pidevremote/DEPLOY.md

Deploy — pi.schwenk.online

Stack: Pi Coding Agent + PI WEB in Docker, Traefik ingress, Authelia ForwardAuth (authelia@docker).

Prerequisites (boka)

• Docker + Compose
• External network traefik exists
• Authelia running; ACL for pi.schwenk.online → two_factor
• DNS: pi.schwenk.online → boka
• Portal: https://auth.schwenk.online

First deploy

ssh frank-schwenk.de
# clone or sync this repo to:
cd /home/frank/pi.schwenk.online

cp .env.example .env
# edit OPENROUTER_API_KEY and CURSOR_API_KEY (https://cursor.com/dashboard/api)
# PUID/PGID = host user (frank on boka: 1002) — must match `id -u` / `id -g`
# WORKSPACE_HOST_PATH=/home/frank

mkdir -p data/pi-web data/pi-agent
chown -R "$(id -u):$(id -g)" data

docker compose build
docker compose up -d
docker compose logs -f --tail=100

# smoke: should list your projects, not Permission denied
docker compose exec web ls /workspaces/eselhoefe.de

Verify

1. Incognito: https://pi.schwenk.online → redirect to Authelia login
2. Password + Google Authenticator (TOTP)
3. PI WEB UI loads
4. Add project under /workspaces/..., start a session — agent runs inside the container
5. Optional: docker compose exec sessiond pi --version
6. Packages: Settings → Pi packages, or
   docker compose exec sessiond pi install npm:<package>
   (persists in data/pi-agent)
7. Cursor CLI: docker compose exec web agent --version
   Auth: docker compose exec web agent status (needs CURSOR_API_KEY in .env)

Ops

docker compose ps
docker compose logs web sessiond
docker compose restart
docker compose pull   # N/A — local build; rebuild after Dockerfile changes:
docker compose build --no-cache && docker compose up -d

Notes

• No host port publish; only Traefik on network traefik reaches :8504
• Middleware is referenced only (authelia@docker); ForwardAuth is defined on Authelia
• pi-coding-agent pinned to 0.82.1 for current pi-web peer range
• Container runs as PUID/PGID (default 1002) so bind mounts under /home/frank are readable
• Cursor Agent CLI (agent) is in the image; auth via CURSOR_API_KEY only (no browser login)