mirror of
https://github.com/turnstonelabs/turnstone.git
synced 2026-08-12 23:12:23 -06:00
Patrick Buckley
1728a4c0af
Drop the Tavily and DuckDuckGo (ddgs) web_search backends for a single self-hosted SearxNG service bundled into the docker-compose stacks. Core: - New SearXNGClient + _format_searxng; rewrite resolve_web_search_client to (backend, searxng_url, searxng_engines, ...). MCP backend + oauth_user guard unchanged. _resolve_search_client follows storage -> toml -> env -> default precedence (explicit "" disables, via ConfigStore.stored_keys()). - Drop the Tavily-era topic=finance (no SearxNG category); topic is now general/news. Settings/config: - Remove tools.tavily_api_key, get_tavily_key, $TAVILY_API_KEY, [api].tavily_key. - Add tools.searxng_url (default http://searxng:8080) + tools.searxng_engines, with get_searxng_url/get_searxng_engines. Compose + bundled config: - Internal-only searxng service (no published API port, :ro config, /healthz healthcheck, persistent searxng-cache volume) in both stacks; bundle turnstone/deploy/searxng/settings.yml (JSON output on, limiter off). - Caddy serves the SearxNG web UI on :8444 (dev: localhost-only; prod: opt-in). - bootstrap extractor + wheel packaging updated. Deps: drop the ddg extra + ddgs mypy override (regenerates uv.lock, removing the lxml/h2/brotli transitives). Docs: tools/docker/architecture/openshell + diagrams + config example + CHANGELOG; docs/docker.md carries the AGPL-3.0 §13 operator note. BREAKING: tools.web_search_backend no longer accepts "tavily"/"ddg"; tools.tavily_api_key and the ddg extra are removed. Run the bundled SearxNG (ships in the compose stacks) or set TURNSTONE_SEARXNG_URL to an external instance. Closes #545
62 lines
3.2 KiB
Bash
62 lines
3.2 KiB
Bash
# =============================================================================
|
|
# Turnstone environment overrides — ALL OPTIONAL for the dev stack.
|
|
#
|
|
# `docker compose up` from a clone works with zero config: every value below
|
|
# has a built-in (insecure) default. Copy this file to `.env` only to override.
|
|
#
|
|
# The PRODUCTION stack (turnstone/deploy/compose.yaml) has no baked-in secrets
|
|
# and DOES require TURNSTONE_JWT_SECRET and POSTGRES_PASSWORD.
|
|
#
|
|
# Note: for a turnstone process running on bare metal (not in a container),
|
|
# put secrets in ~/.config/turnstone/config.toml (chmod 0600), not the
|
|
# environment. See docs/docker.md "Join a bare-metal host".
|
|
# =============================================================================
|
|
|
|
# -- LLM backend --------------------------------------------------------------
|
|
# Optional: nodes boot without an LLM. Add real model backends from the console
|
|
# UI (Models tab). These only set the bootstrap default a node starts with.
|
|
# LLM_BASE_URL=http://host.docker.internal:8000/v1
|
|
# OPENAI_API_KEY=dummy
|
|
# ANTHROPIC_API_KEY=sk-ant-... # set instead of OPENAI_API_KEY for Anthropic
|
|
# TURNSTONE_SEARXNG_URL=http://searxng:8080 # web_search backend (default: bundled service; set to an external SearxNG)
|
|
# MODEL= # default model alias
|
|
|
|
# -- Secrets ------------------------------------------------------------------
|
|
# The dev stack defaults these to INSECURE values. Always set real ones for
|
|
# anything reachable beyond localhost. Generate the JWT secret with:
|
|
# python -c "import secrets; print(secrets.token_hex(32))"
|
|
# TURNSTONE_JWT_SECRET=
|
|
# POSTGRES_PASSWORD=
|
|
|
|
# -- Database -----------------------------------------------------------------
|
|
# Defaults to the bundled PostgreSQL (shared by every service — required for
|
|
# the console to discover nodes). Override to point at an external database:
|
|
# TURNSTONE_DB_BACKEND=postgresql
|
|
# POSTGRES_USER=turnstone
|
|
# TURNSTONE_DB_URL=postgresql+psycopg://turnstone:<pw>@postgres:5432/turnstone
|
|
|
|
# -- Ports / networking -------------------------------------------------------
|
|
# The dashboard is reached via Caddy only (HTTP/2 avoids the browser's
|
|
# 6-connection cap on the console's SSE streams). Both stacks expose the same
|
|
# two host ports; everything else is proxied through the console.
|
|
# CONSOLE_HTTPS_PORT=8443 # Caddy (dashboard HTTPS)
|
|
# POSTGRES_PORT=5432 # exposed for bare-metal host joins
|
|
# POSTGRES_BIND=127.0.0.1 # set 0.0.0.0 to let another machine join
|
|
|
|
# -- Workspace ----------------------------------------------------------------
|
|
# Bind-mount a host directory the model can read/write at /workspace:
|
|
# WORKSPACE_MOUNT=/path/to/your/project
|
|
|
|
# -- Agent behavior -----------------------------------------------------------
|
|
# SKIP_PERMISSIONS=true # auto-approve all tool calls (dev only)
|
|
# MCP_CONFIG=/workspace/mcp.json # MCP server config file
|
|
|
|
# -- Channel gateway (Discord / Slack) ----------------------------------------
|
|
# TURNSTONE_DISCORD_TOKEN=
|
|
# TURNSTONE_DISCORD_GUILD=0
|
|
# TURNSTONE_SLACK_TOKEN=xoxb-...
|
|
# TURNSTONE_SLACK_APP_TOKEN=xapp-...
|
|
|
|
# -- Production image tag ------------------------------------------------------
|
|
# TURNSTONE_IMAGE_TAG=latest # pin the ghcr.io image (production stack)
|