feat: Docker stack for PI WEB + Pi behind Traefik/Authelia

Compose services, Dockerfile, and deploy notes for pi.schwenk.online with OpenRouter and external Authelia middleware.

Co-authored-by: Cursor <cursoragent@cursor.com>

Dockerfile

@@ -0,0 +1,46 @@
+# Pi Coding Agent + PI WEB (Plain Docker)
+# Peer pin: pi-web requires pi-coding-agent >=0.82.1 <0.83
+FROM node:24-bookworm-slim
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    bash \
+    ca-certificates \
+    curl \
+    git \
+    python3 \
+    make \
+    g++ \
+    ripgrep \
+  && rm -rf /var/lib/apt/lists/*
+
+# Agent first (peer for pi-web), then PI WEB with node-pty native build
+RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.1 \
+  && npm install -g @jmfederico/pi-web@1.202607.3 --allow-scripts=node-pty \
+  && npm cache clean --force
+
+# Drop build toolchain from runtime image layer weight is optional; keep for native package installs
+# Re-install without g++ would break future pi packages needing compile — leave tools in.
+
+RUN mkdir -p /data/pi-web /workspaces /home/node/.pi/agent /home/node/.config/pi-web \
+  && chown -R node:node /data /workspaces /home/node/.pi /home/node/.config
+
+COPY --chown=node:node config/pi-web.config.json /etc/pi-web/config.json
+
+ENV HOME=/home/node \
+  PI_WEB_CONFIG=/etc/pi-web/config.json \
+  PI_WEB_DATA_DIR=/data/pi-web \
+  PI_CODING_AGENT_DIR=/home/node/.pi/agent \
+  PI_WEB_SESSIOND_SOCKET=/data/pi-web/sessiond.sock \
+  PI_WEB_HOST=0.0.0.0 \
+  PI_WEB_PORT=8504 \
+  PI_WEB_ALLOWED_HOSTS=pi.schwenk.online \
+  PATH="/usr/local/bin:${PATH}"
+
+USER node
+WORKDIR /workspaces
+
+EXPOSE 8504
+
+# Default overridden per-service in compose.yml
+CMD ["pi-web-server"]