# Deploy — pi.schwenk.online

Stack: Pi Coding Agent + PI WEB in Docker, Traefik ingress, Authelia ForwardAuth (`authelia@docker`).

## Prerequisites (boka)

- Docker + Compose
- External network `traefik` exists
- Authelia running; ACL for `pi.schwenk.online` → `two_factor`
- DNS: `pi.schwenk.online` → boka
- Portal: https://auth.schwenk.online

## First deploy

```bash
ssh frank-schwenk.de
# clone or sync this repo to:
cd /home/frank/pi.schwenk.online

cp .env.example .env
# edit OPENROUTER_API_KEY and CURSOR_API_KEY (https://cursor.com/dashboard/api)
# PUID/PGID = host user (frank on boka: 1002) — must match `id -u` / `id -g`
# WORKSPACE_HOST_PATH=/home/frank

mkdir -p data/pi-web data/pi-agent
chown -R "$(id -u):$(id -g)" data

docker compose build
docker compose up -d
docker compose logs -f --tail=100

# smoke: should list your projects, not Permission denied
docker compose exec web ls /workspaces/eselhoefe.de
```

## Verify

1. Incognito: `https://pi.schwenk.online` → redirect to Authelia login
2. Password + Google Authenticator (TOTP)
3. PI WEB UI loads
4. Add project under `/workspaces/...`, start a session — agent runs **inside** the container
5. Optional: `docker compose exec sessiond pi --version`
6. Packages: Settings → Pi packages, or  
   `docker compose exec sessiond pi install npm:<package>`  
   (persists in `data/pi-agent`)
7. Cursor CLI: `docker compose exec web agent --version`  
   Auth: `docker compose exec web agent status` (needs `CURSOR_API_KEY` in `.env`)

## Ops

```bash
docker compose ps
docker compose logs web sessiond
docker compose restart
docker compose pull   # N/A — local build; rebuild after Dockerfile changes:
docker compose build --no-cache && docker compose up -d
```

## Notes

- No host port publish; only Traefik on network `traefik` reaches `:8504`
- Middleware is referenced only (`authelia@docker`); ForwardAuth is defined on Authelia
- `pi-coding-agent` pinned to `0.82.1` for current `pi-web` peer range
- Container runs as `PUID`/`PGID` (default 1002) so bind mounts under `/home/frank` are readable
- Cursor Agent CLI (`agent`) is in the image; auth via `CURSOR_API_KEY` only (no browser login)