Files
obsidian-wiki/.env.example
T
Codex 7eb9b987ab feat(mcp): harden remote assets and job execution
Gate source-file downloads and verify registry paths and content hashes. Stream multipart uploads with bounded limits, supervise OpenCode jobs with explicit result markers and timeouts, and preserve managed endpoint security settings. Document the trusted-client boundary and add focused regression coverage.

Validation: PYTHONPATH=<staged-tree> python -m unittest discover -s tests (182 tests)
2026-07-09 21:44:48 +00:00

181 lines
7.8 KiB
Bash

# =============================================================================
# Obsidian Wiki — Environment Configuration
# Copy this to .env and set your vault path
# =============================================================================
# --- Required ---
# Absolute path to your Obsidian vault
OBSIDIAN_VAULT_PATH=
# --- Optional ---
# Comma-separated source directories to ingest documents from
# Leave empty to skip document ingestion
OBSIDIAN_SOURCES_DIR=
# Copy file-based sources into the vault before ingest so citations survive
# machine moves and Linux/Web deployment. Archived files are immutable and
# tracked in _meta/source-registry.jsonl.
WIKI_ARCHIVE_SOURCES=true
OBSIDIAN_SOURCE_ARCHIVE_DIR=_sources/archive
# Maintain content-based source catalog pages that link to archived originals
# without copying the same file into multiple folders.
WIKI_SOURCE_CATALOG=true
OBSIDIAN_SOURCE_CATALOG_DIR=_sources/catalog
# SQLite source-file locator. Leave empty to use _meta/file-assets.sqlite.
OBSIDIAN_FILE_ASSET_DB=
# --- Business Facts / Kingdee Sales Orders (optional) ---
#
# Exact operational statistics use <vault>/_meta/business-facts.sqlite.
# Run `obsidian-wiki business config kingdee` to create the local private
# .runtime/kingdee.env file for real Kingdee credentials and token settings.
# Do not put real app secrets or access tokens in this example file.
OBSIDIAN_BUSINESS_FACTS_DB=
# --- Source File MCP Server (optional) ---
#
# Run with: obsidian-wiki-mcp
# Install extra: pip install "obsidian-wiki[mcp]"
# Metadata/search is limited to safe engineering source files. Downloading the
# underlying source bytes is a separate opt-in and defaults off for new managed
# installs; metadata tools remain available when it is disabled.
OBSIDIAN_MCP_BOT_PROFILE=bjd-general-bot
OBSIDIAN_MCP_MAX_FILE_BYTES=26214400
OBSIDIAN_MCP_EXPOSE_PATHS=false
OBSIDIAN_MCP_ALLOW_SOURCE_FILES=false
# Optional remote Streamable HTTP MCP mode.
# Run locally:
# OBSIDIAN_MCP_TOKEN='<long-random-token>' obsidian-wiki-mcp --transport streamable-http
# Or manage a user-level service:
# bash scripts/mcp_service.sh start
# Rotate token later with:
# bash scripts/mcp_service.sh new-token
OBSIDIAN_MCP_TOKEN=
OBSIDIAN_MCP_HOST=127.0.0.1
OBSIDIAN_MCP_PORT=8765
OBSIDIAN_MCP_PATH=/mcp
OBSIDIAN_MCP_ENABLED_TOOLS=file-assets
# Optional public URLs shown to remote agents in capabilities/config output.
# Set PUBLIC_BASE_URL when /mcp is behind DNS/tunnel/reverse proxy.
OBSIDIAN_MCP_PUBLIC_BASE_URL=
# Set only when the ingest upload endpoint has a different public URL.
OBSIDIAN_MCP_INGEST_PUBLIC_UPLOAD_URL=
# Comma-separated HTTP Host and Origin allowlists. Managed service installs
# derive these from their bind/public URLs; set them explicitly for manual HTTP
# deployments, especially behind a tunnel or reverse proxy.
OBSIDIAN_MCP_ALLOWED_HOSTS=
OBSIDIAN_MCP_ALLOWED_ORIGINS=
# Optional write-capable MCP ingest tools. Default is disabled.
# When enabled, remote MCP clients sharing this token can upload files and
# trigger a local `opencode run --auto` wiki-ingest job for those uploads.
# The prompt entrypoint is fixed, but `--auto` has no enforced shell sandbox.
# Enable ingest/query only for trusted clients behind a trusted network boundary.
# After enabling, call the MCP tool `check_ingest_opencode_readiness` before
# the first upload; set run_smoke_test=true to verify OpenCode can load the
# project wiki-ingest skill without editing files.
# Preferred remote file upload path: POST multipart/form-data to
# /mcp-ingest/uploads. Agents that cannot read the main MCP bearer token should
# call `create_ingest_upload_ticket` first and send the returned
# X-Obsidian-Wiki-Upload-Token header. `get_ingest_upload_instructions` returns
# exact fields/examples.
# Keep this runtime root outside OBSIDIAN_VAULT_PATH; uploads are staging inputs,
# and wiki-ingest decides how sources are archived into the vault.
# Prefer OBSIDIAN_MCP_ENABLED_TOOLS=file-assets,ingest for new configs. This
# legacy flag is still read when OBSIDIAN_MCP_ENABLED_TOOLS is absent.
OBSIDIAN_MCP_ENABLE_INGEST=0
# Multipart files are streamed to spooled storage. The parser enforces the
# per-file cap while consuming each part.
OBSIDIAN_MCP_INGEST_MAX_FILE_BYTES=104857600
OBSIDIAN_MCP_INGEST_MAX_CHUNK_BYTES=4194304
OBSIDIAN_MCP_INGEST_MAX_FILES_PER_JOB=10
# 0 derives the total request cap from max-file-bytes * max-files plus multipart
# overhead. A positive value sets an additional, stricter total request cap.
OBSIDIAN_MCP_INGEST_MAX_REQUEST_BYTES=0
OBSIDIAN_MCP_INGEST_JOB_TIMEOUT_SECONDS=1800
OBSIDIAN_MCP_OPENCODE_PATH=opencode
OBSIDIAN_MCP_INGEST_OPENCODE_PATH=opencode
OBSIDIAN_MCP_INGEST_OPENCODE_MODEL=openai/gpt-5.5
OBSIDIAN_MCP_INGEST_OPENCODE_VARIANT=high
OBSIDIAN_MCP_INGEST_RUNTIME_ROOT=.runtime/mcp-ingest
# Optional MCP query tools. Default is disabled.
# When enabled, remote MCP clients sharing this token can ask this machine's
# local OpenCode to run the normal wiki-query workflow and return the answer.
# The query tool reads the full vault by default; pass public_only=true per tool
# call when the remote answer must exclude visibility/internal or visibility/pii
# pages. Use OBSIDIAN_MCP_ENABLED_TOOLS=file-assets,query or:
# bash scripts/mcp_service.sh tools enable query
# bash scripts/mcp_service.sh start --enable-query
OBSIDIAN_MCP_QUERY_OPENCODE_MODEL=openai/gpt-5.5
OBSIDIAN_MCP_QUERY_OPENCODE_VARIANT=minimal
OBSIDIAN_MCP_QUERY_MAX_CHARS=8000
OBSIDIAN_MCP_QUERY_JOB_TIMEOUT_SECONDS=300
OBSIDIAN_MCP_QUERY_RUNTIME_ROOT=.runtime/mcp-query
# Wiki categories (directories created in the vault)
OBSIDIAN_CATEGORIES=concepts,entities,skills,references,synthesis,journal
# Max pages to create/update per ingest operation
OBSIDIAN_MAX_PAGES_PER_INGEST=15
# Claude conversation history path (auto-discovered from ~/.claude if empty)
CLAUDE_HISTORY_PATH=
# Codex history path (defaults to ~/.codex if empty)
CODEX_HISTORY_PATH=
# Pi agent session history path (defaults to ~/.pi/agent/sessions if empty)
PI_HISTORY_PATH=
# Lint schedule: daily | weekly | manual
LINT_SCHEDULE=weekly
# Internal link format for generated/updated pages
# wikilink (default) → [[concepts/foo]] or [[concepts/foo|display text]]
# markdown → [display text](relative/path.md)
# Only affects future writes — existing vault content is never migrated automatically.
OBSIDIAN_LINK_FORMAT=wikilink
# --- QMD Semantic Search (optional) ---
#
# QMD indexes your wiki and sources for fast semantic search.
# Install: https://github.com/tobi/qmd
# After installing, point these at your QMD collection names (set when you ran `qmd index`).
#
# Without QMD: wiki-ingest and wiki-query fall back to Grep/Glob — fully functional, just slower.
# With QMD: semantic search replaces grep passes, enabling concept-level matches and cross-collection queries.
# Name of the QMD collection indexing your compiled wiki pages (OBSIDIAN_VAULT_PATH)
QMD_WIKI_COLLECTION=
# Name of the QMD collection indexing your raw source documents (OBSIDIAN_SOURCES_DIR or _raw/)
QMD_PAPERS_COLLECTION=
# QMD integration transport: mcp | cli
# mcp preserves the original behavior and uses an agent-configured QMD MCP server.
# cli runs the local qmd command directly; useful for agents without QMD MCP support.
QMD_TRANSPORT=mcp
# CLI search quality mode: quality | balanced | fast
# quality: qmd query with reranking (best relevance, slowest on CPU)
# balanced: qmd query --no-rerank (good hybrid results, faster)
# fast: qmd vsearch (semantic only) or qmd search when exact terms matter
QMD_CLI_SEARCH_MODE=quality
# Optional qmd binary override if qmd is not on PATH.
QMD_CLI=qmd
# --- Raw Staging Directory (optional) ---
#
# A directory inside OBSIDIAN_VAULT_PATH for unprocessed draft pages.
# Drop rough notes, clipboard pastes, or quick captures here.
# wiki-ingest will promote them to proper wiki pages when you run it.
# Promoted files are deleted from _raw/ after processing.
OBSIDIAN_RAW_DIR=_raw