mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
3e9ba38fc1
Add opt-in hardening to the agents-as-a-service example: - commented runtimeClassName/nodeSelector fields for sandboxes and Deployments - optional sandbox NetworkPolicy plus exposure-variant policies - optional dsh-provider-keys-extra Secret for extra provider keys - docs/optional-hardening.md with verification, caveats and rollback The base walkthrough stays portable; no gateway code, routes or auth changed. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
51 lines
1.6 KiB
Plaintext
51 lines
1.6 KiB
Plaintext
# Copy to .env and fill in. Never commit a real key.
|
|
#
|
|
# The version values below are documentation only: versions.env is the single
|
|
# source of truth, and scripts/check-versions.sh fails if they drift.
|
|
|
|
# --- Main DSH Web image (root Dockerfile) ---
|
|
DEEPSEEK_API_KEY=
|
|
# Optional additional provider keys consumed by DSH. For Docker, pass them with
|
|
# -e; the Kubernetes examples inject them through the optional
|
|
# dsh-provider-keys-extra Secret.
|
|
OPENROUTER_API_KEY=
|
|
GEMINI_API_KEY=
|
|
NVIDIA_API_KEY=
|
|
OPENAI_API_KEY=
|
|
ANTHROPIC_API_KEY=
|
|
GROQ_API_KEY=
|
|
XAI_API_KEY=
|
|
MISTRAL_API_KEY=
|
|
TOGETHER_API_KEY=
|
|
CEREBRAS_API_KEY=
|
|
AI_GATEWAY_API_KEY=
|
|
HF_TOKEN=
|
|
DSH_VERSION=dsh-v0.2.1-rc.3
|
|
RELEASE_REVISION=r3
|
|
PNPM_VERSION=11.28.5
|
|
# Container port, and the host port published by "make run".
|
|
DSH_PORT=3080
|
|
# Comma/space separated extra Host allow-list entries for DSH (for a proxy or
|
|
# public hostname). localhost and 127.0.0.1 are always trusted.
|
|
DSH_TRUSTED_HOSTS=
|
|
|
|
# --- agents-as-a-service example ---
|
|
NAMESPACE=dsh-demo
|
|
POOL=dsh-pool
|
|
# Seconds a sandbox may stay idle before the sweeper suspends it, and the max
|
|
# time a proxied request waits for a suspended sandbox to become Ready.
|
|
IDLE_TIMEOUT=360
|
|
WAKE_TIMEOUT=240
|
|
DSH_CONTAINER=dsh-web
|
|
DSH_LOG_TAIL_LINES=2000
|
|
COOKIE_NAME=dsh_gw_session
|
|
# Set to true only behind HTTPS; secure cookies are not sent over plain HTTP
|
|
# (localhost counts as a secure context in browsers).
|
|
COOKIE_SECURE=false
|
|
COOKIE_MAX_AGE=604800
|
|
MAX_BODY_MB=32
|
|
HTTP_TIMEOUT=300
|
|
# SSO is opt-in. Set this only when the gateway Service is reachable
|
|
# exclusively through oauth2-proxy (see the example exposure docs).
|
|
# AUTH_PROXY_HEADER=X-Forwarded-User
|