@fazer-ai/agents 1.0.0

package/dist/skills/agents-onboarding/scripts/remote.py

@@ -0,0 +1,198 @@
+#!/usr/bin/env python3
+# Generic remote-bash runner for the fazer.ai agents onboarding. ONE job: run an arbitrary bash script on a
+# host over SSH WITHOUT the agent hand-assembling it on the PowerShell command line. That assembly is the
+# footgun that reappears every new context on Windows, in two distinct shapes (both seen in real runs):
+#
+#   1. Eaten quotes. `ssh <host> 'docker network ls --format "{{.Name}}" | grep -vE "^(a|b)$"'`, the inner
+#      double quotes are swallowed by Windows native-arg parsing on the way to ssh.exe, so the remote bash
+#      gets `{{.Name}}` / `^(a|b)$` UNQUOTED and dies with `syntax error near unexpected token '('`.
+#   2. BOM on a here-string. `@'...set -euo pipefail...'@ | ssh ... 'bash -s'`, PowerShell prepends a UTF-8
+#      BOM to the piped text; the remote bash reads `set` as an unknown command on line 1, so the
+#      guard never arms and the rest of a (possibly destructive) script runs unguarded.
+#
+# Both vanish with the same move: write the script to a `.sh` file (with the editing tool, no shell in the
+# loop) and feed it to the remote `bash -s` through THIS helper, which streams the bytes to ssh's stdin via
+# a DIRECT argv list (no local shell). The script content never touches a command line, so quotes, `$()`,
+# `{{...}}`, `(`, heredocs and newlines arrive byte-for-byte on every OS. Same payload-owning pattern as
+# coolify.py (psql) and docker-status.py (`docker ps`), generalized to any script.
+#
+#   remote.py --ssh root@HOST --ssh-opts "-i ~/.ssh/key" --script-file recon.sh             # stream output
+#   remote.py --ssh root@HOST --ssh-opts "-i ~/.ssh/key" --script-file wipe.sh --sudo        # via sudo -n
+#   remote.py --ssh ... --in-container coolify-db --exec "psql -U coolify -d coolify" --script-file q.sql  # psql in a container
+#   remote.py --ssh ... --in-container <rails-c> --exec "bundle exec rails runner -" --script-file t.rb     # rails runner
+#   remote.py --ssh root@HOST --ssh-opts "-i ~/.ssh/key" --script-file x.sh --capture        # JSON result
+#   remote.py --ssh root@HOST --ssh-opts "-i ~/.ssh/key" --script-file x.sh --dry-run         # argv+preview
+#
+# Same payload-on-stdin trick for a console INSIDE a container: psql and `rails runner -` read their program
+# from stdin, so --in-container/--exec delivers a .sql/.rb file byte-exact too (the `\` of a PHP/Ruby
+# namespace, accents, quotes, none of it touches a command line).
+#
+# Python 3 stdlib only (no pip). Runs ssh via Bash with dangerouslyDisableSandbox:true (it is network),
+# same as sshkey.py/docker-status.py. Output streams live by default (long installs do not look hung and
+# do not trip the harness timeout); exit code is propagated. --capture buffers and returns JSON instead.
+import argparse
+import json
+import os
+import re
+import shlex
+import subprocess
+import sys
+
+BOM = b"\xef\xbb\xbf"
+# Container name is interpolated into the remote command, so keep it to a safe bare token.
+SAFE_TOKEN = set("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-")
+# --exec is the in-container program that reads the script from stdin (psql / rails runner -). Allow only
+# bare words, flags and the punctuation those need, no shell metacharacters that the remote shell would act on.
+EXEC_OK = re.compile(r"^[A-Za-z0-9 _=:./-]+$")
+# Git Bash/MSYS on Windows reports paths as "/c/Users/..." (or "/mnt/c/..." under WSL), but native Python
+# on Windows cannot open those: it needs "C:\Users\...". Match a leading drive segment so we can retranslate.
+MSYS_DRIVE_RE = re.compile(r"^/(?:mnt/)?([A-Za-z])/(.*)$")
+
+
+def out(obj, code=0):
+    print(json.dumps(obj))
+    sys.exit(code)
+
+
+def fail(msg, **extra):
+    out({"ok": False, "error": msg, **extra}, code=1)
+
+
+def msys_to_native(path):
+    # Translate a Git Bash/MSYS/WSL path ("/c/Users/me/x.sh", "/mnt/c/Users/me/x.sh") to the native Windows
+    # form ("C:\Users\me\x.sh") so open() finds it. Returns None when the path is not drive-prefixed (nothing
+    # to translate). POSIX paths and already-native Windows paths ("C:\...", "C:/...") are left to open() as-is.
+    m = MSYS_DRIVE_RE.match(path)
+    if not m:
+        return None
+    drive, rest = m.group(1), m.group(2)
+    return f"{drive.upper()}:\\" + rest.replace("/", "\\")
+
+
+def split_ssh_opts(opts, _nt=None):
+    # POSIX shlex eats backslashes, so a Windows key path ("-i C:\Users\me\.ssh\key") would arrive as
+    # "C:Usersme.sshkey". On Windows, tokenize WITHOUT escape processing and strip the surrounding quotes
+    # ourselves so backslashes survive. _nt is injectable for tests. (Kept in sync with docker-status.py.)
+    nt = (os.name == "nt") if _nt is None else _nt
+    if not opts:
+        return []
+    if nt:
+        toks = shlex.split(opts, posix=False)
+        return [t[1:-1] if len(t) >= 2 and t[0] == t[-1] and t[0] in "\"'" else t for t in toks]
+    return shlex.split(opts)
+
+
+def _read_bytes(path):
+    with open(path, "rb") as f:
+        return f.read()
+
+
+def read_script(path):
+    if path == "-":
+        data = sys.stdin.buffer.read()
+    else:
+        try:
+            data = _read_bytes(path)
+        except OSError as exc:
+            # A Git Bash/MSYS path ("/c/Users/me/x.sh") reaches native Windows Python verbatim and fails to
+            # open; retry the translated native form ("C:\Users\me\x.sh") before giving up.
+            native = msys_to_native(path)
+            if native is None:
+                fail(f"cannot read --script-file {path!r}: {exc}")
+            try:
+                data = _read_bytes(native)
+            except OSError as exc2:
+                fail(f"cannot read --script-file {path!r} (tried {native!r}): {exc2}")
+    # Strip a stray UTF-8 BOM defensively: a PowerShell here-string / `Out-File` adds one and it breaks the
+    # script's first line (the exact failure this helper exists to remove). We deliver the rest byte-exact.
+    if data[:3] == BOM:
+        data = data[3:]
+    if not data.strip():
+        fail("script is empty")
+    return data
+
+
+def build_argv(args, remote):
+    return [
+        "ssh", "-o", "BatchMode=yes", "-o", f"ConnectTimeout={args.connect_timeout}",
+        "-o", "StrictHostKeyChecking=accept-new", *split_ssh_opts(args.ssh_opts), args.ssh, remote,
+    ]
+
+
+def remote_command(args):
+    # The remote command carries NO payload; it just starts the interpreter; the script rides in on stdin,
+    # so it never hits a command line. `bash -s` and `docker exec -i <c> <prog>` (psql, `rails runner -`)
+    # all read their program from stdin. `sudo -n` fails fast instead of hanging on a password prompt.
+    if args.in_container:
+        if any(c not in SAFE_TOKEN for c in args.in_container):
+            fail(f"invalid --in-container {args.in_container!r} (expected a bare [A-Za-z0-9._-] token)")
+        inner = args.exec or "bash -s"
+        if not EXEC_OK.match(inner):
+            fail(f"invalid --exec {inner!r} (bare words/flags only: [A-Za-z0-9 _=:./-])")
+        base = f"docker exec -i {args.in_container} {inner}"
+    else:
+        base = "bash -s"
+    return f"sudo -n -- {base}" if args.sudo else base
+
+
+def cmd_run(args):
+    script = read_script(args.script_file)
+    remote = remote_command(args)
+    argv = build_argv(args, remote)
+    if args.dry_run:
+        preview = script[:400].decode("utf-8", "replace")
+        out({
+            "ok": True, "dry_run": True, "remote_cmd": remote, "argv": argv,
+            "script_bytes": len(script), "script_preview": preview,
+        })
+    timeout = args.timeout or None
+    try:
+        if args.capture:
+            proc = subprocess.run(argv, input=script, capture_output=True, timeout=timeout)
+            ok = proc.returncode == 0
+            out({
+                "ok": ok, "exit_code": proc.returncode,
+                "stdout": proc.stdout.decode("utf-8", "replace"),
+                "stderr": proc.stderr.decode("utf-8", "replace"),
+            }, code=0 if ok else 1)
+        # Stream mode: inherit stdout/stderr so the agent sees output live; feed the script on stdin.
+        proc = subprocess.run(argv, input=script, timeout=timeout)
+        sys.exit(proc.returncode)
+    except FileNotFoundError:
+        fail("ssh not found on PATH")
+    except subprocess.TimeoutExpired:
+        fail("ssh timed out", remote_cmd=remote)
+
+
+def build_parser():
+    parser = argparse.ArgumentParser(
+        prog="remote.py",
+        description="Run an arbitrary bash script on a host over SSH (payload-owning; survives "
+        "PowerShell->SSH). Write the script to a .sh file and point --script-file at it.",
+    )
+    parser.add_argument("--ssh", required=True, metavar="USER@HOST")
+    parser.add_argument("--ssh-opts", default="", help="extra ssh options, e.g. '-i ~/.ssh/key -p 2222'")
+    parser.add_argument("--script-file", required=True, metavar="PATH",
+                        help="path to the bash script to run remotely ('-' reads stdin; avoid '-' on PowerShell)")
+    parser.add_argument("--in-container", default="", metavar="NAME",
+                        help="pipe the script into `docker exec -i NAME ...` on the host (console in a container)")
+    parser.add_argument("--exec", default="", metavar="CMD",
+                        help="program inside --in-container that reads the script on stdin, e.g. "
+                        "'psql -U coolify -d coolify -v ON_ERROR_STOP=1' or 'bundle exec rails runner -' (default: bash -s)")
+    parser.add_argument("--sudo", action="store_true", help="run via `sudo -n -- …` (works with bash -s and --in-container)")
+    parser.add_argument("--capture", action="store_true",
+                        help="buffer and print {ok, exit_code, stdout, stderr} as JSON instead of streaming")
+    parser.add_argument("--connect-timeout", type=int, default=12)
+    parser.add_argument("--timeout", type=int, default=0, help="ssh timeout in seconds (0 = no limit; installs run long)")
+    parser.add_argument("--dry-run", action="store_true", help="print the argv + script preview, do not connect")
+    parser.set_defaults(fn=cmd_run)
+    return parser
+
+
+def main():
+    args = build_parser().parse_args()
+    args.fn(args)
+
+
+if __name__ == "__main__":
+    main()

package/dist/skills/agents-onboarding/scripts/sshkey.py

@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+# SSH key helper for the fazer.ai agents onboarding. Two jobs:
+#   generate   create a dedicated ed25519 key and print the PUBLIC half for the operator to paste in the
+#              VPS panel. ssh-keygen is spawned with a DIRECT argv list (no shell) so the empty passphrase
+#              `-N ""` survives on every OS. Driven through a shell line, PowerShell DROPS the empty-string
+#              arg, ssh-keygen then falls into its interactive passphrase prompt and HANGS, exactly what
+#              cost a Windows run six failed attempts and a timeout. argv-direct sidesteps the whole class.
+#   wait-access  poll SSH until the freshly pasted key logs in, so the agent detects "done" itself instead
+#              of asking the operator to come back and confirm. Timeout -> exit 1 (caller falls back to ask).
+# Python 3 stdlib only (no pip). `generate` is local; `wait-access` runs ssh via Bash with
+# dangerouslyDisableSandbox:true (it is network), same as the other helpers.
+import argparse
+import json
+import os
+import re
+import shlex
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+NAME_RE = re.compile(r"^[A-Za-z0-9._-]+$")
+
+
+def out(obj, code=0):
+    print(json.dumps(obj))
+    sys.exit(code)
+
+
+def fail(msg, **extra):
+    out({"ok": False, "error": msg, **extra}, code=1)
+
+
+def split_ssh_opts(opts, _nt=None):
+    # POSIX shlex eats backslashes, so a Windows key path ("-i C:\Users\me\.ssh\key") would arrive as
+    # "C:Usersme.sshkey" (a real onboarding failure). On Windows, tokenize WITHOUT escape processing and
+    # strip the surrounding quotes ourselves so backslashes are preserved. _nt is injectable for tests.
+    nt = (os.name == "nt") if _nt is None else _nt
+    if not opts:
+        return []
+    if nt:
+        toks = shlex.split(opts, posix=False)
+        return [t[1:-1] if len(t) >= 2 and t[0] == t[-1] and t[0] in "\"'" else t for t in toks]
+    return shlex.split(opts)
+
+
+def cmd_generate(args):
+    if not NAME_RE.match(args.name):
+        fail(f"invalid --name {args.name!r} (expected a bare filename [A-Za-z0-9._-]+, no path)")
+    ssh_dir = Path(args.ssh_dir).expanduser() if args.ssh_dir else Path.home() / ".ssh"
+    try:
+        ssh_dir.mkdir(parents=True, exist_ok=True)
+        os.chmod(ssh_dir, 0o700)
+    except OSError as exc:
+        fail(f"cannot prepare ssh dir {ssh_dir}: {exc}")
+    key = ssh_dir / args.name
+    pub = Path(str(key) + ".pub")
+    existed = key.exists() and pub.exists()
+    if not existed:
+        # argv-direct: the empty passphrase "" is a real, separate argv element on every OS here.
+        argv = ["ssh-keygen", "-t", "ed25519", "-f", str(key), "-N", "", "-C", args.comment]
+        try:
+            proc = subprocess.run(argv, capture_output=True, text=True, timeout=args.timeout)
+        except FileNotFoundError:
+            fail("ssh-keygen not found on PATH (install OpenSSH client)")
+        except subprocess.TimeoutExpired:
+            fail("ssh-keygen timed out (interactive prompt? the empty passphrase did not pass through)")
+        if proc.returncode != 0 or not pub.exists():
+            fail("ssh-keygen failed", exit_code=proc.returncode, stderr=(proc.stderr or "")[-400:])
+        try:
+            os.chmod(key, 0o600)
+        except OSError:
+            pass
+    try:
+        public_key = pub.read_text(encoding="utf-8").strip()
+    except OSError as exc:
+        fail(f"key generated but cannot read public half: {exc}")
+    out({"ok": True, "key_path": str(key), "public_key": public_key, "existed": existed})
+
+
+def cmd_wait_access(args):
+    argv = [
+        "ssh", "-o", "BatchMode=yes", "-o", f"ConnectTimeout={args.connect_timeout}",
+        "-o", "StrictHostKeyChecking=accept-new", *split_ssh_opts(args.ssh_opts), args.ssh, "echo OK",
+    ]
+    last = None
+    for i in range(args.attempts):
+        try:
+            proc = subprocess.run(argv, capture_output=True, text=True, timeout=args.timeout)
+        except FileNotFoundError:
+            fail("ssh not found on PATH")
+        except subprocess.TimeoutExpired:
+            proc = None
+        if proc is not None and proc.returncode == 0 and "OK" in (proc.stdout or ""):
+            out({"ok": True, "reachable": True, "attempt": i + 1})
+        if proc is not None:
+            last = (proc.stderr or proc.stdout or "").strip()[-200:]
+        if i < args.attempts - 1:
+            time.sleep(args.interval)
+    out(
+        {"ok": False, "reachable": False, "attempts": args.attempts, "last_error": last,
+         "note": "key not active yet: confirm it is pasted in the VPS panel, or ask the operator"},
+        code=1,
+    )
+
+
+def build_parser():
+    parser = argparse.ArgumentParser(
+        prog="sshkey.py",
+        description="Generate a dedicated ed25519 key (argv-direct, empty passphrase safe on Windows) "
+        "and poll SSH access.",
+    )
+    sub = parser.add_subparsers(dest="cmd", required=True)
+
+    gen = sub.add_parser("generate", help="create ~/.ssh/<name> ed25519 (idempotent) and print the public key")
+    gen.add_argument("--name", required=True, help="bare key filename; use the fixed 'fazer-ai-agents' so re-runs reuse the same key (no per-run suffix)")
+    gen.add_argument("--comment", default="fazer-ai-onboarding", help="ssh-keygen -C comment")
+    gen.add_argument("--ssh-dir", default="", help="override the .ssh dir (default ~/.ssh; for tests)")
+    gen.add_argument("--timeout", type=int, default=30)
+    gen.set_defaults(fn=cmd_generate)
+
+    wait = sub.add_parser("wait-access", help="poll SSH until the pasted key logs in (else exit 1)")
+    wait.add_argument("--ssh", required=True, metavar="USER@HOST")
+    wait.add_argument("--ssh-opts", default="", help="extra ssh options, e.g. '-i ~/.ssh/key -p 2222'")
+    wait.add_argument("--attempts", type=int, default=30, help="poll attempts (default 30)")
+    wait.add_argument("--interval", type=int, default=5, help="seconds between attempts (default 5)")
+    wait.add_argument("--connect-timeout", type=int, default=12)
+    wait.add_argument("--timeout", type=int, default=20, help="per-attempt ssh timeout")
+    wait.set_defaults(fn=cmd_wait_access)
+
+    return parser
+
+
+def main():
+    args = build_parser().parse_args()
+    args.fn(args)
+
+
+if __name__ == "__main__":
+    main()

package/dist/skills/agents-onboarding/templates/chatwoot/.env.example

@@ -0,0 +1,30 @@
+# Chatwoot (generic flavor): copy to .env and fill every CHANGE_ME. Do NOT commit the filled .env.
+# Generate secrets with: openssl rand -hex 64  (SECRET_KEY_BASE) / openssl rand -hex 24 (passwords)
+
+# Public URL (where your reverse proxy serves Chatwoot). Required.
+CHATWOOT_URL=https://chatwoot.example.com
+CHATWOOT_LOCALE=pt_BR
+
+# Postgres (this stack's own DB; pgvector image).
+POSTGRES_DB=chatwoot_production
+POSTGRES_USER=chatwoot
+POSTGRES_PASSWORD=CHANGE_ME_pg_password
+
+# Rails secret (128 hex chars: openssl rand -hex 64).
+SECRET_KEY_BASE=CHANGE_ME_secret_key_base
+
+# Redis password (openssl rand -hex 24).
+REDIS_PASSWORD=CHANGE_ME_redis_password
+
+# Host bind for the web port (front it with your own TLS proxy). Default localhost-only.
+CHATWOOT_PORT=127.0.0.1:3001
+
+# ─────────────────────────────────────────────────────────────────────────────
+# EDITION SELECTION
+#   OSS (default, no hub subscription): leave CHATWOOT_IMAGE unset (uses our ghcr.io/fazer-ai/chatwoot fork), do NOT set COMPOSE_PROFILES.
+#   Pro (hub subscription): uncomment BOTH lines below, then `docker login harbor.fazer.ai`
+#   (hub: generate_install_script reveals the credential) BEFORE deploying. Pro adds Baileys WhatsApp.
+# ─────────────────────────────────────────────────────────────────────────────
+# CHATWOOT_IMAGE=harbor.fazer.ai/chatwoot/fazer-ai/chatwoot-pro:latest
+# COMPOSE_PROFILES=pro
+# BAILEYS_DEFAULT_API_KEY=CHANGE_ME_baileys_key   # required only for Pro (openssl rand -hex 24)

package/dist/skills/agents-onboarding/templates/chatwoot/README.md

@@ -0,0 +1,65 @@
+# Chatwoot (self-hosted) for fazer.ai
+
+The inbox fazer.ai agents plugs into. The onboarding installs Chatwoot as part of the journey, in one of
+**two editions**, chosen by whether the operator has a subscription on the fazer.ai hub:
+
+| Edition | Image | When | Extra features |
+| --- | --- | --- | --- |
+| **Pro** | `harbor.fazer.ai/chatwoot/fazer-ai/chatwoot-pro` (private Harbor) | operator **has a hub license** | Baileys WhatsApp provider, Kanban |
+| **OSS** | `ghcr.io/fazer-ai/chatwoot` (our public fork) | **no** hub subscription | standard Chatwoot (official WhatsApp Cloud API, etc.) |
+
+**Both editions work with fazer.ai agents**: the integration is the standard Chatwoot Agent Bot + API
+(see `docs/chatwoot.md`). OSS is **not** a downgrade of compatibility, only of
+Pro-exclusive channels/features.
+
+**Edition source (in order).** The onboarding CLI captures the operator's choice up front and writes it to
+`~/.fazer-ai/onboarding.json` (`{ "chatwootTier": "pro" | "community", "chatwootLicenseId": "<id>" }`).
+Read that marker **first**: `"pro"` → deploy the Pro image and license it at step 9b (use
+`chatwootLicenseId`); `"community"` → deploy OSS (the operator deliberately chose to skip Pro). Only if the
+marker is **absent** (token fallback or a non-CLI entry point) fall back to the hub (`list_licenses` /
+`whoami`): a `CHATWOOT` license → Pro; otherwise OSS. The marker wins because "proceed without Pro" is an
+intent the hub can't express: an operator may own a license yet still pick OSS for this box.
+
+## Files
+
+| File | Use |
+| --- | --- |
+| `docker-compose.yml` | **Generic**: Portainer / EasyPanel / Dokploy / plain Docker. ONE file, both editions via env. |
+| `docker-compose.coolify.yml` | **Coolify** (magic vars; secrets auto-generated). Pro image by default. |
+| `.env.example` | Template for the generic flavor. `cp .env.example .env`, fill every `CHANGE_ME`. |
+
+Topology (both): `chatwoot` (web) + `sidekiq` + `postgres` (pgvector) + `redis`, plus `baileys-api`
+**only in Pro** (compose profile `pro`).
+
+## Deploy (generic: Portainer / plain Docker)
+
+```sh
+cp .env.example .env        # fill every CHANGE_ME (openssl rand -hex 64 / -hex 24)
+
+# OSS (no subscription):
+docker compose up -d
+
+# Pro (hub subscription): authenticate to Harbor first, then enable the pro profile + image.
+docker login harbor.fazer.ai          # username + secret from the hub (generate_install_script)
+CHATWOOT_IMAGE=harbor.fazer.ai/chatwoot/fazer-ai/chatwoot-pro:latest \
+COMPOSE_PROFILES=pro docker compose up -d
+```
+
+**Portainer**: paste `docker-compose.yml` as a Stack and provide the same variables in the Stack env
+editor (for Pro, add `CHATWOOT_IMAGE` + `COMPOSE_PROFILES=pro` and register the Harbor credential under
+Registries first, or `Registries:[<id>]` in the API). Front `chatwoot.<domain>` with a TLS proxy: the
+fazer.ai agents [`docker-compose.portainer.yml`](../docker-compose.portainer.yml) bundled Caddy can do
+this (point a Caddy site at the published `CHATWOOT_PORT`); see the `agents-onboarding` skill (`references/deploy-b-portainer.md`).
+
+## Wire into fazer.ai agents
+
+After both are up (see `docs/chatwoot.md`): create a Chatwoot admin, mint an
+admin token, then from the agents register the deployment (`POST /v1/chatwoot/deployment {baseUrl, adminToken}`),
+sync the account inbox, and bind an inbox to an agent (`PATCH /v1/chatwoot/inboxes/:id {agentId}`), which
+auto-provisions the Agent Bot. The bind is identical for Pro and OSS.
+
+## First admin
+
+In the real flow the operator creates the first Chatwoot admin **in the browser** at `CHATWOOT_URL/app`.
+The agent never creates the account or the admin; it waits for the operator, then reads the admin token
+(`scripts/chatwoot-admin.py provision`, Rails runner read-only) to connect the deployment.

package/dist/skills/agents-onboarding/templates/chatwoot/docker-compose.coolify.yml

@@ -0,0 +1,136 @@
+# Chatwoot for fazer.ai: COOLIFY flavor (magic vars; Coolify auto-generates the SERVICE_* secrets).
+# Edition by CHATWOOT_IMAGE: default = Pro (private Harbor image); for OSS set
+# CHATWOOT_IMAGE=ghcr.io/fazer-ai/chatwoot:latest (our public fork) AND drop the baileys-api service.
+# Pro pull needs the Harbor registry credential configured in Coolify (hub: per-user credential); OSS needs none.
+# Set the service Domain in Coolify to your Chatwoot FQDN (fills SERVICE_URL_CHATWOOT).
+# This is the compose validated in the RUN 2 Coolify deploy; the generic/Portainer flavor is ./docker-compose.yml.
+
+services:
+  chatwoot:
+    image: '${CHATWOOT_IMAGE:-harbor.fazer.ai/chatwoot/fazer-ai/chatwoot-pro:latest}'
+    pull_policy: always
+    volumes:
+      - 'storage:/app/storage'
+    depends_on:
+      - postgres
+      - redis
+    environment:
+      - SERVICE_URL_CHATWOOT
+      - NODE_ENV=production
+      - RAILS_ENV=production
+      - INSTALLATION_ENV=docker
+      - DEFAULT_LOCALE=pt_BR
+      - LOG_LEVEL=${RAILS_LOG_LEVEL:-info}
+      - 'FRONTEND_URL=${SERVICE_URL_CHATWOOT}'
+      - 'INTERNAL_HOST_URL=http://chatwoot:3000'
+      - POSTGRES_HOST=postgres
+      - POSTGRES_PORT=5432
+      - 'POSTGRES_USERNAME=${SERVICE_USER_POSTGRES}'
+      - 'POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRES}'
+      - 'POSTGRES_DATABASE=${POSTGRES_DB:-chatwoot_production}'
+      - 'SECRET_KEY_BASE=${SERVICE_PASSWORD_64_SECRETKEYBASE}'
+      - 'REDIS_URL=redis://redis:6379'
+      - 'REDIS_PASSWORD=${SERVICE_PASSWORD_REDIS}'
+      - 'BAILEYS_PROVIDER_DEFAULT_CLIENT_NAME=${BAILEYS_PROVIDER_DEFAULT_CLIENT_NAME:-Chatwoot}'
+      - 'BAILEYS_PROVIDER_DEFAULT_URL=http://baileys-api:3025'
+      - 'BAILEYS_PROVIDER_DEFAULT_API_KEY=${SERVICE_PASSWORD_64_DEFAULTAPIKEY}'
+      - BAILEYS_PROVIDER_USE_INTERNAL_HOST_URL=true
+      - 'MAILER_SENDER_EMAIL=${MAILER_SENDER_EMAIL}'
+      - 'RESEND_API_KEY=${RESEND_API_KEY}'
+    entrypoint: docker/entrypoints/rails.sh
+    command:
+      - sh
+      - '-c'
+      - 'bundle exec rails db:chatwoot_prepare && bundle exec rails branding:update && exec bundle exec rails s -p 3000 -b 0.0.0.0'
+    restart: always
+    healthcheck:
+      test: ['CMD-SHELL', 'wget -qO- --header="Accept: text/html" http://127.0.0.1:3000/']
+      interval: 20s
+      timeout: 10s
+      retries: 5
+  sidekiq:
+    image: '${CHATWOOT_IMAGE:-harbor.fazer.ai/chatwoot/fazer-ai/chatwoot-pro:latest}'
+    pull_policy: always
+    volumes:
+      - 'storage:/app/storage'
+    depends_on:
+      - postgres
+      - redis
+    environment:
+      - NODE_ENV=production
+      - RAILS_ENV=production
+      - INSTALLATION_ENV=docker
+      - DEFAULT_LOCALE=pt_BR
+      - LOG_LEVEL=${RAILS_LOG_LEVEL:-info}
+      - 'FRONTEND_URL=${SERVICE_URL_CHATWOOT}'
+      - 'INTERNAL_HOST_URL=http://chatwoot:3000'
+      - POSTGRES_HOST=postgres
+      - POSTGRES_PORT=5432
+      - 'POSTGRES_USERNAME=${SERVICE_USER_POSTGRES}'
+      - 'POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRES}'
+      - 'POSTGRES_DATABASE=${POSTGRES_DB:-chatwoot_production}'
+      - 'SECRET_KEY_BASE=${SERVICE_PASSWORD_64_SECRETKEYBASE}'
+      - 'REDIS_URL=redis://redis:6379'
+      - 'REDIS_PASSWORD=${SERVICE_PASSWORD_REDIS}'
+      - 'BAILEYS_PROVIDER_DEFAULT_URL=http://baileys-api:3025'
+      - 'BAILEYS_PROVIDER_DEFAULT_API_KEY=${SERVICE_PASSWORD_64_DEFAULTAPIKEY}'
+      - BAILEYS_PROVIDER_USE_INTERNAL_HOST_URL=true
+      - 'MAILER_SENDER_EMAIL=${MAILER_SENDER_EMAIL}'
+      - 'RESEND_API_KEY=${RESEND_API_KEY}'
+    command: ['bundle', 'exec', 'sidekiq', '-C', 'config/sidekiq.yml']
+    restart: always
+    healthcheck:
+      test: ['CMD-SHELL', 'ps aux | grep [s]idekiq']
+      interval: 20s
+      timeout: 10s
+      retries: 5
+  postgres:
+    image: 'ghcr.io/fazer-ai/pgvector:16'
+    restart: always
+    volumes:
+      - 'postgres:/var/lib/postgresql/data'
+    environment:
+      - 'POSTGRES_DB=${POSTGRES_DB:-chatwoot_production}'
+      - 'POSTGRES_USER=${SERVICE_USER_POSTGRES}'
+      - 'POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRES}'
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -h localhost -p 5432 -U $${POSTGRES_USER} -d $${POSTGRES_DB}']
+      interval: 20s
+      timeout: 20s
+      retries: 10
+  redis:
+    image: 'redis:alpine'
+    restart: always
+    command: ['sh', '-c', 'redis-server --requirepass "${SERVICE_PASSWORD_REDIS}"']
+    volumes:
+      - 'redis:/data'
+    environment:
+      - 'REDIS_PASSWORD=${SERVICE_PASSWORD_REDIS}'
+    healthcheck:
+      test: ['CMD-SHELL', 'redis-cli -h localhost -p 6379 -a $${REDIS_PASSWORD} ping']
+      interval: 20s
+      timeout: 20s
+      retries: 10
+  baileys-api:
+    image: 'ghcr.io/fazer-ai/baileys-api:latest'
+    pull_policy: always
+    volumes:
+      - 'storage:/app/storage'
+    environment:
+      - NODE_ENV=production
+      - 'REDIS_URL=redis://redis:6379'
+      - 'REDIS_PASSWORD=${SERVICE_PASSWORD_REDIS}'
+      - 'LOG_LEVEL=${BAILEYS_API_LOG_LEVEL:-info}'
+      - 'BAILEYS_PROVIDER_DEFAULT_API_KEY=${SERVICE_PASSWORD_64_DEFAULTAPIKEY}'
+    command: ['sh', '-c', 'bun manage-api-keys create user ${SERVICE_PASSWORD_64_DEFAULTAPIKEY} && bun start']
+    restart: always
+    healthcheck:
+      test: ['CMD-SHELL', 'wget -qO- http://localhost:3025/status']
+      interval: 20s
+      timeout: 20s
+      retries: 10
+
+volumes:
+  storage:
+  postgres:
+  redis: