From 1c2e36c2558ccb5f865dc0b9202fbea5b515d69c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Sat, 27 Jun 2026 14:05:03 +0200 Subject: [PATCH] ops: whitelist ALLOW_LOCAL_AI_PRIVATE_HOSTS in the bundled compose The local AI provider's private-host opt-in is read from the environment but was missing from the compose environment whitelist, so the value never reached the container. Add it (and document it in the env example) so a self-hoster can point the local provider at an internal Ollama / LM Studio host. --- .env.production.example | 6 ++++++ docker-compose.yml | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/.env.production.example b/.env.production.example index dcfe5afeb..2a3edb30a 100644 --- a/.env.production.example +++ b/.env.production.example @@ -162,6 +162,12 @@ API_TOKEN_HMAC_KEY="" # docs/ops/tls-cert-pin.md for extraction + the re-pin runbook. # TLS_LEAF_SPKI_PINS="" +# Local-AI SSRF opt-in (optional). The local AI provider rejects private/ +# internal hosts by default. Set to an exact host allowlist (comma-separated, +# e.g. "ollama.lan,10.0.0.5") or "true" for any private host — intended for a +# self-hosted Ollama / LM Studio endpoint. See docs/integrations/ai-providers.md. +# ALLOW_LOCAL_AI_PRIVATE_HOSTS="" + # ----------------------------------------------------------------------------- # Off-host backups -- all-or-none diff --git a/docker-compose.yml b/docker-compose.yml index f28293eee..8b12fe468 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -146,6 +146,13 @@ services: # container (the `environment:` block is a whitelist). See # docs/ops/tls-cert-pin.md. TLS_LEAF_SPKI_PINS: "${TLS_LEAF_SPKI_PINS:-}" + # Local-AI SSRF opt-in (optional). The local AI provider rejects + # private/internal hosts by default; set this to an exact host allowlist + # (e.g. "ollama.lan,10.0.0.5") or "true" for any private host, intended + # for a self-hosted Ollama / LM Studio. Listed here so an operator value + # in .env reaches the container (the `environment:` block is a whitelist). + # See docs/integrations/ai-providers.md. + ALLOW_LOCAL_AI_PRIVATE_HOSTS: "${ALLOW_LOCAL_AI_PRIVATE_HOSTS:-}" # v1.17.1 — SMTP transport for the email notification channel (optional, # all-or-none: HOST + PORT + FROM enable it; USER/PASS optional; SECURE # toggles implicit TLS). Listed here so operator values in .env reach the