Frank Schwenk
063b16296c
Bake agent into the pi user PATH; pass CURSOR_API_KEY from .env so no browser login is required. Co-authored-by: Cursor <cursoragent@cursor.com>
66 lines
2.1 KiB
Markdown
66 lines
2.1 KiB
Markdown
# Deploy — pi.schwenk.online
|
|
|
|
Stack: Pi Coding Agent + PI WEB in Docker, Traefik ingress, Authelia ForwardAuth (`authelia@docker`).
|
|
|
|
## Prerequisites (boka)
|
|
|
|
- Docker + Compose
|
|
- External network `traefik` exists
|
|
- Authelia running; ACL for `pi.schwenk.online` → `two_factor`
|
|
- DNS: `pi.schwenk.online` → boka
|
|
- Portal: https://auth.schwenk.online
|
|
|
|
## First deploy
|
|
|
|
```bash
|
|
ssh frank-schwenk.de
|
|
# clone or sync this repo to:
|
|
cd /home/frank/pi.schwenk.online
|
|
|
|
cp .env.example .env
|
|
# edit OPENROUTER_API_KEY and CURSOR_API_KEY (https://cursor.com/dashboard/api)
|
|
# PUID/PGID = host user (frank on boka: 1002) — must match `id -u` / `id -g`
|
|
# WORKSPACE_HOST_PATH=/home/frank
|
|
|
|
mkdir -p data/pi-web data/pi-agent
|
|
chown -R "$(id -u):$(id -g)" data
|
|
|
|
docker compose build
|
|
docker compose up -d
|
|
docker compose logs -f --tail=100
|
|
|
|
# smoke: should list your projects, not Permission denied
|
|
docker compose exec web ls /workspaces/eselhoefe.de
|
|
```
|
|
|
|
## Verify
|
|
|
|
1. Incognito: `https://pi.schwenk.online` → redirect to Authelia login
|
|
2. Password + Google Authenticator (TOTP)
|
|
3. PI WEB UI loads
|
|
4. Add project under `/workspaces/...`, start a session — agent runs **inside** the container
|
|
5. Optional: `docker compose exec sessiond pi --version`
|
|
6. Packages: Settings → Pi packages, or
|
|
`docker compose exec sessiond pi install npm:<package>`
|
|
(persists in `data/pi-agent`)
|
|
7. Cursor CLI: `docker compose exec web agent --version`
|
|
Auth: `docker compose exec web agent status` (needs `CURSOR_API_KEY` in `.env`)
|
|
|
|
## Ops
|
|
|
|
```bash
|
|
docker compose ps
|
|
docker compose logs web sessiond
|
|
docker compose restart
|
|
docker compose pull # N/A — local build; rebuild after Dockerfile changes:
|
|
docker compose build --no-cache && docker compose up -d
|
|
```
|
|
|
|
## Notes
|
|
|
|
- No host port publish; only Traefik on network `traefik` reaches `:8504`
|
|
- Middleware is referenced only (`authelia@docker`); ForwardAuth is defined on Authelia
|
|
- `pi-coding-agent` pinned to `0.82.1` for current `pi-web` peer range
|
|
- Container runs as `PUID`/`PGID` (default 1002) so bind mounts under `/home/frank` are readable
|
|
- Cursor Agent CLI (`agent`) is in the image; auth via `CURSOR_API_KEY` only (no browser login)
|