma-separated BCP-47 language tags the recognizer auto-detects. |
| 93 | +AZURE_SPEECH_RECOGNIZER_LANGUAGES=en-US,fr-FR,de-DE,it-IT |
| 94 | + |
| 95 | +# --- Content Safety (PARITY-IMPL, optional) --- |
| 96 | +# Wires the prompt-shielding guard the chat pipeline runs before every |
| 97 | +# Foundry IQ call (`ContentSafetyGuard.screen()` posts to the |
| 98 | +# `AnalyzeText` REST endpoint). Empty endpoint -> lifespan leaves |
| 99 | +# `app.state.content_safety_client = None` and `get_content_safety_guard` |
| 100 | +# returns None so the pipeline runs unguarded (mirrors v1 |
| 101 | +# `enable_content_safety: false` default). |
| 102 | +# AAD-only: the workload identity must hold `Cognitive Services User` |
| 103 | +# (a97b65f3-24c7-4388-baec-2e87135dc908) on the account. NO |
| 104 | +# subscription key (Hard Rule #2). |
| 105 | +AZURE_CONTENT_SAFETY_ENDPOINT= |
| 106 | +# Defaults to true (secure-by-default). Both `enabled=true` AND a |
| 107 | +# non-empty endpoint are required to construct the client at lifespan |
| 108 | +# start, so this stays inert until AZURE_CONTENT_SAFETY_ENDPOINT is |
| 109 | +# set above. Operators flip the guard OFF per-request via |
| 110 | +# `PATCH /api/admin/config {"content_safety_enabled": false}` |
| 111 | +# (`RuntimeConfig` override; `false` short-circuits to None even when |
| 112 | +# the lifespan client is present). |
| 113 | +AZURE_CONTENT_SAFETY_ENABLED=true |
| 114 | +# Inclusive lower bound at which Content Safety verdicts trip. Azure |
| 115 | +# reports severity 0/2/4/6 (0=safe, 2=low, 4=medium, 6=high); default |
| 116 | +# 4 matches v1's `enable_content_safety: true` behavior. Range 0-7. |
| 117 | +AZURE_CONTENT_SAFETY_SEVERITY_THRESHOLD=4 |
| 118 | + |
| 119 | +# --- Frontend (consumed by the frontend container build) --- |
| 120 | +VITE_BACKEND_URL=http://localhost:8000 |
0 commit comments