Compare commits

2 Commits

Author SHA1 Message Date
umbra audio
19ee5db43a Merge branch 'main' into chore/untrack-env
# Conflicts:
#	.env
2026-10-19 04:36:00 -07:00
umbra audio
9f403cb873 Untrack .env now that this repository is public
Adding `.env` to .gitignore on its own would have changed nothing, which is the whole
point of doing this properly.

.gitignore only applies to files git is not already tracking. This repository has tracked
`.env` since the initial commit, so an ignore entry would have been inert: git would carry
on tracking the file and would have committed a secret placed in it later, while the
.gitignore looked like it was handling it. The untracking is what does the work, and the
comment in .gitignore says so, because "the entry is there but the file is still tracked"
is a silent failure that reads as protection.

Worth being accurate about what was and was not a risk. The committed `.env` was checked
before this change rather than assumed to be dangerous: 32 keys, all of them paths, engine
names, model locations, thresholds and ports. No API key, no token, no password. An earlier
report that this file held live secrets was wrong. `infra/umbra-node.json` likewise
declares itself to carry only ids, names, labels and counts.

So nothing needs purging from history and nothing needs rotating. What needed fixing was
the gap that would have turned the next ordinary mistake - pasting an API key into .env -
into a public commit. That is now closed, verified three ways: .env is absent from the
index, `git check-ignore` confirms the rule matches, and `git add .env` is refused.

.env is untracked with `git rm --cached`, so the working file is untouched and the
application still reads it. Untracking rather than deleting was deliberate: this file is
the machine's real configuration, and a fresh clone now needs .env.example instead.

.env.example is new, generated from .env with all 32 keys and no values. A clone now knows
what to set without anything machine-specific being shared. Verified: zero lines in it
carry a value.

On a branch rather than master, because untracking .env changes what a fresh clone gets
and that is a workflow change rather than a pure fix. Merge or cherry-pick as suits.

No behaviour change. The application reads .env at runtime through pydantic-settings in
four places and none of them care whether git is watching the file.
2026-10-06 18:30:16 -07:00
3 changed files with 56 additions and 48 deletions

48
.env
View File

@@ -1,48 +0,0 @@
# UmbraAudio Environment Configuration
# Copy this to .env and modify as needed
# --- Project ---
UMBRA_PROJECT_DIR=.
UMBRA_DATA_DIR=.umbra
# --- TTS ---
UMBRA_TTS__ENGINE=qwen
UMBRA_TTS__DEVICE=mps
UMBRA_TTS__SAMPLE_RATE=24000
UMBRA_TTS__MAX_RETRIES=3
UMBRA_TTS__RETRY_DELAY=2.0
UMBRA_TTS__VOICEDESIGN_MODEL=/Volumes/1TB_APL_Storage/UmbraAudio/models/Qwen3-TTS-12Hz-1.7B-VoiceDesign
UMBRA_TTS__BASE_MODEL=/Volumes/1TB_APL_Storage/UmbraAudio/models/Qwen3-TTS-12Hz-1.7B-Base
UMBRA_TTS__QWEN_TTS_URL=http://localhost:8881
# The GPU box (192.168.123.14) is retired and removed from the configuration:
# it is offline and being reconfigured, so there is no relay and no helper URL.
# Local Qwen3-TTS on 8881 is the only TTS backend.
# --- LLM ---
UMBRA_LLM__PROVIDER=auto
UMBRA_LLM__LMSTUDIO_BASE_URL=http://localhost:1234/v1
UMBRA_LLM__LMSTUDIO_MODEL=qwen/qwen3.5-9b
UMBRA_LLM__OPENAI_MODEL=gpt-4o
UMBRA_LLM__TEMPERATURE=0.3
UMBRA_LLM__MAX_TOKENS=4096
# --- Web ---
UMBRA_WEB__HOST=0.0.0.0
UMBRA_WEB__PORT=8420
UMBRA_WEB__AUTO_OPEN=false
# --- Quality ---
UMBRA_QUALITY__MIN_MOS=3.8
UMBRA_QUALITY__MIN_TEST_MOS=4.0
UMBRA_QUALITY__MAX_WER=0.03
UMBRA_QUALITY__MIN_SPEAKER_SIMILARITY=0.80
UMBRA_QUALITY__MIN_TEST_SPEAKER_SIMILARITY=0.85
UMBRA_QUALITY__MIN_ARTIFACT_SCORE=3.5
# --- Audio ---
UMBRA_AUDIO__TARGET_RMS_DB=-20.0
UMBRA_AUDIO__PEAK_LIMIT_DB=-3.0
UMBRA_AUDIO__NOISE_FLOOR_DB=-60.0
UMBRA_AUDIO__SILENCE_BETWEEN_UTTERANCES_MS=500
UMBRA_AUDIO__SILENCE_BETWEEN_PARAGRAPHS_MS=2000
UMBRA_AUDIO__SILENCE_BETWEEN_CHAPTERS_MS=4000

39
.env.example Normal file
View File

@@ -0,0 +1,39 @@
# UmbraAudio configuration - TEMPLATE.
#
# Copy to .env and fill in. `.env` is gitignored and untracked; this file is the
# tracked one, so it carries every key and no values.
#
# Generated from .env with values removed. Nothing here is machine-specific, so
# every line is a placeholder: a path, an engine name, a threshold, or a port.
UMBRA_PROJECT_DIR=
UMBRA_DATA_DIR=
UMBRA_TTS__ENGINE=
UMBRA_TTS__DEVICE=
UMBRA_TTS__SAMPLE_RATE=
UMBRA_TTS__MAX_RETRIES=
UMBRA_TTS__RETRY_DELAY=
UMBRA_TTS__VOICEDESIGN_MODEL=
UMBRA_TTS__BASE_MODEL=
UMBRA_TTS__QWEN_TTS_URL=
UMBRA_TTS__QWEN_TTS_HELPER_URL=
UMBRA_LLM__PROVIDER=
UMBRA_LLM__LMSTUDIO_BASE_URL=
UMBRA_LLM__LMSTUDIO_MODEL=
UMBRA_LLM__OPENAI_MODEL=
UMBRA_LLM__TEMPERATURE=
UMBRA_LLM__MAX_TOKENS=
UMBRA_WEB__HOST=
UMBRA_WEB__PORT=
UMBRA_WEB__AUTO_OPEN=
UMBRA_QUALITY__MIN_MOS=
UMBRA_QUALITY__MIN_TEST_MOS=
UMBRA_QUALITY__MAX_WER=
UMBRA_QUALITY__MIN_SPEAKER_SIMILARITY=
UMBRA_QUALITY__MIN_TEST_SPEAKER_SIMILARITY=
UMBRA_QUALITY__MIN_ARTIFACT_SCORE=
UMBRA_AUDIO__TARGET_RMS_DB=
UMBRA_AUDIO__PEAK_LIMIT_DB=
UMBRA_AUDIO__NOISE_FLOOR_DB=
UMBRA_AUDIO__SILENCE_BETWEEN_UTTERANCES_MS=
UMBRA_AUDIO__SILENCE_BETWEEN_PARAGRAPHS_MS=
UMBRA_AUDIO__SILENCE_BETWEEN_CHAPTERS_MS=

17
.gitignore vendored
View File

@@ -50,3 +50,20 @@ umbraaudio_package.zip
# SQLite project databases are runtime state, never source
*.db
# Local configuration, and the one rule here that is easy to get wrong.
#
# `.env` is in this file AND untracked (`git rm --cached .env`). Both are needed, and
# the reason is not obvious: .gitignore only applies to files git is not already
# tracking. Adding an entry for a tracked file changes nothing at all - git carries on
# tracking it and will happily commit a secret placed in it later. The untracking is
# what actually does the work.
#
# The committed copy contained no secrets - paths, engine names, model locations and
# thresholds - which was verified before this change rather than assumed. It is
# untracked because the repo is public now and the next person to put an API key in
# .env should not commit it, and untracking is the only way to guarantee that.
#
# .env.example is tracked and carries the keys with no values, so a fresh clone knows
# what to set without anything sensitive being shared.
.env