Scope monitoring TG by department

.env.example

@@ -32,23 +32,20 @@ API_PORT=8000
 MEDIA_DIR=/data/media
 MEDIA_MAX_BYTES=20971520
 
-# Local LLM (Ollama) — runs Qwen 2.5 7B Q4 on CPU. Set LLM_ENABLED=false to disable.
+# OpenAI-compatible LLM endpoint. In production this can point to the same
+# vLLM server/model used by telephony.
 LLM_ENABLED=true
-LLM_BASE_URL=http://ollama:11434
-LLM_MODEL=qwen2.5:7b-instruct-q4_K_M
+LLM_BASE_URL=http://10.2.3.5:8002
+LLM_API_KEY=
+LLM_MODEL=qwen2.5-14b
 LLM_TIMEOUT_SECONDS=120
+LLM_MAX_TOKENS=600
 LLM_MIN_TEXT_LENGTH=20
 # How often the background classifier wakes up and how many messages it
 # processes per tick. With 5/20s ≈ 900 messages/hour at ~3-6s per call.
 LLM_CLASSIFY_INTERVAL_SECONDS=20
 LLM_CLASSIFY_BATCH_SIZE=5
 
-# Admin allowlist for /auth.html, /docs, /openapi.json, /redoc and the
-# /api/v1/auth/* endpoints. Comma-separated list of client IPs.
-# Empty = no restriction (everyone is admin) — convenient for local dev.
-# Example: ADMIN_ALLOWED_IPS=89.110.109.221,127.0.0.1
-ADMIN_ALLOWED_IPS=
-# Honor X-Forwarded-For / X-Real-IP from a reverse proxy (Docker port-
-# forward, nginx, traefik) when resolving the client IP for the allowlist.
-TRUST_PROXY_HEADERS=true
-
+# Optional local fallback for admin-only UI/API operations. In production the
+# portal forwards X-User-Is-Admin=1, so no local password is required.
+ADMIN_PASSWORD=