LLM_PROVIDER_ENC_KEY

.env.example

@@ -8,3 +8,9 @@ POSTGRES_USER=device_cloud
 POSTGRES_PASSWORD=change-me-database-password
 
 CLOUD_API_PORT=8001
+
+# Fernet key protecting database-managed LLM Provider API keys. Generate once
+# and preserve it with the database backups (rotating it makes stored keys
+# undecryptable):
+#   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+CLOUD_LLM_PROVIDER_ENCRYPTION_KEY=change-me-generate-a-fernet-key

compose.deploy.yaml

@@ -26,6 +26,7 @@ services:
       CLOUD_ENVIRONMENT: production
       CLOUD_DATABASE_URL: postgresql+psycopg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
       CLOUD_TRUST_PROXY_HEADERS: ${CLOUD_TRUST_PROXY_HEADERS:-false}
+      CLOUD_LLM_PROVIDER_ENCRYPTION_KEY: ${CLOUD_LLM_PROVIDER_ENCRYPTION_KEY}
     ports:
       - "${CLOUD_API_PORT:-8001}:8001"
     depends_on:

compose.yaml

@@ -27,6 +27,7 @@ services:
       CLOUD_ENVIRONMENT: production
       CLOUD_DATABASE_URL: postgresql+psycopg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
       CLOUD_TRUST_PROXY_HEADERS: ${CLOUD_TRUST_PROXY_HEADERS:-false}
+      CLOUD_LLM_PROVIDER_ENCRYPTION_KEY: ${CLOUD_LLM_PROVIDER_ENCRYPTION_KEY}
     ports:
       - "${CLOUD_API_PORT:-8001}:8001"
     depends_on: