50 lines
2.2 KiB
Nix
50 lines
2.2 KiB
Nix
# heather — paseo daemon (self-hosted web UI для CLI-агентов: pi, codex и др.).
|
||
#
|
||
# https://github.com/getpaseo/paseo, npm-пакет @getpaseo/cli
|
||
# Daemon управляет агентами как дочерними процессами (provider = CLI на хосте,
|
||
# со своими кредами). Слушает 127.0.0.1:6767 → Caddy paseo.iscg.dev терминирует
|
||
# TLS + basicauth (внешний слой, см. caddy.nix paseoBasicAuth).
|
||
#
|
||
# Auth два слоя:
|
||
# 1) встроенная парольная auth демона (bcrypt, Bearer header + WS subprotocol,
|
||
# без пароля — 401). Пароль: PASEO_PASSWORD из EnvironmentFile
|
||
# /var/lib/paseo-secrets/paseo.env (mikl:users 600), plaintext в
|
||
# pass iscg.dev/paseo/daemon.
|
||
# 2) Caddy basicauth, пароль в pass iscg.dev/paseo/basicauth.
|
||
#
|
||
# Конфиг демона: ~/.paseo/config.json (hostnames: paseo.iscg.dev — DNS rebinding
|
||
# protection, webUi enabled, relay off, dictation/voice off — не качать
|
||
# speech-модели). Хост-allowlist проверен: чужой Host → 403.
|
||
#
|
||
# Установка @getpaseo/cli — ручная (npm global в ~/.npm-global, как pi-web):
|
||
# npm i -g @getpaseo/cli # node-pty собирается без тулчейна (prebuilds)
|
||
# Провайдеры: pi уже стоит (~/.local/bin/pi).
|
||
|
||
{ config, pkgs, lib, ... }:
|
||
{
|
||
systemd.services.paseo = {
|
||
description = "paseo daemon (self-hosted web UI for CLI coding agents)";
|
||
after = [ "network-online.target" ];
|
||
wants = [ "network-online.target" ];
|
||
wantedBy = [ "multi-user.target" ];
|
||
|
||
# PATH: nodejs (node/npm) + ~/.npm-global/bin (paseo) + ~/.local/bin (pi).
|
||
path = [ pkgs.nodejs "/home/mikl/.npm-global/bin" "/home/mikl/.local/bin" ];
|
||
|
||
environment = {
|
||
PASEO_HOME = "/home/mikl/.paseo";
|
||
HOME = "/home/mikl";
|
||
};
|
||
|
||
serviceConfig = {
|
||
Type = "simple";
|
||
User = "mikl";
|
||
Group = "users";
|
||
ExecStart = "/home/mikl/.npm-global/bin/paseo daemon start --foreground --web-ui --no-relay";
|
||
EnvironmentFile = "/var/lib/paseo-secrets/paseo.env";
|
||
WorkingDirectory = "/home/mikl";
|
||
Restart = "on-failure";
|
||
RestartSec = 5;
|
||
};
|
||
};
|
||
}
|