improved pre-processing and prompt

.env.example

@@ -1,7 +1,15 @@
 # --- AI Configuration ---
 OLLAMA_API_URL=http://localhost:11434/api/generate
 OLLAMA_MODEL=llama3.2:1b
-AI_SYSTEM_PROMPT="You are a Linux Sysadmin. Look at these server error logs from yesterday. Summarize the main issues, identify any potential attacks (like failed brute force logins), and ignore harmless background noise. Keep it brief."
+# How long to wait for the (CPU-only) model to respond before giving up
+OLLAMA_TIMEOUT_SECONDS=300
+
+# The script now feeds the AI pre-extracted, structured facts (not raw log
+# lines), so this prompt only needs to tell it HOW to write, not what to look
+# for -- the analysis itself happens in Python before the AI ever runs.
+# A sensible default is baked into daily_summary.py; override here only if
+# you want different tone/length.
+# AI_SYSTEM_PROMPT="..."
 
 # --- Email Reporting Configuration ---
 REPORT_TO_EMAIL=admin@yourdomain.com
@@ -13,14 +21,17 @@ SMTP_PASS=
 
 # --- Log Analysis Configuration ---
 JOURNAL_UNIT=mailserver
-MAX_ERRORS_TO_ANALYZE=50
-# Comma-separated list of words that trigger the AI
-ERROR_KEYWORDS=error,failed,warning,fatal,timeout
+# Comma-separated CIDR ranges allowed to log in to mailboxes. Logins from
+# outside these ranges are flagged in the report as noteworthy.
+TRUSTED_LOGIN_NETWORKS=10.0.0.0/24
 
 # --- Execution Options ---
 # Set to 'true' to see detailed background processes, 'false' for clean logs
 DEBUG=true
 # Set to 'true' to run also immediately when the container starts, 'false' to wait for the schedule
+# NOTE: leave this 'false' in production. Combined with the systemd unit's
+# Restart=always, an immediate run on every container (re)start can cause
+# duplicate/rapid-fire reports if the container is restarting frequently.
 RUN_NOW=true
 # Time format must be HH:MM in 24-hour format
 REPORT_TIME=08:00