lastlight 0.16.0 → 0.16.2

package/deploy/.env.production.example

@@ -1,100 +0,0 @@
-# ── Last Light — Production Environment ──────────────────────────
-# Copy this file to instance/secrets/.env and fill in your values, where
-# instance/ is your private deployment overlay (a separate repo cloned next to
-# docker-compose.yml). The whole instance/ folder is mounted read-only into the
-# container at /app/instance; the entrypoint reads secrets from
-# /app/instance/secrets, and both the agent and caddy services read this file
-# via env_file. No repo-root .env is needed.
-#
-# Overlay config + assets (config.yaml + agent-context/ + workflows/ + skills/)
-# are read at startup — edit and `lastlight server restart agent` to apply, no
-# rebuild. (Removing a var here needs a recreate: `lastlight server start agent`.)
-LASTLIGHT_OVERLAY_DIR=/app/instance
-
-# =================================================================
-# GITHUB APP (required)
-# =================================================================
-# Create a GitHub App: https://docs.github.com/en/apps/creating-github-apps
-# Permissions: Issues (R/W), Pull Requests (R/W), Contents (R/W), Metadata (R).
-# Subscribe to issue, issue_comment, pull_request, and pull_request_review events.
-# Drop the App private key at instance/secrets/app.pem (the entrypoint symlinks
-# it to /app/app.pem; GITHUB_APP_PRIVATE_KEY_PATH is resolved relative to /app).
-
-GITHUB_APP_ID=
-GITHUB_APP_PRIVATE_KEY_PATH=./app.pem
-GITHUB_APP_INSTALLATION_ID=
-
-# =================================================================
-# WEBHOOK (required)
-# =================================================================
-# Must match the webhook secret configured in your GitHub App settings.
-
-WEBHOOK_SECRET=change-me-to-a-random-string
-
-# =================================================================
-# MODEL + LLM PROVIDER (required — pick one provider key)
-# =================================================================
-# Default model for sandbox + chat. Any provider/model agentic-pi supports:
-# anthropic/…, openai/…, openrouter/<vendor>/<model>, or any pi-ai provider
-# (google/…, mistral/…, groq/…, cerebras/…, xai/…, huggingface/…, moonshotai/…,
-# nvidia/…, fireworks/…, together/…, deepseek/…, zai/…, kimi-coding/…,
-# minimax/…). See src/providers.ts for the registered set.
-LASTLIGHT_MODEL=anthropic/claude-sonnet-4-6
-
-# Set whichever key matches LASTLIGHT_MODEL (set more than one if per-task
-# overrides in config.yaml route phases to different providers).
-# ANTHROPIC_API_KEY=sk-ant-...
-# OPENAI_API_KEY=sk-proj-...
-# OPENROUTER_API_KEY=sk-or-...
-# GEMINI_API_KEY=AIza...      MISTRAL_API_KEY=...      GROQ_API_KEY=gsk_...
-# CEREBRAS_API_KEY=...        XAI_API_KEY=...           HF_TOKEN=hf_...
-# MOONSHOT_API_KEY=...        NVIDIA_API_KEY=...        FIREWORKS_API_KEY=...
-# TOGETHER_API_KEY=...        DEEPSEEK_API_KEY=...      ZAI_API_KEY=...
-# KIMI_API_KEY=...            MINIMAX_API_KEY=...
-
-# =================================================================
-# DOMAIN (for Caddy TLS)
-# =================================================================
-# Public hostname for automatic Let's Encrypt TLS. Leave "localhost" for local
-# dev (HTTP only). The webhook URL is https://<DOMAIN>/webhook.
-
-DOMAIN=localhost
-
-# =================================================================
-# ADMIN DASHBOARD
-# =================================================================
-# ADMIN_SECRET signs session tokens (required for login). ADMIN_PASSWORD enables
-# password login; auth is also satisfied by a configured OAuth provider below.
-
-ADMIN_SECRET=change-me-to-a-random-string
-# ADMIN_PASSWORD=
-
-# =================================================================
-# OPTIONAL: SLACK
-# =================================================================
-# Enables the messaging connector + chat skill (and the chat server).
-# SLACK_BOT_TOKEN=xoxb-...
-# SLACK_APP_TOKEN=xapp-...
-# SLACK_DELIVERY_CHANNEL=          # channel id for cron reports
-# SLACK_ALLOWED_USERS=             # comma-separated user ids
-#
-# "Login with Slack" on the dashboard (OIDC):
-# SLACK_OAUTH_CLIENT_ID=
-# SLACK_OAUTH_CLIENT_SECRET=
-# SLACK_OAUTH_REDIRECT_URI=https://<DOMAIN>/admin/api/auth/slack/callback
-# SLACK_ALLOWED_WORKSPACE=         # restrict login to one team_id / domain
-
-# =================================================================
-# OPTIONAL: WEB SEARCH (explore workflow only)
-# =================================================================
-# Set any one to enable agentic-pi's web_search / web_fetch tools for phases
-# that opt in (Tavily > Exa > Brave). Other workflows ignore these keys.
-# TAVILY_API_KEY=tvly-...
-# EXA_API_KEY=...
-# BRAVE_SEARCH_API_KEY=BSA...
-
-# =================================================================
-# OPTIONAL: RUNTIME
-# =================================================================
-# PORT=8644                        # webhook listener / admin port
-# STATE_DIR=./data                 # persistent state (mounted as a volume)

package/deploy/entrypoint.sh

@@ -1,82 +0,0 @@
-#!/usr/bin/env bash
-# Last Light Docker entrypoint
-# Links secrets, ensures state dirs, then starts the harness.
-set -euo pipefail
-
-# Secrets live in the consolidated deployment folder (instance/secrets). Fall
-# back to the legacy standalone secrets/ mount for pre-migration deployments.
-SECRETS="/app/instance/secrets"
-[ -d "$SECRETS" ] || SECRETS="/app/secrets"
-APP_DIR="/app"
-STATE_DIR="${STATE_DIR:-/app/data}"
-
-# Materialize secrets into the writable /app layer, owned by `lastlight` (mode
-# 600). We COPY rather than symlink: the source lives on a read-only mount owned
-# by whatever uid created it on the host (often 1000), while the harness runs as
-# `lastlight` (uid-pinned 10001) via gosu below. A symlink would leave the
-# unreadable 600 source in place and the harness would EACCES on it. root (this
-# entrypoint, pre-gosu) bypasses the source perms to read+copy; the chown then
-# hands the copy to lastlight. Same pattern as the PEM→state-volume copy below.
-# rm -f first so a stale symlink from an older image isn't written through.
-for f in .env; do
-  if [ -f "$SECRETS/$f" ]; then
-    rm -f "$APP_DIR/$f"
-    cp "$SECRETS/$f" "$APP_DIR/$f"
-    chown lastlight:lastlight "$APP_DIR/$f"
-    chmod 600 "$APP_DIR/$f"
-    echo "Copied $f from secrets volume"
-  fi
-done
-
-# GitHub App private key(s) — same copy+chown so the in-process Octokit (which
-# also runs as lastlight) can read them.
-for pem in "$SECRETS"/*.pem; do
-  if [ -f "$pem" ]; then
-    dest="$APP_DIR/$(basename "$pem")"
-    rm -f "$dest"
-    cp "$pem" "$dest"
-    chown lastlight:lastlight "$dest"
-    chmod 600 "$dest"
-    echo "Copied $(basename "$pem") from secrets volume"
-  fi
-done
-
-# Ensure state directory structure exists and is owned by lastlight.
-# agent-sessions/ is where agentic-pi's event shim writes JSONL envelopes
-# the dashboard reads (path is set by LASTLIGHT_SESSIONS_DIR).
-mkdir -p "$STATE_DIR"/{logs,sandboxes,secrets,agent-sessions}
-chown -R lastlight:lastlight "$STATE_DIR"
-
-# Copy PEM to the data volume so sandbox containers can access it via shared
-# volume (LASTLIGHT_SANDBOX=docker fallback path only — gondolin doesn't go
-# through this). Owner is `lastlight` so the host harness (which exec's via
-# gosu lastlight below) can read it for in-process GitHub API calls.
-# Sandbox-entrypoint runs as root before switching to `agent`, so it can
-# still read this 600 file and materialize an agent-readable copy when
-# ALLOW_APP_PEM=1.
-for pem in "$SECRETS"/*.pem; do
-  if [ -f "$pem" ]; then
-    cp "$pem" "$STATE_DIR/secrets/app.pem"
-    chown lastlight:lastlight "$STATE_DIR/secrets/app.pem"
-    chmod 600 "$STATE_DIR/secrets/app.pem"
-    echo "Copied PEM to data volume for sandbox access"
-    break
-  fi
-done
-
-# Source .env if available
-if [ -f "$APP_DIR/.env" ]; then
-  set -a
-  # shellcheck disable=SC1091
-  source "$APP_DIR/.env"
-  set +a
-fi
-
-# Fix Docker socket permissions — host GID may differ from container docker group
-if [ -S /var/run/docker.sock ]; then
-  chmod 666 /var/run/docker.sock
-fi
-
-echo "Starting Last Light (state: $STATE_DIR)..."
-# Drop to non-root before exec'ing the harness.
-exec gosu lastlight "$@"

package/deploy/native/README.md

@@ -1,160 +0,0 @@
-# Native deploy (systemd + gondolin)
-
-Production deploy for `lastlight` as a systemd service on a KVM-capable
-Linux host. Replaces the Docker compose deploy; the Dockerfiles in the
-repo root are kept only for local prod-like smoke testing.
-
-## Why native
-
-`agentic-pi`'s gondolin sandbox needs `/dev/kvm`. Running lastlight inside
-a container loses or complicates KVM access (Docker-in-Docker, nested
-virt, capability juggling). On a bare-metal Linux box you get
-near-native VM performance with no extra moving parts.
-
-See `agentic-pi/SPIKE-gondolin.md` for the full analysis.
-
-## First-time install
-
-On the prod host as root:
-
-```bash
-# 1. Clone the repo to the canonical path.
-git clone https://github.com/nearform/lastlight.git /opt/lastlight
-cd /opt/lastlight
-
-# 2. (Optional) Drop the GitHub App PEM in place before the install runs,
-#    so install.sh locks it down. Otherwise place it later and re-run.
-install -m 0600 -o root /path/to/your-app.pem /etc/lastlight/app.pem
-
-# 3. Provision system + install systemd unit.
-sudo bash deploy/native/install.sh
-
-# 4. install.sh scaffolds /etc/lastlight/lastlight.env from the example
-#    and refuses to (re)start the service while any CHANGE_ME placeholder
-#    remains. Edit it:
-sudo $EDITOR /etc/lastlight/lastlight.env
-
-# 5. Re-run install.sh to start the service.
-sudo bash deploy/native/install.sh
-```
-
-## Re-deploying a code change
-
-```bash
-cd /opt/lastlight
-sudo -u lastlight git pull
-sudo bash deploy/native/install.sh   # rebuilds + restarts the service
-```
-
-The existing `/home/lastlight/deploy.sh` on the prod host should be
-replaced with the two lines above (or wrap them in a script).
-
-## What's where
-
-| Path | Purpose |
-| --- | --- |
-| `/opt/lastlight` | Source checkout. `node dist/index.js` runs from here. |
-| `/etc/lastlight/lastlight.env` | systemd EnvironmentFile (mode 0640). Holds all secrets. |
-| `/etc/lastlight/app.pem` | GitHub App private key (mode 0640). Optional but typical. |
-| `/var/lib/lastlight/` | Persistent state — SQLite DB, session JSONLs, gondolin image cache. |
-| `/var/lib/lastlight/lastlight.db` | Workflow runs, executions, messaging sessions. |
-| `/var/lib/lastlight/agent-sessions/` | Dashboard's JSONL envelope store. |
-| `/var/lib/lastlight/.cache/agentic-pi/images/` | Downloaded gondolin guest images (~89 MB each). |
-| `/var/log/lastlight/` | LogsDirectory if anything writes to it. |
-| `/etc/systemd/system/lastlight.service` | The unit file (installed by install.sh from `deploy/native/lastlight.service`). |
-
-## Operations
-
-```bash
-# Status / logs
-systemctl status lastlight
-journalctl -u lastlight -f                    # live tail
-journalctl -u lastlight --since '10 min ago'  # recent
-
-# Restart (e.g. after an env edit that doesn't need a rebuild)
-sudo systemctl restart lastlight
-
-# Stop / disable
-sudo systemctl stop lastlight
-sudo systemctl disable lastlight
-```
-
-## TLS / reverse proxy
-
-The harness binds `127.0.0.1:8644` by default (PORT in the env file).
-Front it with Caddy or nginx for TLS.
-
-Minimal Caddy setup:
-
-```bash
-sudo apt-get install -y caddy
-sudo tee /etc/caddy/Caddyfile <<'EOF'
-your-domain.example.com {
-  reverse_proxy 127.0.0.1:8644
-}
-EOF
-sudo systemctl reload caddy
-```
-
-## Migrating from the Docker compose deploy
-
-On the old (Docker compose) box:
-
-```bash
-# Snapshot the persistent volume.
-docker run --rm -v lastlight_agent-data:/data -v /tmp:/backup busybox \
-  tar czf /backup/lastlight-data.tgz -C /data .
-scp /tmp/lastlight-data.tgz root@new-host:/tmp/
-docker compose down
-```
-
-On the new (native) host, after running install.sh and editing the env file:
-
-```bash
-sudo systemctl stop lastlight
-sudo tar xzf /tmp/lastlight-data.tgz -C /var/lib/lastlight \
-  lastlight.db lastlight.db-shm lastlight.db-wal \
-  agent-sessions secrets || true
-# The old volume used these directory names that the new code doesn't read.
-# Safe to skip restoring them: opencode-home/, opencode-serve/, sandboxes/,
-# sandbox-data/, sessions/, claude-home/.
-sudo chown -R lastlight:lastlight /var/lib/lastlight
-sudo systemctl start lastlight
-```
-
-The DB schema is unchanged across the migration, so workflow_runs +
-executions history carry over.
-
-## Rollback
-
-If the new service doesn't come up cleanly:
-
-```bash
-sudo systemctl stop lastlight
-sudo systemctl disable lastlight
-# Restore the docker stack on the same host (or fail over to the old host)
-docker compose up -d
-```
-
-State at `/var/lib/lastlight/` and the docker `agent-data` volume are
-independent — neither rollback step touches the other.
-
-## Verification
-
-After the service is up:
-
-```bash
-# 1. It started cleanly.
-systemctl status lastlight   # → active (running)
-
-# 2. KVM is reachable from the service's user context.
-sudo -u lastlight ls -l /dev/kvm
-
-# 3. The harness is listening.
-curl -sS http://127.0.0.1:8644/admin/  | head -5
-
-# 4. (Optional) Trigger a real workflow via a PR comment and watch:
-journalctl -u lastlight -f
-# Then look in the dashboard for the executions row + a JSONL under
-# /var/lib/lastlight/agent-sessions/projects/<slug>/
-```

package/deploy/native/install.sh

@@ -1,110 +0,0 @@
-#!/usr/bin/env bash
-# Idempotent provision + (re)deploy of lastlight as a systemd service on a
-# KVM-capable Linux host. Run as root from the repo root:
-#
-#     sudo bash deploy/native/install.sh
-#
-# On first run: installs system deps, creates the lastlight user, scaffolds
-# /etc/lastlight/lastlight.env from the example, installs and starts the
-# systemd unit. On subsequent runs: re-installs the deps that changed,
-# rebuilds, restarts the service.
-
-set -euo pipefail
-
-REPO_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
-SERVICE_NAME=lastlight
-LASTLIGHT_USER=lastlight
-LASTLIGHT_HOME=/var/lib/lastlight
-ENV_DIR=/etc/lastlight
-ENV_FILE="${ENV_DIR}/lastlight.env"
-PEM_FILE="${ENV_DIR}/app.pem"
-
-if [ "$(id -u)" -ne 0 ]; then
-  echo "install.sh must run as root (try: sudo $0)" >&2
-  exit 1
-fi
-
-# ── 1. KVM check — gondolin silently hangs without it ──────────────────────
-if [ ! -e /dev/kvm ]; then
-  echo "ERROR: /dev/kvm not present on this host." >&2
-  echo "  gondolin (lastlight's default sandbox) requires KVM. The host must" >&2
-  echo "  be bare-metal Linux or a VM with nested virtualization enabled." >&2
-  echo "  See agentic-pi/SPIKE-gondolin.md for the full constraint." >&2
-  exit 1
-fi
-
-# ── 2. System dependencies (Debian/Ubuntu) ─────────────────────────────────
-export DEBIAN_FRONTEND=noninteractive
-apt-get update
-apt-get install -y --no-install-recommends \
-  curl ca-certificates git \
-  qemu-system-x86 qemu-utils \
-  python3 build-essential
-# Use NodeSource for a current Node 22 LTS (Debian's nodejs is too old).
-if ! command -v node >/dev/null 2>&1 || ! node -e 'process.exit(process.versions.node.split(".")[0] >= 20 ? 0 : 1)'; then
-  curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
-  apt-get install -y --no-install-recommends nodejs
-fi
-
-# ── 3. User + group ────────────────────────────────────────────────────────
-if ! id "$LASTLIGHT_USER" >/dev/null 2>&1; then
-  useradd --system --create-home --home-dir "$LASTLIGHT_HOME" \
-    --shell /usr/sbin/nologin "$LASTLIGHT_USER"
-fi
-# `kvm` group exists once qemu is installed; gate the membership add to
-# avoid a usermod warning on hosts where it doesn't.
-if getent group kvm >/dev/null 2>&1; then
-  usermod -aG kvm "$LASTLIGHT_USER"
-fi
-
-# ── 4. Repo install + build (as the lastlight user) ────────────────────────
-chown -R "$LASTLIGHT_USER:$LASTLIGHT_USER" "$REPO_DIR"
-sudo -u "$LASTLIGHT_USER" -H bash -c "cd '$REPO_DIR' && npm ci --no-audit --no-fund"
-sudo -u "$LASTLIGHT_USER" -H bash -c "cd '$REPO_DIR' && npm run build && npm run build:dashboard"
-# Prune dev deps to shrink the on-disk footprint of the deployed checkout.
-sudo -u "$LASTLIGHT_USER" -H bash -c "cd '$REPO_DIR' && npm prune --omit=dev"
-
-# ── 5. Env file scaffold (don't overwrite an existing config) ──────────────
-mkdir -p "$ENV_DIR"
-chmod 0750 "$ENV_DIR"
-chgrp "$LASTLIGHT_USER" "$ENV_DIR"
-if [ ! -f "$ENV_FILE" ]; then
-  install -m 0640 -o root -g "$LASTLIGHT_USER" \
-    "$REPO_DIR/deploy/native/lastlight.env.example" "$ENV_FILE"
-  echo "" >&2
-  echo "  NOTE: $ENV_FILE was just created from the example template." >&2
-  echo "  Edit it to fill in your GitHub App, model API keys, Slack tokens, etc." >&2
-  echo "  Then re-run this script to start the service." >&2
-  echo "" >&2
-fi
-
-# ── 6. App PEM — referenced by GITHUB_APP_PRIVATE_KEY_PATH in the env file ─
-# If you placed the PEM at /etc/lastlight/app.pem before running install.sh,
-# this section locks down its permissions; otherwise it's a no-op.
-if [ -f "$PEM_FILE" ]; then
-  chown root:"$LASTLIGHT_USER" "$PEM_FILE"
-  chmod 0640 "$PEM_FILE"
-fi
-
-# ── 7. systemd unit ────────────────────────────────────────────────────────
-install -m 0644 \
-  "$REPO_DIR/deploy/native/lastlight.service" \
-  "/etc/systemd/system/${SERVICE_NAME}.service"
-systemctl daemon-reload
-
-# ── 8. Enable + start ──────────────────────────────────────────────────────
-systemctl enable "${SERVICE_NAME}"
-# Only start/restart if the env file looks configured (the example has the
-# string CHANGE_ME everywhere a value is required).
-if grep -q '^[A-Z].*=CHANGE_ME' "$ENV_FILE"; then
-  echo "  $ENV_FILE still has CHANGE_ME placeholders — not (re)starting the service." >&2
-  echo "  Fill in the values and re-run install.sh." >&2
-  exit 0
-fi
-systemctl restart "${SERVICE_NAME}"
-
-# Brief status read-out so the operator sees if it started cleanly.
-sleep 2
-systemctl status "${SERVICE_NAME}" --no-pager -l | head -20 || true
-echo ""
-echo "  Live logs:  journalctl -u ${SERVICE_NAME} -f"

package/deploy/native/lastlight.env.example

@@ -1,95 +0,0 @@
-# ── Last Light — Native deploy env (systemd EnvironmentFile) ────────────
-# Path on the host: /etc/lastlight/lastlight.env
-# Mode 0640, owned by root:lastlight.
-#
-# Anything marked CHANGE_ME must be replaced before the service will start
-# (install.sh refuses to start the unit while placeholders are present).
-
-# ── GitHub App (required) ─────────────────────────────────────────────────
-GITHUB_APP_ID=CHANGE_ME
-GITHUB_APP_INSTALLATION_ID=CHANGE_ME
-# PEM is read by the harness at boot. install.sh locks down permissions if
-# you place it at /etc/lastlight/app.pem before running.
-GITHUB_APP_PRIVATE_KEY_PATH=/etc/lastlight/app.pem
-
-# Webhook receiver
-WEBHOOK_SECRET=CHANGE_ME
-# Listener port — Caddy/Nginx should reverse-proxy 443 → 127.0.0.1:PORT.
-PORT=8644
-
-# ── Model + provider API key ─────────────────────────────────────────────
-# pi-ai supports anthropic/…, openai/…, openrouter/<vendor>/<model>.
-LASTLIGHT_MODEL=anthropic/claude-sonnet-4-6
-# Set whichever matches LASTLIGHT_MODEL (or several if LASTLIGHT_MODELS
-# routes different phases to different providers).
-ANTHROPIC_API_KEY=CHANGE_ME
-# OPENAI_API_KEY=
-# OPENROUTER_API_KEY=
-
-# ── OpenTelemetry (optional, disabled by default) ────────────────────────
-# LASTLIGHT_OTEL_ENABLED=false
-# LASTLIGHT_OTEL_SERVICE_NAME=lastlight
-# LASTLIGHT_OTEL_INCLUDE_CONTENT=false
-# LASTLIGHT_OTEL_FORWARD_TO_SANDBOX=true
-# LASTLIGHT_OTEL_STRICT=false
-# OTEL_EXPORTER_OTLP_ENDPOINT=https://CHANGE_ME
-# OTEL_EXPORTER_OTLP_HEADERS=authorization=Bearer CHANGE_ME
-# docker backend routes sandbox telemetry through an in-network otel-collector
-# (re-exports to the endpoint above; headers stay host-side, any port works).
-# LASTLIGHT_OTEL_COLLECTOR_HOSTS is only used by the gondolin egress allowlist.
-# LASTLIGHT_OTEL_COLLECTOR_HOSTS=CHANGE_ME
-
-# Per-task model overrides (optional). JSON keyed by phase/skill name.
-# LASTLIGHT_MODELS={"architect":"openai/gpt-5.5","triage":"anthropic/claude-haiku-4-5-20251001"}
-
-# ── Web search (optional, explore workflow only) ─────────────────────────
-# Set any one to enable agentic-pi's `web_search` / `web_fetch` tools for
-# the explore workflow. Provider auto-detected from whichever key is set
-# (Tavily > Exa > Brave). Other workflows ignore these keys.
-# TAVILY_API_KEY=tvly-...
-# BRAVE_SEARCH_API_KEY=BSA...
-# EXA_API_KEY=...
-
-# Reasoning-effort default + per-task overrides (optional).
-# Values: off | minimal | low | medium | high | xhigh
-# LASTLIGHT_THINKING=medium
-# LASTLIGHT_THINKINGS={"architect":"high","reviewer":"high"}
-
-# ── Sandbox backend ───────────────────────────────────────────────────────
-# gondolin = agentic-pi's QEMU micro-VM (default, requires /dev/kvm).
-# docker   = sibling docker containers (requires docker socket access).
-# none     = unsandboxed in-process (dev only — agent reads/writes host fs).
-LASTLIGHT_SANDBOX=gondolin
-
-# ── State paths ───────────────────────────────────────────────────────────
-# systemd's StateDirectory= grants /var/lib/lastlight with the right mode.
-STATE_DIR=/var/lib/lastlight
-DB_PATH=/var/lib/lastlight/lastlight.db
-LASTLIGHT_SESSIONS_DIR=/var/lib/lastlight/agent-sessions
-
-# ── Admin dashboard ───────────────────────────────────────────────────────
-# HMAC secret for session tokens. Generate with: openssl rand -hex 32
-ADMIN_SECRET=CHANGE_ME
-# Optional: require a password for the dashboard. Leave unset to allow
-# anyone who can reach the listener (i.e. anyone past Caddy).
-# ADMIN_PASSWORD=
-
-# ── Slack (optional) ──────────────────────────────────────────────────────
-# Setting SLACK_BOT_TOKEN enables the chat skill and the Slack connector.
-# SLACK_BOT_TOKEN=xoxb-…
-# SLACK_APP_TOKEN=xapp-…
-# SLACK_DELIVERY_CHANNEL=C0123456789
-# SLACK_ALLOWED_USERS=U0123,U0456
-
-# Slack OAuth for dashboard login (optional)
-# SLACK_OAUTH_CLIENT_ID=
-# SLACK_OAUTH_CLIENT_SECRET=
-# SLACK_OAUTH_REDIRECT_URI=https://your-domain/admin/auth/slack/callback
-# SLACK_ALLOWED_WORKSPACE=
-
-# ── Approval gates (optional) ─────────────────────────────────────────────
-# Comma-separated list of gate names that should pause the runner.
-# APPROVAL_GATES=post_architect,post_reviewer
-
-# ── Bootstrap label (optional) ────────────────────────────────────────────
-# BOOTSTRAP_LABEL=lastlight:bootstrap

package/deploy/native/lastlight.service

@@ -1,50 +0,0 @@
-[Unit]
-Description=Last Light — GitHub repository maintenance agent
-Documentation=https://github.com/nearform/lastlight
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=lastlight
-Group=lastlight
-# gondolin needs /dev/kvm — group `kvm` is the standard accessor on Debian/Ubuntu.
-SupplementaryGroups=kvm
-
-WorkingDirectory=/opt/lastlight
-ExecStart=/usr/bin/node /opt/lastlight/dist/index.js
-EnvironmentFile=/etc/lastlight/lastlight.env
-
-# HOME drives where agentic-pi caches the gondolin guest image
-# (~/.cache/agentic-pi/images/). Pin it to the StateDirectory so the cache
-# survives redeploys and isn't recomputed on every restart.
-Environment=HOME=/var/lib/lastlight
-Environment=NODE_ENV=production
-
-Restart=on-failure
-RestartSec=5s
-LimitNOFILE=65536
-# 2 GB matches the docker-compose limit. Bursts during webhook fan-out +
-# in-process pi-ai chat; per-task gondolin VMs have their own memory budget.
-MemoryMax=2G
-
-# /var/lib/lastlight created with mode 0750, owned by lastlight:lastlight
-StateDirectory=lastlight
-StateDirectoryMode=0750
-LogsDirectory=lastlight
-LogsDirectoryMode=0750
-
-# Security hardening — the harness only writes to its state dir and logs.
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectControlGroups=true
-ReadWritePaths=/var/lib/lastlight /var/log/lastlight
-# Explicit /dev/kvm rule — ProtectSystem=strict alone doesn't gate /dev.
-DeviceAllow=/dev/kvm rw
-
-[Install]
-WantedBy=multi-user.target