Help me understand how/if I should set a JWT token

[mo-st]

Hi and thank you to everyone willing to help me better understand how this software works.

What I (think I) know so far

• when running tabby via the default tabby serve --device metal --model StarCoder-1B --chat-model Qwen2-1.5B-Instruct --port 8080 command, the service is accessible freely on that port.
• This means people on the same wifi network could also use it from a different machine
• Setting a JWT token, generated with jwt.io and there plugging in the output of openssl rand -hex 32 should restrict the access to IDE's/clients that send the jwt.io ouput as a header (if I worded that correctly)
• This client setting is easily accessible in the VSCode tabby settings config.toml
• tabby serve will not automatically take the TABBY_WEBSERVER_JWT_TOKEN_SECRET environment variable from a .env file I have in my home directory when being started. It also does not have any flags that allow me to plug this file in
• Trying to source it within the zshrc also does not work
• There is no official tabby documentation on how to properly and securely set this, I assume it is expected that users who would want to do that will already know

So my first question, am I correct about the above things? My second question, if yes, how can I set the token correctly and securely? Additionally, would there be a simpler way to restrict access to just my local machine on which I run tabby so it isn't accessible from the whole network in any case?

Again, thank you for your time and patience. I really tried to read the docs and find out as much as I could on my own but I feel I may have been on a wrong track to begin with.

[wsxiaoys]

Seems https://askubuntu.com/questions/58814/how-do-i-add-environment-variables is what you need?