Configuration
Bootstrap and hosting-specific credentials are read from protected files under rad/config/ for the current WHM deployment. These files must be readable only by the deployment owner and web-server account, must not be served publicly, and must not be included in support artifacts.
Database configuration remains hosting-specific and is managed through rad/config/sys.inc.php for the current WHM deployment. Restrict the database account to the RAD database, limit access to trusted hosts, and protect the configuration through server filesystem permissions. Do not include database passwords in generated support bundles or web-server logs.
The public base URL must use HTTP or HTTPS and must not contain credentials, query parameters, or fragments. Production deployments should use HTTPS and secure session cookies.
Keep detailed error display and SQL logging disabled in production. Batoi AIF remains opt-in and no provider is contacted until an authorized operation requests execution.
AI provider credentials, models, endpoints, timeouts, and managed-runtime policy are stored in rad/config/ai-config.php. RAD Admin masks configured keys and preserves them when the key field is unchanged. Limit AI Settings to trusted system administrators and protect the configuration file through WHM filesystem permissions.
Public gateway operators may set BATOI_PUBLIC_GATEWAY_BASE_URL for the advertised API/MCP origin and BATOI_MCP_AUTHORIZATION_SERVER for protected-resource discovery. Both values must be absolute HTTPS origins controlled by the operator; credentials and URL user information are forbidden.
Developer tools and AI-assisted code workflows should remain disabled unless a trusted administrator has a defined operational need.