.env.example

# Copy to .env (or `export`) to configure TinySOC. The .env file is gitignored.

# ── Default: self-contained llama.cpp (CPU, no external services) ──
# This is the default if you set nothing. Models auto-download from the Hub
# on first launch. Set WEC_N_GPU_LAYERS=-1 if a GPU is available.
# WEC_BACKEND=llamacpp
# WEC_N_GPU_LAYERS=0

# ── Dev: point the explainer at an Ollama server (skip CPU model loads) ──
# WEC_BACKEND=ollama
# WEC_OLLAMA_URL=http://localhost:11434
# WEC_EXPLAIN_MODEL=gemma4:e4b
# WEC_OLLAMA_TIMEOUT=120

# ── Explainer model (defaults to the TinySOC fine-tune, auto-pulled) ──
# Default: Mroqui/TinySOC-Qwen2.5-3B / TinySOC-Qwen2.5-3B-Q5_K_M.gguf.
# Override with a local GGUF...
# WEC_BACKEND=llamacpp
# WEC_MODEL_PATH=models/TinySOC-Qwen2.5-3B-Q5_K_M.gguf
# ...or with another Hub model:
# WEC_MODEL_REPO=<user-or-org>/<repo>
# WEC_MODEL_FILE=<file>.gguf

# ── Live feed source (reads Wazuh alerts.json; auto-hidden if unavailable) ──
# Docker (default): tail the Wazuh manager container. Override its name/path:
# WEC_WAZUH_CONTAINER=wazuh-wazuh.manager-1
# WEC_ALERTS_PATH=/var/ossec/logs/alerts/alerts.json
# ...or tail a local alerts.json directly, no Docker:
# WEC_ALERTS_FILE=/path/to/alerts.json
# WEC_TZ=America/Toronto
# Allow picking the live source from the UI. Keep OFF on a shared/public deploy:
# it would let any visitor tail arbitrary local files. Enable only when self-hosting.
# WEC_ALLOW_UI_SOURCE=1