Frank Schwenk
063b16296c
Bake agent into the pi user PATH; pass CURSOR_API_KEY from .env so no browser login is required. Co-authored-by: Cursor <cursoragent@cursor.com>
65 lines
2.4 KiB
Markdown
65 lines
2.4 KiB
Markdown
# SOUL.md — Project Character
|
|
|
|
## Product Name
|
|
|
|
`pidevremote` / PI on boka
|
|
|
|
## One-Liner
|
|
|
|
Pi Coding Agent + PI WEB in Docker behind Traefik on `pi.schwenk.online`, gated by Authelia (external).
|
|
|
|
## Vision
|
|
|
|
Prompt and supervise Pi agent sessions on boka from a phone or any browser, without exposing the agent UI unauthenticated.
|
|
|
|
## Audience
|
|
|
|
Fränky — single trusted user; remote control surface for agent work under `/home/frank` project mounts.
|
|
|
|
## Tone & Wording
|
|
|
|
- **Voice:** direct, ops-clear
|
|
- **Formality:** du
|
|
- **Error messages:** honest + next step (logs, `docker compose logs`)
|
|
- **Forbidden:** pretending this stack is multi-tenant or a public SaaS
|
|
|
|
## Non-Goals
|
|
|
|
- Authelia / SSO (separate project; consume `authelia@docker` only)
|
|
- Host-installed `pi` or host systemd PI WEB
|
|
- Gondolin / OpenShell sandbox patterns (Plain Docker only)
|
|
- Public unauthenticated exposure of PI WEB
|
|
|
|
## Project-Specific Rules
|
|
|
|
- Never commit `.env`, API keys, or `data/pi-agent` contents
|
|
- Traefik middleware: reference `authelia@docker` — do not redefine ForwardAuth here
|
|
- Keep workspace bind mounts intentional (default `/workspaces`); do not mount all of `/home/frank` blindly
|
|
- Pin `@earendil-works/pi-coding-agent` to `0.82.x` while `@jmfederico/pi-web` peer range is `>=0.82.1 <0.83`
|
|
|
|
---
|
|
|
|
## Infrastructure (project-local)
|
|
|
|
- **Domain:** `pi.schwenk.online`
|
|
- **Deploy path (typical):** `/home/frank/pi.schwenk.online`
|
|
- **Compose:** `compose.yml` — services `sessiond` + `web`, image built from `Dockerfile`
|
|
- **Networks:** external `traefik`
|
|
- **Auth:** Authelia portal `https://auth.schwenk.online`; middleware `authelia@docker`; ACL `two_factor` for this host
|
|
- **Data:** `./data/pi-web` (PI WEB state + sessiond socket), `./data/pi-agent` → `/home/pi/.pi/agent` (sessions, packages, auth)
|
|
- **Workspaces:** host path via `WORKSPACE_HOST_PATH` → container `/workspaces`
|
|
- **UID:** `PUID`/`PGID` in `.env` must match host owner of the mount (boka frank = 1002)
|
|
- **Cursor CLI:** `agent` installed in image; auth via `CURSOR_API_KEY` (no browser login)
|
|
- **Secrets:** `OPENROUTER_API_KEY`, `CURSOR_API_KEY` in `.env` (see `.env.example`)
|
|
|
|
### Authelia handoff (consumed)
|
|
|
|
| Feld | Wert |
|
|
|------|------|
|
|
| Middleware | `authelia@docker` |
|
|
| Portal | `https://auth.schwenk.online` |
|
|
| Netz | `traefik` |
|
|
| Cookie domain | `schwenk.online` |
|
|
| ACL | `pi.schwenk.online` → `two_factor` |
|
|
| ForwardAuth | `http://authelia:9091/api/authz/forward-auth` |
|