Security notes

This stack is designed for a private local lab (single trusted machine / LAN), not a public multi-tenant deployment.

Defaults to change before any network exposure

Replace every REPLACE_WITH_* / YOUR_*_HERE placeholder immediately
Generate TabbyAPI admin_key and api_key with python3 -c "import secrets; print(secrets.token_hex(32))"
Use the same TabbyAPI api_key in Open WebUI OPENAI_API_KEY, MCPO TABBYAPI_KEY, and SillyTavern
Do not publish api_tokens.yml, cookie secrets, chat logs, or SSH keys
Bind ports to localhost (127.0.0.1) if you do not need LAN access
Keep model directories and user chat data out of git (see .gitignore)
Prefer disable_auth: false and long random keys in TabbyAPI config
SillyTavern on 0.0.0.0 needs basicAuthMode: true (or user accounts) or it will refuse to start

Incident note (public mirror hygiene)

Earlier public revisions of this Hugging Face / GitHub tree included lab convenience keys:

TabbyAPI keys in tabby_config/config.yml
A live TABBYAPI_KEY in mcpo/config.json (a4333bfb7630a44bec1f23175f27e1ee and later lab values)

Those keys must be treated as compromised for any shared or networked use. Rotate them everywhere they might have been reused. The public tree now ships placeholders and examples only.

What is intentionally not in this repo

Model weights
Live user databases / chat logs
Real API tokens

SillyTavern character cards (PNG) under cards/ are included on purpose. They are not credentials.

If you found a secret in an older revision, rotate it and open an issue on the GitHub companion: https://github.com/jpanasuk-netizen/tabby-tavern-stack