crucix 2.39.0 → 2.39.3

package/.env.example

@@ -1,149 +1,151 @@
-# ============================================
-# Crucix Intelligence Engine — Configuration
-# ============================================
-# Copy this file to .env and fill in your keys.
-# Keys are optional — sources without keys degrade gracefully.
-#
-# IMPORTANT: Do NOT put comments on the same line as values.
-# Docker env_file treats inline comments as part of the value.
-
-# === OSINT Source API Keys ===
-
-# Federal Reserve Economic Data (free: fred.stlouisfed.org/docs/api)
-FRED_API_KEY=
-# NASA FIRMS fire data (free: firms.modaps.eosdis.nasa.gov/api)
-FIRMS_MAP_KEY=
-# Energy Information Administration (free: api.eia.gov/register)
-EIA_API_KEY=
-# Financial Modeling Prep (free: site.financialmodelingprep.com/register, 250 calls/day): equities, indexes, forex in two
-# batch calls per sweep (192/day at the 15-minute sweep). FMP_DAILY_LIMIT caps the calls; without a key Yahoo covers it.
-FMP_API_KEY=
-FMP_DAILY_LIMIT=250
-# Finnhub (free: finnhub.io/register, 60 calls/minute): second quote source for the US-listed equities
-FINNHUB_API_KEY=
-# Base currency of the FX crosses: USD | EUR | GBP | HUF | JPY | CHF | CAD | AUD | CNY (each dashboard user can switch)
-CRUCIX_BASE_CURRENCY=USD
-# Maritime live AIS (free: aisstream.io/account, sign in with GitHub). With a key the dashboard server keeps one
-# aisstream.io WebSocket open and reports vessels seen at 11 chokepoints in the last hour; one-shot briefings do not.
-# A key allows 3 connections; the service has no SLA and no written licence or terms of use (aisstream issue #290).
-AISSTREAM_API_KEY=
-# Armed Conflict Location & Event Data (acleddata.com/user/register)
-ACLED_EMAIL=
-# OAuth2 password grant (API keys deprecated Sept 2025)
-ACLED_PASSWORD=
-# OpenSky Network API client (opensky-network.org/my-opensky/account -> Create a new API client -> credentials.json)
-# Optional: 4,000 instead of 400 credits/day and a refresh every 15 minutes instead of 2 hours; set both or neither
-OPENSKY_CLIENT_ID=
-OPENSKY_CLIENT_SECRET=
-# Cloudflare Radar internet outages & traffic anomalies (free: dash.cloudflare.com/profile/api-tokens, Account Analytics Read)
-CLOUDFLARE_API_TOKEN=
-
-# === Server Configuration ===
-
-# Dashboard server port
-PORT=3117
-# Auto-refresh interval (minutes)
-REFRESH_INTERVAL_MINUTES=15
-
-# === LLM Layer (optional) ===
-# Enables AI-enhanced trade ideas and breaking news Telegram alerts.
-# Provider options: anthropic | openai | gemini | codex | openrouter | minimax | mistral | ollama | grok | openai-compatible
-LLM_PROVIDER=
-# Not needed for codex (uses ~/.codex/auth.json) or ollama (local)
-LLM_API_KEY=
-# Optional override. Each provider has a sensible default:
-# anthropic: claude-sonnet-4-6 | openai: gpt-5.4 | gemini: gemini-3.1-pro | codex: first model in ~/.codex/models_cache.json (gpt-6.1-sol) | openrouter: openrouter/auto | minimax: MiniMax-M2.5 | ollama: llama3.1:8b | grok: grok-4-latest
-LLM_MODEL=
-# Ollama base URL (only needed if not using default http://localhost:11434)
-OLLAMA_BASE_URL=
-# Output language for the "Trade Ideas" LLM box. Supported: en | fr | hu
-# Falls back to CRUCIX_LANG, then to English if unset.
-TRADE_IDEAS_LANG=
-
-# === Telegram Alerts (optional; rules work without LLM) ===
-# Create a bot via @BotFather, get chat ID via @userinfobot
-TELEGRAM_BOT_TOKEN=
-TELEGRAM_CHAT_ID=
-# Alerts below this tier are not sent on their own but listed in /brief: FLASH | PRIORITY | ROUTINE (default PRIORITY)
-TELEGRAM_ALERT_MIN_TIER=PRIORITY
-# Group chats: only these Telegram user ids may run bot commands, /ask included (empty = anyone in TELEGRAM_CHAT_ID)
-TELEGRAM_ALLOWED_USER_IDS=
-# Local server access (HOST=0.0.0.0 enables LAN; Docker sets this internally)
-HOST=127.0.0.1
-AUTH_USER=
-AUTH_PASSWORD=
-PUBLIC_URL=
-MAX_SSE_CLIENTS=100
-NO_AUTO_OPEN=0
-# Opt-in browser access from other sites (comma lists of origins like https://example.com; empty = off, see docs/API.md and docs/EMBEDDING.md)
-# CORS_ORIGINS: pages from these origins may READ the GET /api routes (a lone * allows any site; only sensible with AUTH_USER/AUTH_PASSWORD)
-CORS_ORIGINS=
-# EMBED_ORIGINS: pages from these origins may show the dashboard (/) or the widget (/embed.html) in an iframe
-EMBED_ORIGINS=
-# Explicit opt-in to read public Telegram previews; never private bot updates
-TELEGRAM_OSINT_ENABLED=false
-# Optional user allowlist for Discord sweep/mute/unmute/ask (otherwise Manage Server required)
-DISCORD_ALLOWED_USER_IDS=
-DISCORD_ALERT_MIN_TIER=PRIORITY
-# === Bounded LLM requests / local OpenAI-compatible servers ===
-# LLM_PROVIDER=openai-compatible works with llama.cpp or LM Studio; key optional
-LLM_BASE_URL=
-# Independent from OLLAMA_BASE_URL; origin, /v1 or full chat/completions endpoint
-# LLM_PROVIDER=anthropic against a self-hosted Anthropic Messages API (gateway, router); origin, /v1 or full /v1/messages endpoint
-ANTHROPIC_BASE_URL=
-# Sent as Authorization: Bearer instead of x-api-key; use either this or LLM_API_KEY, not both
-ANTHROPIC_AUTH_TOKEN=
-LLM_IDEAS_MAX_TOKENS=4096
-LLM_IDEAS_TIMEOUT_MS=90000
-LLM_ALERT_MAX_TOKENS=800
-LLM_ALERT_TIMEOUT_MS=30000
-# Cited briefings (POST /api/briefing): tokens 128-8192, timeout 1000-360000 ms; a failure falls back to the rule-based briefing
-LLM_BRIEFING_MAX_TOKENS=1200
-LLM_BRIEFING_TIMEOUT_MS=60000
-# Bot /ask answers, from the latest sweep only: tokens 64-2048, timeout 1000-360000 ms
-LLM_ASK_MAX_TOKENS=500
-LLM_ASK_TIMEOUT_MS=45000
-# Optional only when your local model supports it: none|minimal|low|medium|high
-OLLAMA_REASONING_EFFORT=
-# 1=every sweep; 3=first sweep then sweeps 3,6,...; delta alerts still run every sweep
-LLM_IDEAS_EVERY_N_SWEEPS=1
-
-# === Sweep archive (replay, changes, source-health matrix) ===
-# Stored in RUNS_DIR/sweeps as one gzip file per sweep; the oldest go first when either limit is reached.
-# Sweeps kept, 2-672 (default 96 = 24 hours at a 15-minute refresh interval)
-SWEEP_ARCHIVE_COUNT=
-# Disk budget of the archive in MB, 4-512 (default 64); the newest sweep is always kept
-SWEEP_ARCHIVE_MAX_MB=
-
-# === Country risk, logged predictions and cited briefings ===
-# Stored in RUNS_DIR/intelligence (countries.json, predictions.json). The score is a heuristic 0-100 index, not a probability.
-# false skips the risk step: no files, no snapshot.risk, and /api/countries, /api/predictions and /api/briefing answer 404 (default true)
-RISK_ENABLED=
-# Days of event references and score history kept, 14-90 (default 35)
-RISK_RETENTION_DAYS=
-
-# === Alert engine notifications (optional) ===
-# Alerts always appear in the dashboard; these settings only control what is also sent out.
-# Telegram and Discord alerts use the TELEGRAM_* and DISCORD_* settings above; ntfy and the webhook are set here.
-# Send engine alerts to Telegram and/or Discord too: comma list of telegram, discord (default none; their /mute applies)
-ALERT_NOTIFY_CHANNELS=
-# Lowest severity that is sent: critical | high | watch | info (default high)
-ALERT_NOTIFY_MIN_SEVERITY=
-# Quiet hours in local time as HH:MM-HH:MM, for example 22:00-07:00; critical still goes through, the rest follows as one summary after the window
-ALERT_QUIET_HOURS=
-# Individual messages per sweep, 1-50 (default 5); further alerts are sent as one "+N more alerts" summary
-ALERT_MAX_NOTIFICATIONS_PER_SWEEP=
-# Dashboard address added as a link to every message and accepted as the page origin behind a reverse proxy, for example https://crucix.example.com (http or https, no user:password)
-ALERT_PUBLIC_URL=
-# Without AUTH_USER/AUTH_PASSWORD, alert changes are accepted only via localhost, an IP address, the ALERT_PUBLIC_URL host or these host names (comma list, e.g. crucix.lan)
-ALERT_ALLOWED_HOSTS=
-# ntfy topic URL, for example https://ntfy.sh/your-topic (http or https, no user:password)
-ALERT_NTFY_URL=
-# Optional ntfy access token sent as a Bearer header
-ALERT_NTFY_TOKEN=
-# Webhook URL that receives each alert as a JSON POST (http or https, no user:password)
-ALERT_WEBHOOK_URL=
-# Open alerts allowed per rule, 1-500 (default 50); more hits are counted but not opened
-ALERT_MAX_ACTIVE_PER_RULE=
-# Optional: the User-Agent sent to SEC EDGAR (SEC asks automated clients to declare contact details), for example "Example Org ops@example.org". Printable ASCII, at most 200 characters; empty uses the plain Crucix agent, which SEC accepts
-SEC_USER_AGENT=
+# ============================================
+# Crucix Intelligence Engine — Configuration
+# ============================================
+# Copy this file to .env and fill in your keys.
+# Keys are optional — sources without keys degrade gracefully.
+#
+# IMPORTANT: Do NOT put comments on the same line as values.
+# Docker env_file treats inline comments as part of the value.
+
+# === OSINT Source API Keys ===
+
+# Federal Reserve Economic Data (free: fred.stlouisfed.org/docs/api)
+FRED_API_KEY=
+# NASA FIRMS fire data (free: firms.modaps.eosdis.nasa.gov/api)
+FIRMS_MAP_KEY=
+# Energy Information Administration (free: api.eia.gov/register)
+EIA_API_KEY=
+# BLS Public Data (optional: data.bls.gov/registrationEngine). v1 is ~25/day; Crucix caches 12 hours. v2 is 500/day.
+BLS_API_KEY=
+# Financial Modeling Prep (free: site.financialmodelingprep.com/register, 250 calls/day): equities, indexes, forex in two
+# batch calls per sweep (192/day at the 15-minute sweep). FMP_DAILY_LIMIT caps the calls; without a key Yahoo covers it.
+FMP_API_KEY=
+FMP_DAILY_LIMIT=250
+# Finnhub (free: finnhub.io/register, 60 calls/minute): second quote source for the US-listed equities
+FINNHUB_API_KEY=
+# Base currency of the FX crosses: USD | EUR | GBP | HUF | JPY | CHF | CAD | AUD | CNY (each dashboard user can switch)
+CRUCIX_BASE_CURRENCY=USD
+# Maritime live AIS (free: aisstream.io/account, sign in with GitHub). With a key the dashboard server keeps one
+# aisstream.io WebSocket open and reports vessels seen at 11 chokepoints in the last hour; one-shot briefings do not.
+# A key allows 3 connections; the service has no SLA and no written licence or terms of use (aisstream issue #290).
+AISSTREAM_API_KEY=
+# Armed Conflict Location & Event Data (acleddata.com/user/register)
+ACLED_EMAIL=
+# OAuth2 password grant (API keys deprecated Sept 2025)
+ACLED_PASSWORD=
+# OpenSky Network API client (opensky-network.org/my-opensky/account -> Create a new API client -> credentials.json)
+# Optional: 4,000 instead of 400 credits/day and a refresh every 15 minutes instead of 2 hours; set both or neither
+OPENSKY_CLIENT_ID=
+OPENSKY_CLIENT_SECRET=
+# Cloudflare Radar internet outages & traffic anomalies (free: dash.cloudflare.com/profile/api-tokens, Account Analytics Read)
+CLOUDFLARE_API_TOKEN=
+
+# === Server Configuration ===
+
+# Dashboard server port
+PORT=3117
+# Auto-refresh interval (minutes)
+REFRESH_INTERVAL_MINUTES=15
+
+# === LLM Layer (optional) ===
+# Enables AI-enhanced trade ideas and breaking news Telegram alerts.
+# Provider options: anthropic | openai | gemini | codex | openrouter | minimax | mistral | ollama | grok | openai-compatible
+LLM_PROVIDER=
+# Not needed for codex (uses ~/.codex/auth.json) or ollama (local)
+LLM_API_KEY=
+# Optional override. Each provider has a sensible default:
+# anthropic: claude-sonnet-4-6 | openai: gpt-5.4 | gemini: gemini-3.1-pro | codex: first model in ~/.codex/models_cache.json (gpt-6.1-sol) | openrouter: openrouter/auto | minimax: MiniMax-M2.5 | ollama: llama3.1:8b | grok: grok-4-latest
+LLM_MODEL=
+# Ollama base URL (only needed if not using default http://localhost:11434)
+OLLAMA_BASE_URL=
+# Output language for the "Trade Ideas" LLM box. Supported: en | fr | hu
+# Falls back to CRUCIX_LANG, then to English if unset.
+TRADE_IDEAS_LANG=
+
+# === Telegram Alerts (optional; rules work without LLM) ===
+# Create a bot via @BotFather, get chat ID via @userinfobot
+TELEGRAM_BOT_TOKEN=
+TELEGRAM_CHAT_ID=
+# Alerts below this tier are not sent on their own but listed in /brief: FLASH | PRIORITY | ROUTINE (default PRIORITY)
+TELEGRAM_ALERT_MIN_TIER=PRIORITY
+# Group chats: only these Telegram user ids may run bot commands, /ask included (empty = anyone in TELEGRAM_CHAT_ID)
+TELEGRAM_ALLOWED_USER_IDS=
+# Local server access (HOST=0.0.0.0 enables LAN; Docker sets this internally)
+HOST=127.0.0.1
+AUTH_USER=
+AUTH_PASSWORD=
+PUBLIC_URL=
+MAX_SSE_CLIENTS=100
+NO_AUTO_OPEN=0
+# Opt-in browser access from other sites (comma lists of origins like https://example.com; empty = off, see docs/API.md and docs/EMBEDDING.md)
+# CORS_ORIGINS: pages from these origins may READ the GET /api routes (a lone * allows any site; only sensible with AUTH_USER/AUTH_PASSWORD)
+CORS_ORIGINS=
+# EMBED_ORIGINS: pages from these origins may show the dashboard (/) or the widget (/embed.html) in an iframe
+EMBED_ORIGINS=
+# Explicit opt-in to read public Telegram previews; never private bot updates
+TELEGRAM_OSINT_ENABLED=false
+# Optional user allowlist for Discord sweep/mute/unmute/ask (otherwise Manage Server required)
+DISCORD_ALLOWED_USER_IDS=
+DISCORD_ALERT_MIN_TIER=PRIORITY
+# === Bounded LLM requests / local OpenAI-compatible servers ===
+# LLM_PROVIDER=openai-compatible works with llama.cpp or LM Studio; key optional
+LLM_BASE_URL=
+# Independent from OLLAMA_BASE_URL; origin, /v1 or full chat/completions endpoint
+# LLM_PROVIDER=anthropic against a self-hosted Anthropic Messages API (gateway, router); origin, /v1 or full /v1/messages endpoint
+ANTHROPIC_BASE_URL=
+# Sent as Authorization: Bearer instead of x-api-key; use either this or LLM_API_KEY, not both
+ANTHROPIC_AUTH_TOKEN=
+LLM_IDEAS_MAX_TOKENS=4096
+LLM_IDEAS_TIMEOUT_MS=180000
+LLM_ALERT_MAX_TOKENS=800
+LLM_ALERT_TIMEOUT_MS=30000
+# Cited briefings (POST /api/briefing): tokens 128-8192, timeout 1000-360000 ms; a failure falls back to the rule-based briefing
+LLM_BRIEFING_MAX_TOKENS=1200
+LLM_BRIEFING_TIMEOUT_MS=60000
+# Bot /ask answers, from the latest sweep only: tokens 64-2048, timeout 1000-360000 ms
+LLM_ASK_MAX_TOKENS=500
+LLM_ASK_TIMEOUT_MS=45000
+# Optional only when your local model supports it: none|minimal|low|medium|high
+OLLAMA_REASONING_EFFORT=
+# 1=every sweep; 3=first sweep then sweeps 3,6,...; delta alerts still run every sweep
+LLM_IDEAS_EVERY_N_SWEEPS=1
+
+# === Sweep archive (replay, changes, source-health matrix) ===
+# Stored in RUNS_DIR/sweeps as one gzip file per sweep; the oldest go first when either limit is reached.
+# Sweeps kept, 2-672 (default 96 = 24 hours at a 15-minute refresh interval)
+SWEEP_ARCHIVE_COUNT=
+# Disk budget of the archive in MB, 4-512 (default 64); the newest sweep is always kept
+SWEEP_ARCHIVE_MAX_MB=
+
+# === Country risk, logged predictions and cited briefings ===
+# Stored in RUNS_DIR/intelligence (countries.json, predictions.json). The score is a heuristic 0-100 index, not a probability.
+# false skips the risk step: no files, no snapshot.risk, and /api/countries, /api/predictions and /api/briefing answer 404 (default true)
+RISK_ENABLED=
+# Days of event references and score history kept, 14-90 (default 35)
+RISK_RETENTION_DAYS=
+
+# === Alert engine notifications (optional) ===
+# Alerts always appear in the dashboard; these settings only control what is also sent out.
+# Telegram and Discord alerts use the TELEGRAM_* and DISCORD_* settings above; ntfy and the webhook are set here.
+# Send engine alerts to Telegram and/or Discord too: comma list of telegram, discord (default none; their /mute applies)
+ALERT_NOTIFY_CHANNELS=
+# Lowest severity that is sent: critical | high | watch | info (default high)
+ALERT_NOTIFY_MIN_SEVERITY=
+# Quiet hours in local time as HH:MM-HH:MM, for example 22:00-07:00; critical still goes through, the rest follows as one summary after the window
+ALERT_QUIET_HOURS=
+# Individual messages per sweep, 1-50 (default 5); further alerts are sent as one "+N more alerts" summary
+ALERT_MAX_NOTIFICATIONS_PER_SWEEP=
+# Dashboard address added as a link to every message and accepted as the page origin behind a reverse proxy, for example https://crucix.example.com (http or https, no user:password)
+ALERT_PUBLIC_URL=
+# Without AUTH_USER/AUTH_PASSWORD, alert changes are accepted only via localhost, an IP address, the ALERT_PUBLIC_URL host or these host names (comma list, e.g. crucix.lan)
+ALERT_ALLOWED_HOSTS=
+# ntfy topic URL, for example https://ntfy.sh/your-topic (http or https, no user:password)
+ALERT_NTFY_URL=
+# Optional ntfy access token sent as a Bearer header
+ALERT_NTFY_TOKEN=
+# Webhook URL that receives each alert as a JSON POST (http or https, no user:password)
+ALERT_WEBHOOK_URL=
+# Open alerts allowed per rule, 1-500 (default 50); more hits are counted but not opened
+ALERT_MAX_ACTIVE_PER_RULE=
+# Optional: the User-Agent sent to SEC EDGAR (SEC asks automated clients to declare contact details), for example "Example Org ops@example.org". Printable ASCII, at most 200 characters; empty uses the plain Crucix agent, which SEC accepts
+SEC_USER_AGENT=