HolyClaude/docker-compose.full.yaml at master · CoderLuii/HolyClaude · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
# ==============================================================================
# HolyClaude — Full Configuration
# Usage: docker compose -f docker-compose.full.yaml up -d
# All options documented: https://github.com/CoderLuii/HolyClaude/blob/master/docs/configuration.md
# ==============================================================================

services:
  holyclaude:
    image: coderluii/holyclaude:latest
    container_name: holyclaude
    hostname: holyclaude
    restart: unless-stopped
    shm_size: 2g
    network_mode: bridge
    cap_add:
      - SYS_ADMIN  # Current browser profile for this release; hardening is separate
      - SYS_PTRACE # Debugging-related capability
    security_opt:
      - seccomp=unconfined  # Current browser profile for this release; hardening is separate
    # extra_hosts:
    #   - "host.docker.internal:host-gateway"  # Linux: let the container reach services on the Docker host (e.g., Ollama)
    ports:
      - "127.0.0.1:${HOLYCLAUDE_HOST_PORT:-3001}:3001"   # CloudCLI web UI, localhost only
      # --- Uncomment ports as needed ---
      # - "127.0.0.1:3000:3000"  # Dev server (Next.js, Express)
      # - "127.0.0.1:4321:4321"  # Astro dev
      # - "127.0.0.1:5173:5173"  # Vite dev
      # - "127.0.0.1:8787:8787"  # Wrangler dev
      # - "127.0.0.1:9229:9229"  # Node.js debugger
      # - "127.0.0.1:1455:1455"  # Codex auth callback port
      # - "127.0.0.1:2222:22"    # Optional SSH, localhost/VPN only
      # - "127.0.0.1:60000-60010:60000-60010/udp"  # Optional Mosh UDP range
    volumes:
      - ${HOLYCLAUDE_HOST_CLAUDE_DIR:-./data/claude}:/home/claude/.claude
      - ${HOLYCLAUDE_HOST_WORKSPACE_DIR:-./workspace}:/workspace
      # --- Optional SSH/Mosh remote shell state ---
      # Keep authorized_keys outside .claude and /workspace. Mount it read-only.
      # - ./data/ssh/authorized_keys:/run/holyclaude-ssh/authorized_keys:ro
      # Persist host keys if you do not want SSH fingerprints to change after recreate.
      # - holyclaude-ssh:/var/lib/holyclaude-ssh
    environment:
      # --- Required ---
      - TZ=UTC                                    # Your timezone (e.g., America/New_York)

      # --- Performance ---
      - NODE_OPTIONS=--max-old-space-size=4096     # Node.js memory limit (MB)

      # --- User mapping (match your host UID/GID) ---
      - PUID=1000
      - PGID=1000

      # --- SMB/CIFS mounts (enable if workspace is on a network share) ---
      # - CHOKIDAR_USEPOLLING=1
      # - WATCHFILES_FORCE_POLLING=true

      # --- Notifications (uncomment services you want) ---
      # - NOTIFY_DISCORD=discord://webhook_id/webhook_token
      # - NOTIFY_TELEGRAM=tgram://bot_token/chat_id
      # - NOTIFY_PUSHOVER=pover://user_key@app_token
      # - NOTIFY_SLACK=slack://token_a/token_b/token_c
      # - NOTIFY_EMAIL=mailto://user:pass@gmail.com?to=you@gmail.com
      # - NOTIFY_GOTIFY=gotify://hostname/token
      # - NOTIFY_URLS=                                   # catch-all: comma-separated Apprise URLs

      # --- Anthropic / Claude Code (optional, can also authenticate via web UI) ---
      # - ANTHROPIC_API_KEY=
      # - ANTHROPIC_AUTH_TOKEN=                  # Auth token, or set to ollama for Ollama's Anthropic-compatible API
      # - ANTHROPIC_BASE_URL=                    # Custom API endpoint, or Ollama endpoint (e.g. http://host.docker.internal:11434)
      # - CLAUDE_CODE_USE_BEDROCK=1              # Use Amazon Bedrock as backend
      # - CLAUDE_CODE_USE_VERTEX=1               # Use Google Vertex AI as backend

      # --- AI provider API keys (optional — can also set via web UI) ---
      # - GEMINI_API_KEY=
      # - OPENAI_API_KEY=
      # - CURSOR_API_KEY=

      # --- Web UI base path (optional) ---
      # Use only when a reverse proxy mounts HolyClaude below a path. No trailing slash.
      # Example: tailscale serve --set-path=/holyclaude http://127.0.0.1:3001
      # - HOLYCLAUDE_BASE_PATH=/holyclaude

      # --- Codex permission modes (optional) ---
      # CloudCLI Codex chat runtime mode. Valid: default, acceptEdits, bypassPermissions.
      # Recommended: acceptEdits. bypassPermissions gives full access with no approval;
      # use it only for trusted local workspaces inside your Docker volume boundary.
      # - HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE=acceptEdits
      # Raw codex CLI first-boot mode. Only used when creating a new ~/.codex/config.toml.
      # Existing Codex configs are not overwritten.
      # - HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE=acceptEdits

      # --- Desloppify global skill setup (optional) ---
      # The desloppify CLI is always installed and passive. This only configures
      # global agent guidance; scans still run only when you call desloppify.
      # Valid: off, all, claude, codex, gemini, opencode, or comma-separated subsets.
      # all expands to claude,codex,gemini. opencode is full-image only.
      # - HOLYCLAUDE_DESLOPPIFY_SETUP=off

      # --- SSH/Mosh remote shell (optional, disabled by default) ---
      # Keep this behind localhost, VPN, Tailscale, or a firewall. Do not publish
      # SSH/Mosh directly to the public internet.
      # - HOLYCLAUDE_SSH_ENABLE=false
      # - HOLYCLAUDE_SSH_AUTHORIZED_KEYS=/run/holyclaude-ssh/authorized_keys
      # - HOLYCLAUDE_SSH_HOST_KEYS_DIR=/var/lib/holyclaude-ssh/host_keys
      # - HOLYCLAUDE_MOSH_ENABLE=false
      # - HOLYCLAUDE_MOSH_UDP_START=60000
      # - HOLYCLAUDE_MOSH_UDP_END=60010

# volumes:
#   holyclaude-ssh: