forked from admin/VolcanicAgenticCore
d51438e665
ADMIN_USER_IDS (Telegram:AdminUserIds) takes a comma separated list; the older ADMIN_USER_ID / Telegram:AdminUserId still works, also takes a list and is merged. Empty entries and duplicates are ignored, non-numeric entries fail validation. Impersonation is now per admin: one admin per target, an impersonating admin can't be impersonated, and every admin's chat menu lists /impersonate.
60 lines
3.6 KiB
YAML
60 lines
3.6 KiB
YAML
services:
|
|
bot:
|
|
build:
|
|
context: .
|
|
args:
|
|
INSTALL_PLAYWRIGHT: ${INSTALL_PLAYWRIGHT:-true}
|
|
CLAUDE_CODE_VERSION: ${CLAUDE_CODE_VERSION:-2.1}
|
|
restart: unless-stopped
|
|
# dotnet does not reap orphans; killed `claude` trees and bash tool children would pile up as zombies.
|
|
# docker-init runs as root (the image user), so the agent can't read its /proc/1/environ.
|
|
init: true
|
|
# Chromium crashes with Docker's 64 MB /dev/shm.
|
|
shm_size: 1gb
|
|
stop_grace_period: 30s
|
|
# The A2A server's port inside the network (Coolify's proxy routes the domain to it); nothing listens with A2A off.
|
|
expose: ["8080"]
|
|
environment:
|
|
- TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
|
|
- TELEGRAM_ALLOWED_USER_IDS=${TELEGRAM_ALLOWED_USER_IDS}
|
|
- Telegram__Model=${TELEGRAM_MODEL:-claude-code/claude-opus-5-5}
|
|
- TZ=${TZ:-UTC}
|
|
- Logging__LogLevel__Default=${LOG_LEVEL:-Information}
|
|
# Optional features; empty means off / default.
|
|
- OPENAI_API_KEY=${OPENAI_API_KEY:-} # speech to text (attachments spec)
|
|
- STT_MODEL=${STT_MODEL:-}
|
|
- TTS_MODEL=${TTS_MODEL:-}
|
|
- TTS_VOICE=${TTS_VOICE:-}
|
|
- TTS_PROVIDER=${TTS_PROVIDER:-}
|
|
- ELEVENLABS_API_KEY=${ELEVENLABS_API_KEY:-}
|
|
- ELEVENLABS_VOICE_ID=${ELEVENLABS_VOICE_ID:-}
|
|
- ELEVENLABS_MODEL=${ELEVENLABS_MODEL:-}
|
|
- OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-} # group topic triggers via Jev (group triggers spec)
|
|
- TRIGGER_MODEL=${TRIGGER_MODEL:-}
|
|
- GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-} # Google Calendar (calendar spec)
|
|
- GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
|
|
- MCP_ENCRYPTION_SECRET=${MCP_ENCRYPTION_SECRET:-}
|
|
- ADMIN_USER_IDS=${ADMIN_USER_IDS:-} # comma separated; may /impersonate other users (telegram-bot.md)
|
|
- ADMIN_USER_ID=${ADMIN_USER_ID:-} # older single-id form, merged with ADMIN_USER_IDS
|
|
- DEFAULT_TIMEZONE=${DEFAULT_TIMEZONE:-} # chats' default zone (scheduler spec §7); empty → TZ
|
|
- PROCESS_ENV_ALLOW=${PROCESS_ENV_ALLOW:-} # deny-listed variables the agent may see, e.g. GH_TOKEN
|
|
- A2A__Enabled=${A2A_ENABLED:-false} # A2A server (a2a-server spec); needs a domain in Coolify
|
|
- A2A__PublicUrl=${A2A_PUBLIC_URL:-} # e.g. https://bot.example.com; required for push webhooks
|
|
- A2AClient__Enabled=${A2A_CLIENT_ENABLED:-false} # A2A client: the a2a tool and watches (a2a-client spec)
|
|
# Playwright MCP preset (MCP spec): the preinstalled binary, no npx download. Set PLAYWRIGHT_ENABLED=false for an
|
|
# image built with INSTALL_PLAYWRIGHT=false (no nested default: Coolify parses these expressions itself).
|
|
- PLAYWRIGHT_ENABLED=${PLAYWRIGHT_ENABLED:-true}
|
|
- PLAYWRIGHT_HEADLESS=${PLAYWRIGHT_HEADLESS:-true} # no display in the container
|
|
- PLAYWRIGHT_BROWSER=${PLAYWRIGHT_BROWSER:-}
|
|
- PLAYWRIGHT_EXTRA_ARGS=${PLAYWRIGHT_EXTRA_ARGS:---no-sandbox}
|
|
- PLAYWRIGHT_COMMAND=${PLAYWRIGHT_COMMAND:-playwright-mcp}
|
|
# git trusts every repository: workspaces copied in on the host belong to another uid, which git otherwise refuses.
|
|
- GIT_CONFIG_COUNT=1
|
|
- GIT_CONFIG_KEY_0=safe.directory
|
|
- GIT_CONFIG_VALUE_0=*
|
|
# Bind mounts on the host. Docker creates missing directories as root; the entrypoint hands the three roots to app.
|
|
volumes:
|
|
- /media/disk1/containers/volcanic_secretary_core/workspaces:/data/workspaces
|
|
- /media/disk1/containers/volcanic_secretary_core/agent:/data/agent
|
|
- /media/disk1/containers/volcanic_secretary_core/claude:/data/claude
|