# roost — copy to .env next to compose.yml and edit. Only PUBLIC_KEYS is
# required; everything else has a default.

# Who may log in as `agent`: public keys (laptop, phone, ...), separated by
# commas or newlines:
#   PUBLIC_KEYS="ssh-ed25519 AAAA... laptop,ssh-ed25519 AAAA... phone"
PUBLIC_KEYS=

# The box's sshd is published on SSH_BIND:SSH_PORT. 0.0.0.0 = every interface
# of the docker host (LAN, Tailscale, ...). Binding one IP fails to start if
# that IP is not up yet (e.g. Tailscale after a reboot).
SSH_PORT=2222
SSH_BIND=0.0.0.0

# ---------------------------------------------------------------------------
# Container
# ---------------------------------------------------------------------------
# Persistent home volume (logins, repos, mise tools) and the SSH identity
# directory (host key + authorized_keys, root-owned; created on first start). On a NAS use a durable appdata path, e.g.
#   /mnt/user/appdata/roost
ROOST_HOME=/srv/roost
ROOST_SSH=/srv/roost-ssh

# uid:gid that own the home volume and files the agent writes.
#   typical Linux user: 1000:1000
#   Unraid:             99:100   (nobody:users)
# Changing these needs a recreate: docker compose up -d
PUID=1000
PGID=1000

TZ=UTC

# Committed as your git identity inside the container.
GIT_USER_NAME=
GIT_USER_EMAIL=

# Optional GitHub token (fine-grained, only the repos you need). gh is logged
# in with it on every start and git uses it for HTTPS. Like every login in the
# box, every agent in it can read it.
GH_TOKEN=

# ---------------------------------------------------------------------------
# What gets installed at first start (mise specs, space-separated)
# ---------------------------------------------------------------------------
# Harnesses (mise specs). mise knows these by name:
#   claude codex opencode gemini copilot pi omp amp qwen grok crush aider? see docs/tools.md
# Set CURSOR=1 to add the Cursor Agent CLI (mise: cursor-agent).
HARNESSES=claude codex opencode
CURSOR=0

# Pre-accept Claude's folder-trust dialog for ~/projects/* (the box is the
# security boundary). Set 0 to keep the dialog.
TRUST_PROJECTS=1

# Always-on tooling + optional extras. herdr is required (it is the runtime).
TOOLS=herdr uv gh glab npm:ccusage npm:playwright npm:@playwright/mcp

# Extra apt packages, space-separated. Builds a thin Dockerfile.user overlay on
# top of the published image; only used with
#   docker compose -f compose.yml -f compose.user.yml up -d --build
EXTRA_PACKAGES=

# Container image (a fork's own image, or roost:dev built locally).
ROOST_IMAGE=ghcr.io/aronjanosch/roost:latest

# Resource guards.
MEM_LIMIT=6g
PIDS_LIMIT=2048