7081221352
Add WS_TLS_CA_FILE and WS_TLS_REJECT_UNAUTHORIZED so the remote agent can trust internal PKI chains instead of failing with "unable to verify the first certificate". Apply the same TLS options to proxied HTTPS calls and document CA bundle mounting in compose and deploy READMEs. Co-authored-by: Cursor <cursoragent@cursor.com>
34 lines
1.2 KiB
YAML
34 lines
1.2 KiB
YAML
# Runtime-only compose file that ships inside the deploy ZIP.
|
|
# Unlike the build-time compose in the repo root, this one does NOT try to
|
|
# build anything — it references the image loaded from the tarball
|
|
# (`sha-remote-agent:__VERSION__`, replaced at package time).
|
|
#
|
|
# Run:
|
|
# ./install.sh # first-time setup (loads image, seeds .env, starts)
|
|
# docker compose up -d # subsequent starts once installed
|
|
# docker compose logs -f # tail logs
|
|
# docker compose down # stop
|
|
|
|
services:
|
|
remote-agent:
|
|
image: sha-remote-agent:__VERSION__
|
|
container_name: sha-remote-agent
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
# If WS_URL uses wss:// with a corporate/private CA, place your root +
|
|
# intermediate PEM bundle next to this compose file and uncomment:
|
|
#
|
|
# volumes:
|
|
# - ./certs/ca-bundle.pem:/certs/ca-bundle.pem:ro
|
|
# environment:
|
|
# WS_TLS_CA_FILE: /certs/ca-bundle.pem
|
|
#
|
|
# The agent is a websocket CLIENT — no ports to publish.
|
|
stop_signal: SIGTERM
|
|
stop_grace_period: 10s
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: '10m'
|
|
max-file: '3'
|