7bb41f0b5b
Entrypoint drops the capability bounding set and sets no_new_privs. Security docs and spec no longer claim the agent can't reach the secrets; docker exec fallbacks use a clean environment. PLAYWRIGHT_ENABLED drops the nested compose default. Tests pin the Dockerfile's Playwright install step and the compose model fallback.
40 lines
1.6 KiB
Plaintext
40 lines
1.6 KiB
Plaintext
# Copy to .env for `docker compose up -d --build`. On Coolify, set these as the resource's environment variables.
|
|
# Never add ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL, CLAUDE_CODE_OAUTH_TOKEN,
|
|
# CLAUDE_CODE_USE_BEDROCK or CLAUDE_CODE_USE_VERTEX: the Claude Code provider is subscription-only and refuses to run.
|
|
|
|
# Required. Allowed Telegram user ids, comma separated; the first one is the owner (re-login prompts, "Online").
|
|
TELEGRAM_BOT_TOKEN=
|
|
TELEGRAM_ALLOWED_USER_IDS=
|
|
|
|
# Model every chat uses (empty = the compose default), log level, container time zone.
|
|
TELEGRAM_MODEL=
|
|
LOG_LEVEL=Information
|
|
TZ=UTC
|
|
|
|
# Build: Playwright MCP + Chromium in the image (~+400 MB); Claude Code version (2.1 = newest 2.1.x at build time).
|
|
INSTALL_PLAYWRIGHT=true
|
|
CLAUDE_CODE_VERSION=2.1
|
|
|
|
# Speech to text for voice notes (empty = off).
|
|
OPENAI_API_KEY=
|
|
STT_MODEL=
|
|
|
|
# Google Calendar (both set = on; each chat connects its own account with /calendar_connect).
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
|
|
# Default time zone for chats that never ran /timezone (IANA name, e.g. Europe/Berlin; empty = TZ).
|
|
DEFAULT_TIMEZONE=
|
|
|
|
# Deny-listed variables the agent's processes may see anyway, comma separated (e.g. GH_TOKEN).
|
|
PROCESS_ENV_ALLOW=
|
|
|
|
# Playwright MCP preset; empty = compose defaults (enabled, headless, chromium, --no-sandbox, playwright-mcp).
|
|
# An override of PLAYWRIGHT_EXTRA_ARGS must keep --no-sandbox.
|
|
# An image built with INSTALL_PLAYWRIGHT=false also needs PLAYWRIGHT_ENABLED=false.
|
|
PLAYWRIGHT_ENABLED=
|
|
PLAYWRIGHT_HEADLESS=
|
|
PLAYWRIGHT_BROWSER=
|
|
PLAYWRIGHT_EXTRA_ARGS=
|
|
PLAYWRIGHT_COMMAND=
|