891a644590
Streamable HTTP/SSE servers from the workspace's .volcanic/mcp/servers.json. Headers are sealed with AES-GCM; the chat and the visible fields are the associated data, so only /mcp_add|remove|tools change servers. Tools <server>__<tool> go live in the session. An unreachable server is skipped and reported in the system prompt. Keys are redacted from tool results, and Telegram deletes messages that carry one.
55 lines
3.3 KiB
YAML
55 lines
3.3 KiB
YAML
services:
|
|
bot:
|
|
build:
|
|
context: .
|
|
args:
|
|
INSTALL_PLAYWRIGHT: ${INSTALL_PLAYWRIGHT:-true}
|
|
CLAUDE_CODE_VERSION: ${CLAUDE_CODE_VERSION:-2.1}
|
|
restart: unless-stopped
|
|
# dotnet does not reap orphans; killed `claude` trees and bash tool children would pile up as zombies.
|
|
# docker-init runs as root (the image user), so the agent can't read its /proc/1/environ.
|
|
init: true
|
|
# Chromium crashes with Docker's 64 MB /dev/shm.
|
|
shm_size: 1gb
|
|
stop_grace_period: 30s
|
|
# The A2A server's port inside the network (Coolify's proxy routes the domain to it); nothing listens with A2A off.
|
|
expose: ["8080"]
|
|
environment:
|
|
- TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
|
|
- TELEGRAM_ALLOWED_USER_IDS=${TELEGRAM_ALLOWED_USER_IDS}
|
|
- Telegram__Model=${TELEGRAM_MODEL:-claude-code/claude-opus-5-5}
|
|
- TZ=${TZ:-UTC}
|
|
- Logging__LogLevel__Default=${LOG_LEVEL:-Information}
|
|
# Optional features; empty means off / default.
|
|
- OPENAI_API_KEY=${OPENAI_API_KEY:-} # speech to text (attachments spec)
|
|
- STT_MODEL=${STT_MODEL:-}
|
|
- TTS_MODEL=${TTS_MODEL:-}
|
|
- TTS_VOICE=${TTS_VOICE:-}
|
|
- OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-} # group topic triggers via Jev (group triggers spec)
|
|
- TRIGGER_MODEL=${TRIGGER_MODEL:-}
|
|
- GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-} # Google Calendar (calendar spec)
|
|
- GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
|
|
- MCP_ENCRYPTION_SECRET=${MCP_ENCRYPTION_SECRET:-}
|
|
- ADMIN_USER_ID=${ADMIN_USER_ID:-} # may /impersonate other users (telegram-bot.md)
|
|
- DEFAULT_TIMEZONE=${DEFAULT_TIMEZONE:-} # chats' default zone (scheduler spec §7); empty → TZ
|
|
- PROCESS_ENV_ALLOW=${PROCESS_ENV_ALLOW:-} # deny-listed variables the agent may see, e.g. GH_TOKEN
|
|
- A2A__Enabled=${A2A_ENABLED:-false} # A2A server (a2a-server spec); needs a domain in Coolify
|
|
- A2A__PublicUrl=${A2A_PUBLIC_URL:-} # e.g. https://bot.example.com; required for push webhooks
|
|
- A2AClient__Enabled=${A2A_CLIENT_ENABLED:-false} # A2A client: the a2a tool and watches (a2a-client spec)
|
|
# Playwright MCP preset (MCP spec): the preinstalled binary, no npx download. Set PLAYWRIGHT_ENABLED=false for an
|
|
# image built with INSTALL_PLAYWRIGHT=false (no nested default: Coolify parses these expressions itself).
|
|
- PLAYWRIGHT_ENABLED=${PLAYWRIGHT_ENABLED:-true}
|
|
- PLAYWRIGHT_HEADLESS=${PLAYWRIGHT_HEADLESS:-true} # no display in the container
|
|
- PLAYWRIGHT_BROWSER=${PLAYWRIGHT_BROWSER:-}
|
|
- PLAYWRIGHT_EXTRA_ARGS=${PLAYWRIGHT_EXTRA_ARGS:---no-sandbox}
|
|
- PLAYWRIGHT_COMMAND=${PLAYWRIGHT_COMMAND:-playwright-mcp}
|
|
# git trusts every repository: workspaces copied in on the host belong to another uid, which git otherwise refuses.
|
|
- GIT_CONFIG_COUNT=1
|
|
- GIT_CONFIG_KEY_0=safe.directory
|
|
- GIT_CONFIG_VALUE_0=*
|
|
# Bind mounts on the host. Docker creates missing directories as root; the entrypoint hands the three roots to app.
|
|
volumes:
|
|
- /media/disk1/containers/volcanic_secretary_core/workspaces:/data/workspaces
|
|
- /media/disk1/containers/volcanic_secretary_core/agent:/data/agent
|
|
- /media/disk1/containers/volcanic_secretary_core/claude:/data/claude
|