ThreatXtension/.env.example at master · barvhaim/ThreatXtension · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# =============================================================================
# ThreatXtension Environment Configuration
# =============================================================================
# Copy this file to .env and fill in your API keys
# For Docker deployment, these values are passed via docker-compose.yml

# =============================================================================
# LLM (Large Language Model) Configuration
# =============================================================================
# Provider options: openai, watsonx, rits, ollama
LLM_PROVIDER=openai
LLM_MODEL=gpt-4o

# -----------------------------------------------------------------------------
# OpenAI Configuration (Recommended for demos)
# Get your API key at: https://platform.openai.com/api-keys
# -----------------------------------------------------------------------------
OPENAI_API_KEY=

# -----------------------------------------------------------------------------
# WatsonX.ai Configuration (Alternative - IBM)
# Set LLM_PROVIDER=watsonx to use
# Get API key at: https://cloud.ibm.com/iam/apikeys
# -----------------------------------------------------------------------------
# WATSONX_URL=https://us-south.ml.cloud.ibm.com/
# WATSONX_APIKEY=
# WATSONX_PROJECT_ID=
# WX_PROJECT_ID=

# -----------------------------------------------------------------------------
# RITS Configuration (IBM Research Internal)
# Set LLM_PROVIDER=rits to use
# -----------------------------------------------------------------------------
# RITS_API_KEY=
# RITS_API_BASE_URL=

# -----------------------------------------------------------------------------
# Ollama Configuration (Local LLM - No API key needed)
# Set LLM_PROVIDER=ollama to use
# Requires Ollama running locally: https://ollama.ai
# -----------------------------------------------------------------------------
# OLLAMA_BASE_URL=http://localhost:11434

# =============================================================================
# Threat Intelligence
# =============================================================================
# VirusTotal API key for file hash reputation checks (optional)
# Get your API key at: https://www.virustotal.com/gui/my-apikey
VIRUSTOTAL_API_KEY=

# Chrome Stats API for behavioral threat intelligence (optional)
# Provides install trends, rating patterns, developer reputation analysis
# Get your API key at: https://chrome-stats.com/api
CHROMESTATS_API_KEY=
CHROMESTATS_API_URL=https://chrome-stats.com

# =============================================================================
# Application Settings
# =============================================================================
# Chrome version for extension download (used in User-Agent)
CHROME_VERSION=131.0

# Storage paths (these are set automatically in Docker)
EXTENSION_STORAGE_PATH=./extensions_storage
DATABASE_PATH=./threatxtension.db

# =============================================================================
# Isolated Docker egress (only used with docker-compose.override.yml)
# =============================================================================
# When running the network-restricted stack, the app has no direct internet;
# egress is limited to a fixed allowlist (Chrome Web Store, ChromeStats,
# VirusTotal, LangSmith). Add your LLM provider's host(s) here as anchored,
# comma-separated regex. Examples by LLM_PROVIDER:
#   openai-compatible (local, default) : ^host\.docker\.internal$
#   real OpenAI                        : ^api\.openai\.com$
#   WatsonX                            : (^|\.)ml\.cloud\.ibm\.com$
#   Ollama (on host)                   : ^host\.docker\.internal$
#   RITS                               : <host from RITS_API_BASE_URL>
EGRESS_ALLOW_EXTRA=^host\.docker\.internal$

# =============================================================================
# Development & Debugging (Optional)
# =============================================================================
# LangSmith tracing for debugging LLM calls
# LANGSMITH_TRACING=false
# LANGSMITH_ENDPOINT=https://api.smith.langchain.com
# LANGSMITH_API_KEY=
# LANGSMITH_PROJECT=threatxtension