sync: update from private repo (2336949a)

2026-09-17 11:29:31 +00:00
parent 28f74c4e37
commit 57702b4f34
2139 changed files with 321270 additions and 17494 deletions
@@ -58,3 +58,11 @@ OLLAMA_MODEL=qwen3:32b
 # Required ONLY when using MCP servers or the SSH tool. 64 hex characters.
 # Generate one with:  openssl rand -hex 32
 # MCP_ENCRYPTION_KEY=replace-with-64-hex-characters
+
+# --- Reverse proxy (Caddy) --------------------------------------------------
+# Do NOT put CLOUDFLARE_API_TOKEN (or any other proxy-only secret) in this file.
+# Under Docker Compose this file is the maestro service's env_file, so every key
+# here lands in the container that runs the agent -- and the agent has a Bash
+# tool, so it could read the token. Proxy settings live in .env.caddy instead,
+# which only the caddy service loads. See .env.caddy.example and
+# docs/operations/caddy-cloudflare-tls.html.