# SOUL.md — Project Character

## Product Name

`pidevremote` / PI on boka

## One-Liner

Pi Coding Agent + PI WEB in Docker behind Traefik on `pi.schwenk.online`, gated by Authelia (external).

## Vision

Prompt and supervise Pi agent sessions on boka from a phone or any browser, without exposing the agent UI unauthenticated.

## Audience

Fränky — single trusted user; remote control surface for agent work under `/home/frank` project mounts.

## Tone & Wording

- **Voice:** direct, ops-clear
- **Formality:** du
- **Error messages:** honest + next step (logs, `docker compose logs`)
- **Forbidden:** pretending this stack is multi-tenant or a public SaaS

## Non-Goals

- Authelia / SSO (separate project; consume `authelia@docker` only)
- Host-installed `pi` or host systemd PI WEB
- Gondolin / OpenShell sandbox patterns (Plain Docker only)
- Public unauthenticated exposure of PI WEB

## Project-Specific Rules

- Never commit `.env`, API keys, or `data/pi-agent` contents
- Traefik middleware: reference `authelia@docker` — do not redefine ForwardAuth here
- Keep workspace bind mounts intentional (default `/workspaces`); do not mount all of `/home/frank` blindly
- Pin `@earendil-works/pi-coding-agent` to `0.82.x` while `@jmfederico/pi-web` peer range is `>=0.82.1 <0.83`

---

## Infrastructure (project-local)

- **Domain:** `pi.schwenk.online`
- **Deploy path (typical):** `/home/frank/pi.schwenk.online`
- **Compose:** `compose.yml` — services `sessiond` + `web`, image built from `Dockerfile`
- **Networks:** external `traefik`
- **Auth:** Authelia portal `https://auth.schwenk.online`; middleware `authelia@docker`; ACL `two_factor` for this host
- **Data:** `./data/pi-web` (PI WEB state + sessiond socket), `./data/pi-agent` → `~/.pi/agent` (sessions, packages, auth)
- **Workspaces:** host path via `WORKSPACE_HOST_PATH` → container `/workspaces`
- **Secrets:** `OPENROUTER_API_KEY` in `.env` (see `.env.example`)

### Authelia handoff (consumed)

| Feld | Wert |
|------|------|
| Middleware | `authelia@docker` |
| Portal | `https://auth.schwenk.online` |
| Netz | `traefik` |
| Cookie domain | `schwenk.online` |
| ACL | `pi.schwenk.online` → `two_factor` |
| ForwardAuth | `http://authelia:9091/api/authz/forward-auth` |