thepopebot 1.2.75-beta.2 → 1.2.75-beta.4

package/setup/setup-ssl.mjs

@@ -0,0 +1,407 @@
+#!/usr/bin/env node
+
+/**
+ * Interactive SSL setup — configures Let's Encrypt wildcard cert via Traefik DNS challenge.
+ *
+ * Prompts for domain, DNS provider, API credentials, and server address.
+ * Creates the wildcard DNS record via the provider's API.
+ * Writes all config to .env and switches COMPOSE_FILE to docker-compose.custom.yml.
+ */
+
+import * as clack from '@clack/prompts';
+import { updateEnvVariable } from './lib/auth.mjs';
+import { loadEnvFile } from './lib/env.mjs';
+
+function handleCancel(value) {
+  if (clack.isCancel(value)) {
+    clack.cancel('Setup cancelled.');
+    process.exit(0);
+  }
+  return value;
+}
+
+// DNS providers supported by Traefik's ACME DNS challenge (via lego).
+// Each entry maps to the Traefik provider name and the env vars it expects.
+const DNS_PROVIDERS = {
+  cloudflare: {
+    label: 'Cloudflare',
+    traefikName: 'cloudflare',
+    envVars: [
+      { key: 'CF_DNS_API_TOKEN', label: 'Cloudflare API Token', secret: true },
+    ],
+    apiCreate: createCloudflareRecord,
+    helpUrl: 'https://dash.cloudflare.com/profile/api-tokens',
+    helpSteps: [
+      'Go to your Cloudflare dashboard → Profile → API Tokens',
+      'Click "Create Token"',
+      'Use the "Edit zone DNS" template',
+      'Select the zone (domain) you want to use',
+      'Copy the token',
+    ],
+  },
+  route53: {
+    label: 'AWS Route 53',
+    traefikName: 'route53',
+    envVars: [
+      { key: 'AWS_ACCESS_KEY_ID', label: 'AWS Access Key ID', secret: false },
+      { key: 'AWS_SECRET_ACCESS_KEY', label: 'AWS Secret Access Key', secret: true },
+      { key: 'AWS_REGION', label: 'AWS Region', secret: false, default: 'us-east-1' },
+    ],
+    apiCreate: null, // TODO: implement
+    helpUrl: 'https://console.aws.amazon.com/iam/',
+    helpSteps: [
+      'Create an IAM user with Route53 permissions',
+      'Generate access keys for the user',
+    ],
+  },
+  digitalocean: {
+    label: 'DigitalOcean',
+    traefikName: 'digitalocean',
+    envVars: [
+      { key: 'DO_AUTH_TOKEN', label: 'DigitalOcean API Token', secret: true },
+    ],
+    apiCreate: null, // TODO: implement
+    helpUrl: 'https://cloud.digitalocean.com/account/api/tokens',
+    helpSteps: [
+      'Go to DigitalOcean → API → Tokens',
+      'Generate a new personal access token with read/write scope',
+    ],
+  },
+  namecheap: {
+    label: 'Namecheap',
+    traefikName: 'namecheap',
+    envVars: [
+      { key: 'NAMECHEAP_API_USER', label: 'Namecheap API User', secret: false },
+      { key: 'NAMECHEAP_API_KEY', label: 'Namecheap API Key', secret: true },
+    ],
+    apiCreate: null, // TODO: implement
+    helpUrl: 'https://www.namecheap.com/support/api/intro/',
+    helpSteps: [
+      'Enable API access in your Namecheap account',
+      'Whitelist your server IP',
+      'Copy your API key',
+    ],
+  },
+  godaddy: {
+    label: 'GoDaddy',
+    traefikName: 'godaddy',
+    envVars: [
+      { key: 'GODADDY_API_KEY', label: 'GoDaddy API Key', secret: true },
+      { key: 'GODADDY_API_SECRET', label: 'GoDaddy API Secret', secret: true },
+    ],
+    apiCreate: null, // TODO: implement
+    helpUrl: 'https://developer.godaddy.com/keys',
+    helpSteps: [
+      'Go to GoDaddy Developer Portal → API Keys',
+      'Create a Production key',
+    ],
+  },
+  porkbun: {
+    label: 'Porkbun',
+    traefikName: 'porkbun',
+    envVars: [
+      { key: 'PORKBUN_API_KEY', label: 'Porkbun API Key', secret: true },
+      { key: 'PORKBUN_SECRET_API_KEY', label: 'Porkbun Secret Key', secret: true },
+    ],
+    apiCreate: null, // TODO: implement
+    helpUrl: 'https://porkbun.com/account/api',
+    helpSteps: [
+      'Go to Porkbun → Account → API Access',
+      'Create an API key pair',
+    ],
+  },
+};
+
+async function main() {
+  clack.intro('SSL Setup — Let\'s Encrypt wildcard cert');
+
+  const env = loadEnvFile() || {};
+
+  // ── Domain ──────────────────────────────────────────────────────────
+  const existingDomain = env.SSL_DOMAIN;
+  let domain;
+
+  if (existingDomain) {
+    clack.log.info(`Current domain: ${existingDomain}`);
+    const reconfig = handleCancel(await clack.confirm({
+      message: 'Change domain?',
+      initialValue: false,
+    }));
+    domain = reconfig ? null : existingDomain;
+  }
+
+  if (!domain) {
+    domain = handleCancel(await clack.text({
+      message: 'Enter your domain (e.g., bot.example.com):',
+      placeholder: 'bot.example.com',
+      validate: (input) => {
+        if (!input) return 'Domain is required';
+        if (!input.includes('.')) return 'Enter a valid domain';
+        if (input.startsWith('*.')) return 'Enter the base domain without the wildcard (e.g., bot.example.com)';
+      },
+    }));
+  }
+
+  // ── Email ───────────────────────────────────────────────────────────
+  const existingEmail = env.SSL_EMAIL;
+  let email;
+
+  if (existingEmail) {
+    clack.log.info(`Current email: ${existingEmail}`);
+    const reconfig = handleCancel(await clack.confirm({
+      message: 'Change email?',
+      initialValue: false,
+    }));
+    email = reconfig ? null : existingEmail;
+  }
+
+  if (!email) {
+    email = handleCancel(await clack.text({
+      message: 'Email for Let\'s Encrypt notifications:',
+      validate: (input) => {
+        if (!input) return 'Email is required';
+        if (!input.includes('@')) return 'Enter a valid email';
+      },
+    }));
+  }
+
+  // ── DNS Provider ────────────────────────────────────────────────────
+  const providerKey = handleCancel(await clack.select({
+    message: 'Who manages your DNS?',
+    options: Object.entries(DNS_PROVIDERS).map(([key, p]) => ({
+      label: p.label,
+      value: key,
+    })),
+  }));
+
+  const provider = DNS_PROVIDERS[providerKey];
+
+  // Show help steps for getting the API credentials
+  clack.log.info(
+    `To get your ${provider.label} API credentials:\n` +
+    provider.helpSteps.map((s, i) => `  ${i + 1}. ${s}`).join('\n') +
+    `\n\n  ${provider.helpUrl}`
+  );
+
+  // ── API Credentials ─────────────────────────────────────────────────
+  const credentials = {};
+  for (const envVar of provider.envVars) {
+    const existing = env[envVar.key];
+    if (existing) {
+      const masked = '****' + existing.slice(-4);
+      clack.log.info(`${envVar.label}: ${masked}`);
+      const reconfig = handleCancel(await clack.confirm({
+        message: `Change ${envVar.label}?`,
+        initialValue: false,
+      }));
+      if (!reconfig) {
+        credentials[envVar.key] = existing;
+        continue;
+      }
+    }
+
+    if (envVar.secret) {
+      credentials[envVar.key] = handleCancel(await clack.password({
+        message: `${envVar.label}:`,
+        validate: (input) => {
+          if (!input && !envVar.default) return `${envVar.label} is required`;
+        },
+      }));
+    } else {
+      credentials[envVar.key] = handleCancel(await clack.text({
+        message: `${envVar.label}:`,
+        defaultValue: envVar.default || '',
+        placeholder: envVar.default || '',
+        validate: (input) => {
+          if (!input && !envVar.default) return `${envVar.label} is required`;
+        },
+      }));
+    }
+    credentials[envVar.key] = credentials[envVar.key] || envVar.default;
+  }
+
+  // ── DNS Record Target ──────────────────────────────────────────────
+  const targetType = handleCancel(await clack.select({
+    message: `How should *.${domain} resolve?`,
+    options: [
+      { label: 'IP address (VPS, bare metal, cloud VM)', value: 'A' },
+      { label: 'CNAME (Tailscale hostname, another domain)', value: 'CNAME' },
+    ],
+  }));
+
+  let recordValue;
+  if (targetType === 'A') {
+    // Try to detect public IP
+    let detectedIp;
+    try {
+      const resp = await fetch('https://api.ipify.org');
+      if (resp.ok) detectedIp = (await resp.text()).trim();
+    } catch {}
+
+    recordValue = handleCancel(await clack.text({
+      message: 'Server IP address:',
+      defaultValue: detectedIp || '',
+      placeholder: detectedIp || '203.0.113.10',
+      validate: (input) => {
+        if (!input) return 'IP address is required';
+        if (!/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(input)) return 'Enter a valid IPv4 address';
+      },
+    }));
+  } else {
+    recordValue = handleCancel(await clack.text({
+      message: 'CNAME target (e.g., mybox.tailnet.ts.net):',
+      validate: (input) => {
+        if (!input) return 'CNAME target is required';
+        if (!input.includes('.')) return 'Enter a valid hostname';
+      },
+    }));
+  }
+
+  // ── Create DNS Record ──────────────────────────────────────────────
+  const s = clack.spinner();
+
+  if (provider.apiCreate) {
+    s.start(`Creating *.${domain} ${targetType} record → ${recordValue}`);
+    try {
+      await provider.apiCreate(domain, targetType, recordValue, credentials);
+      s.stop(`Created *.${domain} → ${recordValue}`);
+    } catch (err) {
+      s.stop(`Failed to create DNS record: ${err.message}`);
+      clack.log.warn(
+        `Create this record manually in your ${provider.label} dashboard:\n` +
+        `  Type: ${targetType}\n` +
+        `  Name: *.${domain}\n` +
+        `  Value: ${recordValue}`
+      );
+      const proceed = handleCancel(await clack.confirm({
+        message: 'Continue anyway? (you can create the record manually)',
+        initialValue: true,
+      }));
+      if (!proceed) process.exit(0);
+    }
+  } else {
+    clack.log.warn(
+      `Automatic DNS record creation is not yet supported for ${provider.label}.\n` +
+      `  Create this record in your ${provider.label} dashboard:\n\n` +
+      `  Type: ${targetType}\n` +
+      `  Name: *.${domain}\n` +
+      `  Value: ${recordValue}\n`
+    );
+    handleCancel(await clack.text({
+      message: 'Press enter once you\'ve created the record',
+      defaultValue: '',
+    }));
+  }
+
+  // ── Write .env ─────────────────────────────────────────────────────
+  s.start('Writing configuration to .env');
+
+  updateEnvVariable('SSL_DOMAIN', domain);
+  updateEnvVariable('SSL_EMAIL', email);
+  updateEnvVariable('SSL_DNS_PROVIDER', provider.traefikName);
+  updateEnvVariable('APP_HOSTNAME', domain);
+
+  // Write provider-specific credentials (standard names — Traefik reads them directly)
+  for (const envVar of provider.envVars) {
+    updateEnvVariable(envVar.key, credentials[envVar.key]);
+  }
+
+  // Switch to custom compose file
+  updateEnvVariable('COMPOSE_FILE', 'docker-compose.custom.yml');
+
+  s.stop('Configuration saved to .env');
+
+  // ── Summary ────────────────────────────────────────────────────────
+  clack.log.success(
+    `SSL configured!\n\n` +
+    `  Domain:    ${domain}\n` +
+    `  Wildcard:  *.${domain}\n` +
+    `  Provider:  ${provider.label}\n` +
+    `  Compose:   docker-compose.custom.yml\n\n` +
+    `  Traefik will automatically obtain and renew your wildcard cert.\n\n` +
+    `  Next: restart your containers with \`docker compose up -d\``
+  );
+
+  clack.outro('Done!');
+}
+
+// ── Cloudflare API ─────────────────────────────────────────────────────
+
+async function createCloudflareRecord(domain, type, value, credentials) {
+  const token = credentials.CF_DNS_API_TOKEN;
+
+  // Find the zone — walk up the domain to find the registered zone.
+  // e.g., for "bot.example.com", the zone is "example.com"
+  const parts = domain.split('.');
+  let zoneId;
+  let zoneName;
+
+  for (let i = 0; i < parts.length - 1; i++) {
+    const candidate = parts.slice(i).join('.');
+    const resp = await fetch(`https://api.cloudflare.com/client/v4/zones?name=${candidate}`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    const data = await resp.json();
+    if (data.result?.length > 0) {
+      zoneId = data.result[0].id;
+      zoneName = data.result[0].name;
+      break;
+    }
+  }
+
+  if (!zoneId) {
+    throw new Error(`Could not find a Cloudflare zone for ${domain}. Make sure your domain is added to Cloudflare.`);
+  }
+
+  // Create the wildcard record: *.domain → value
+  const recordName = `*.${domain}`;
+
+  // Check if record already exists
+  const existingResp = await fetch(
+    `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records?type=${type}&name=${recordName}`,
+    { headers: { Authorization: `Bearer ${token}` } }
+  );
+  const existing = await existingResp.json();
+
+  if (existing.result?.length > 0) {
+    // Update existing record
+    const recordId = existing.result[0].id;
+    const updateResp = await fetch(
+      `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records/${recordId}`,
+      {
+        method: 'PUT',
+        headers: {
+          Authorization: `Bearer ${token}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ type, name: recordName, content: value, proxied: false }),
+      }
+    );
+    const updateData = await updateResp.json();
+    if (!updateData.success) {
+      throw new Error(updateData.errors?.[0]?.message || 'Failed to update DNS record');
+    }
+  } else {
+    // Create new record
+    const createResp = await fetch(
+      `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records`,
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${token}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ type, name: recordName, content: value, proxied: false }),
+      }
+    );
+    const createData = await createResp.json();
+    if (!createData.success) {
+      throw new Error(createData.errors?.[0]?.message || 'Failed to create DNS record');
+    }
+  }
+}
+
+main().catch((err) => {
+  clack.log.error(err.message);
+  process.exit(1);
+});

package/templates/CLAUDE.md.template

@@ -36,8 +36,7 @@ project-root/
 │
 ├── .github/workflows/                 # GitHub Actions
 ├── docker-compose.yml                 # Docker Compose config (MANAGED)
-├── docker-compose.custom.yml          # User-owned compose overrides (not managed)
-├── traefik-dynamic.yml.example        # Traefik TLS config template (not managed)
+├── docker-compose.custom.yml          # SSL compose with Let's Encrypt (not managed)
 ├── skills/                            # All available agent skills
 │   └── active/                        # Symlinks to active skills (shared by Pi + Claude Code)
 ├── .pi/skills → skills/active         # Pi reads skills from here
@@ -343,7 +342,7 @@ Synced during setup for GitHub Actions workflows. The event handler reads creden
 
 The following paths are auto-synced by `thepopebot init` and `thepopebot upgrade`. **Do not edit them** — changes will be overwritten on package updates: `.github/workflows/`, `docker-compose.yml`, `.dockerignore`, `.gitignore`, `CLAUDE.md`, `config/CLAUDE.md`, `skills/CLAUDE.md`, `cron/CLAUDE.md`, `triggers/CLAUDE.md`, `docs/CLAUDE.md`.
 
-To customize Docker Compose config without losing changes on upgrade, set `COMPOSE_FILE=docker-compose.custom.yml` in `.env`. The custom file is scaffolded by init but never overwritten.
+To enable SSL with Let's Encrypt wildcard cert, run `npx thepopebot setup-ssl`. This configures `docker-compose.custom.yml` (not managed, never overwritten).
 
 The Next.js app and `.next` build output are baked into the Docker image — they do not exist in user projects.
 
@@ -351,7 +350,7 @@ The Next.js app and `.next` build output are baked into the Docker image — the
 
 User-editable config files in `config/`: `agent-chat/SYSTEM.md` (agent chat system prompt), `code-chat/SYSTEM.md` (code workspace planning), `agent-job/SOUL.md` (personality), `agent-job/AGENT_JOB.md` (runtime docs), `agent-job/SUMMARY.md` (job summaries), `cluster/SYSTEM.md` (cluster system prompt), `cluster/ROLE.md` (cluster role prompt), `HEARTBEAT.md` (self-monitoring), `CRONS.json` (scheduled jobs), `TRIGGERS.json` (webhook triggers).
 
-To customize Docker Compose (TLS, ports, volumes, extra services), edit `docker-compose.custom.yml` and set `COMPOSE_FILE=docker-compose.custom.yml` in `.env`. For Tailscale TLS, copy `traefik-dynamic.yml.example` to `traefik-dynamic.yml` and follow the instructions inside.
+To enable SSL, run `npx thepopebot setup-ssl` — it configures Let's Encrypt wildcard cert via DNS challenge, sets up your domain, and switches to `docker-compose.custom.yml`. For additional Docker Compose customization (extra services, volumes, ports), edit `docker-compose.custom.yml` directly.
 
 Skills in `skills/` are activated by symlinking into `skills/active/`. Both `.pi/skills` and `.claude/skills` point to `skills/active/`. Scripts for command-type actions go in `cron/` and `triggers/`.
 

package/templates/README.md

@@ -30,7 +30,7 @@ An autonomous AI agent powered by [thepopebot](https://github.com/stephengpope/t
 | `config/agent-job/AGENT_JOB.md` | Agent runtime environment docs |
 | `config/CRONS.json` | Scheduled job definitions |
 | `config/TRIGGERS.json` | Webhook trigger definitions |
-| `.env` | API keys, tokens, and settings |
+| `.env` | Infrastructure settings (APP_URL, GH_OWNER, etc.) |
 
 See [docs/CONFIGURATION.md](docs/CONFIGURATION.md) for the complete list.
 

package/templates/docker-compose.custom.yml

@@ -1,7 +1,17 @@
-# Custom Docker Compose configuration
+# Custom Docker Compose — SSL with Let's Encrypt wildcard cert
 # This file is NOT managed by thepopebot and won't be overwritten on upgrade.
-# To activate: set COMPOSE_FILE=docker-compose.custom.yml in .env
-# Make your customizations here (TLS, ports, volumes, extra services, etc.)
+#
+# Activate: set COMPOSE_FILE=docker-compose.custom.yml in .env
+# Setup:    npx thepopebot setup-ssl
+#
+# Requires these .env vars (set by setup-ssl):
+#   SSL_DOMAIN          — your domain (e.g., bot.example.com)
+#   SSL_EMAIL           — email for Let's Encrypt notifications
+#   SSL_DNS_PROVIDER    — Traefik DNS provider name (e.g., cloudflare)
+#   Provider API creds  — standard env var names (e.g., CF_DNS_API_TOKEN for Cloudflare)
+#
+# DNS: *.${SSL_DOMAIN} must resolve to this server (A record or CNAME).
+# The setup-ssl command can create this record for you.
 
 services:
   traefik:
@@ -9,20 +19,22 @@ services:
     command:
       - --providers.docker=true
       - --providers.docker.exposedByDefault=false
+      - --providers.file.directory=/traefik-config/
       - --entrypoints.web.address=:80
       - --entrypoints.websecure.address=:443
-      ## Uncomment the following lines to enable TLS via Let's Encrypt
-      ## (requires LETSENCRYPT_EMAIL in .env):
-      # - --entrypoints.web.http.redirections.entrypoint.to=websecure
-      # - --entrypoints.web.http.redirections.entrypoint.scheme=https
-      # - --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}
-      # - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
-      # - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
+      - --entrypoints.web.http.redirections.entrypoint.to=websecure
+      - --entrypoints.web.http.redirections.entrypoint.scheme=https
+      - --certificatesresolvers.letsencrypt.acme.email=${SSL_EMAIL}
+      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
+      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=${SSL_DNS_PROVIDER}
+      - --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=8.8.8.8:53,8.8.4.4:53
+    env_file: .env
     ports:
       - "80:80"
       - "443:443"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./traefik-config:/traefik-config:ro
       - traefik_certs:/letsencrypt
     restart: unless-stopped
 
@@ -39,16 +51,16 @@ services:
       - ./cron:/app/cron
       - ./triggers:/app/triggers
       - ./CLAUDE.md:/app/CLAUDE.md
+      - ./traefik-config:/traefik-config
       - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - TRAEFIK_CONFIG_DIR=/traefik-config
     labels:
       - traefik.enable=true
-      # Set APP_HOSTNAME in .env to the domain from APP_URL (e.g., mybot.example.com)
       - traefik.http.routers.event-handler.rule=Host(`${APP_HOSTNAME}`)
-      - traefik.http.routers.event-handler.entrypoints=web
+      - traefik.http.routers.event-handler.entrypoints=websecure
+      - traefik.http.routers.event-handler.tls.certresolver=letsencrypt
       - traefik.http.services.event-handler.loadbalancer.server.port=80
-      ## Uncomment the following lines to enable TLS via Let's Encrypt:
-      # - traefik.http.routers.event-handler.entrypoints=websecure
-      # - traefik.http.routers.event-handler.tls.certresolver=letsencrypt
     stop_grace_period: 120s
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:80/api/ping"]
@@ -58,6 +70,13 @@ services:
       start_period: 30s
     restart: unless-stopped
 
+  litellm:
+    image: ghcr.io/berriai/litellm:main-latest
+    command: --config /litellm/main.yaml --port 4000
+    volumes:
+      - ./config/litellm:/litellm:ro
+    restart: unless-stopped
+
   runner:
     image: myoung34/github-runner:latest
     deploy:
@@ -68,6 +87,7 @@ services:
       RUNNER_SCOPE: repo
       LABELS: self-hosted
       EPHEMERAL: "1"
+      DISABLE_AUTO_UPDATE: "true"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - .:/project
@@ -75,46 +95,3 @@ services:
 
 volumes:
   traefik_certs:
-
-# ──────────────────────────────────────────────────────────────────────
-# Tailscale TLS Example
-# ──────────────────────────────────────────────────────────────────────
-# To use Tailscale HTTPS certs instead of Let's Encrypt:
-#
-# 1. On your Tailscale machine, run:
-#      sudo tailscale cert <your-machine-name>.<tailnet>.ts.net
-#    This creates .crt and .key files in /var/lib/tailscale/certs/
-#
-# 2. Copy traefik-dynamic.yml.example to traefik-dynamic.yml and
-#    replace YOUR_HOSTNAME with your full Tailscale machine name.
-#
-# 3. Replace the traefik service above with:
-#
-#  traefik:
-#    image: traefik:v3
-#    command:
-#      - --providers.docker=true
-#      - --providers.docker.exposedByDefault=false
-#      - --providers.file.filename=/etc/traefik/dynamic.yml
-#      - --entrypoints.web.address=:80
-#      - --entrypoints.web.http.redirections.entrypoint.to=websecure
-#      - --entrypoints.web.http.redirections.entrypoint.scheme=https
-#      - --entrypoints.websecure.address=:443
-#    ports:
-#      - "80:80"
-#      - "443:443"
-#    volumes:
-#      - /var/run/docker.sock:/var/run/docker.sock:ro
-#      - ./traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
-#      - /var/lib/tailscale/certs:/certs:ro
-#    restart: unless-stopped
-#
-# 4. Update the event-handler labels:
-#
-#  event-handler:
-#    labels:
-#      - traefik.enable=true
-#      - traefik.http.routers.event-handler.rule=Host(`${APP_HOSTNAME}`)
-#      - traefik.http.routers.event-handler.entrypoints=websecure
-#      - traefik.http.routers.event-handler.tls=true
-#      - traefik.http.services.event-handler.loadbalancer.server.port=80

package/templates/docker-compose.yml

@@ -4,21 +4,13 @@ services:
     command:
       - --providers.docker=true
       - --providers.docker.exposedByDefault=false
+      - --providers.file.directory=/traefik-config/
       - --entrypoints.web.address=:80
-      - --entrypoints.websecure.address=:443
-      ## Uncomment the following lines to enable TLS via Let's Encrypt
-      ## (requires LETSENCRYPT_EMAIL in .env):
-      # - --entrypoints.web.http.redirections.entrypoint.to=websecure
-      # - --entrypoints.web.http.redirections.entrypoint.scheme=https
-      # - --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}
-      # - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
-      # - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
     ports:
       - "80:80"
-      - "443:443"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - traefik_certs:/letsencrypt
+      - ./traefik-config:/traefik-config:ro
     restart: unless-stopped
 
   event-handler:
@@ -34,16 +26,15 @@ services:
       - ./cron:/app/cron
       - ./triggers:/app/triggers
       - ./CLAUDE.md:/app/CLAUDE.md
+      - ./traefik-config:/traefik-config
       - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - TRAEFIK_CONFIG_DIR=/traefik-config
     labels:
       - traefik.enable=true
-      # Set APP_HOSTNAME in .env to the domain from APP_URL (e.g., mybot.example.com)
       - traefik.http.routers.event-handler.rule=Host(`${APP_HOSTNAME}`)
       - traefik.http.routers.event-handler.entrypoints=web
       - traefik.http.services.event-handler.loadbalancer.server.port=80
-      ## Uncomment the following lines to enable TLS via Let's Encrypt:
-      # - traefik.http.routers.event-handler.entrypoints=websecure
-      # - traefik.http.routers.event-handler.tls.certresolver=letsencrypt
     stop_grace_period: 120s
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:80/api/ping"]
@@ -53,6 +44,13 @@ services:
       start_period: 30s
     restart: unless-stopped
 
+  litellm:
+    image: ghcr.io/berriai/litellm:main-latest
+    command: --config /litellm/main.yaml --port 4000
+    volumes:
+      - ./config/litellm:/litellm:ro
+    restart: unless-stopped
+
   runner:
     image: myoung34/github-runner:latest
     deploy:
@@ -68,6 +66,3 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
       - .:/project
     restart: unless-stopped
-
-volumes:
-  traefik_certs:

package/templates/docs/CLI.md

@@ -29,7 +29,7 @@ These set GitHub repository secrets/variables using the `gh` CLI. They read `GH_
 |---------|-------------|
 | `set-var KEY [VALUE]` | Set a GitHub repository variable |
 
-Agent job secrets are now managed through the admin UI (Settings > Agent Jobs > Secrets), stored encrypted in SQLite, and injected directly into Docker containers.
+Agent job secrets are managed at Admin > Event Handler > Agent Jobs, stored encrypted in SQLite, and injected directly into Docker containers.
 
 ## Common Workflows
 
@@ -54,6 +54,6 @@ npx thepopebot reset config/CRONS.json # accept new template
 ### Set up a new LLM provider for jobs
 ```bash
 npx thepopebot set-var LLM_PROVIDER openai
-npx thepopebot set-var LLM_MODEL gpt-4o
-# Set API keys via admin UI: Settings > Agent Jobs > Secrets
+npx thepopebot set-var LLM_MODEL gpt-5.4
+# Set API keys via admin UI: Admin > Event Handler > LLMs
 ```