forked from admin/VolcanicAgenticCore
92a0061fdd
While on, the admin's updates are routed as the target user's (allow-list, chat, workspace, session, settings, jobs) and the target chat's output goes to the admin's chat. The target's own updates are dropped with a notice that an admin is working with their account. In memory; /impersonate 0 stops.
45 lines
2.6 KiB
YAML
45 lines
2.6 KiB
YAML
services:
|
|
bot:
|
|
build:
|
|
context: .
|
|
args:
|
|
INSTALL_PLAYWRIGHT: ${INSTALL_PLAYWRIGHT:-true}
|
|
CLAUDE_CODE_VERSION: ${CLAUDE_CODE_VERSION:-2.1}
|
|
restart: unless-stopped
|
|
# dotnet does not reap orphans; killed `claude` trees and bash tool children would pile up as zombies.
|
|
# docker-init runs as root (the image user), so the agent can't read its /proc/1/environ.
|
|
init: true
|
|
# Chromium crashes with Docker's 64 MB /dev/shm.
|
|
shm_size: 1gb
|
|
stop_grace_period: 30s
|
|
environment:
|
|
- TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
|
|
- TELEGRAM_ALLOWED_USER_IDS=${TELEGRAM_ALLOWED_USER_IDS}
|
|
- Telegram__Model=${TELEGRAM_MODEL:-claude-code/claude-opus-5-5}
|
|
- TZ=${TZ:-UTC}
|
|
- Logging__LogLevel__Default=${LOG_LEVEL:-Information}
|
|
# Optional features; empty means off / default.
|
|
- OPENAI_API_KEY=${OPENAI_API_KEY:-} # speech to text (attachments spec)
|
|
- STT_MODEL=${STT_MODEL:-}
|
|
- GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-} # Google Calendar (calendar spec)
|
|
- GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
|
|
- ADMIN_USER_ID=${ADMIN_USER_ID:-} # may /impersonate other users (telegram-bot.md)
|
|
- DEFAULT_TIMEZONE=${DEFAULT_TIMEZONE:-} # chats' default zone (scheduler spec §7); empty → TZ
|
|
- PROCESS_ENV_ALLOW=${PROCESS_ENV_ALLOW:-} # deny-listed variables the agent may see, e.g. GH_TOKEN
|
|
# Playwright MCP preset (MCP spec): the preinstalled binary, no npx download. Set PLAYWRIGHT_ENABLED=false for an
|
|
# image built with INSTALL_PLAYWRIGHT=false (no nested default: Coolify parses these expressions itself).
|
|
- PLAYWRIGHT_ENABLED=${PLAYWRIGHT_ENABLED:-true}
|
|
- PLAYWRIGHT_HEADLESS=${PLAYWRIGHT_HEADLESS:-true} # no display in the container
|
|
- PLAYWRIGHT_BROWSER=${PLAYWRIGHT_BROWSER:-}
|
|
- PLAYWRIGHT_EXTRA_ARGS=${PLAYWRIGHT_EXTRA_ARGS:---no-sandbox}
|
|
- PLAYWRIGHT_COMMAND=${PLAYWRIGHT_COMMAND:-playwright-mcp}
|
|
# git trusts every repository: workspaces copied in on the host belong to another uid, which git otherwise refuses.
|
|
- GIT_CONFIG_COUNT=1
|
|
- GIT_CONFIG_KEY_0=safe.directory
|
|
- GIT_CONFIG_VALUE_0=*
|
|
# Bind mounts on the host. Docker creates missing directories as root; the entrypoint hands the three roots to app.
|
|
volumes:
|
|
- /media/disk1/containers/volcanic_secretary_core/workspaces:/data/workspaces
|
|
- /media/disk1/containers/volcanic_secretary_core/agent:/data/agent
|
|
- /media/disk1/containers/volcanic_secretary_core/claude:/data/claude
|