94 lines
6.3 KiB
Markdown
94 lines
6.3 KiB
Markdown
# Satellite Inventory
|
|
|
|
What an account with coding agents needs, as found on `think` (Ubuntu 24.04) on 2026-10-13.
|
|
It is the input for the profile of a satellite, `#sat` in [werkregie.werkbaum](werkregie.werkbaum).
|
|
Secrets appear by name only.
|
|
|
|
## Setups
|
|
|
|
A satellite is an account in which agents work; Werkregie sets it up and reads its agents.
|
|
The setup differs from case to case, and the satellite assumes none of them:
|
|
|
|
- another Unix account on the user's laptop;
|
|
- a local virtual machine;
|
|
- a remote virtual machine;
|
|
- the agent as a user, or as root in its own virtual machine.
|
|
|
|
The user's main account keeps the relay with Matrix; it is no satellite.
|
|
Today `think` has both in the one account `mi`.
|
|
[satellite-omarchy.md](satellite-omarchy.md) shows how an Omarchy VM on `think` became a satellite.
|
|
|
|
## System Packages
|
|
|
|
| Package | Version | Used by |
|
|
|------------|---------|-----------------------------------------------------------|
|
|
| git | | everything |
|
|
| bubblewrap | 0.9.0 | the Codex runner hides the home directory from Codex |
|
|
| curl, jq | | scripts, the bootstrap of a satellite |
|
|
|
|
A satellite runs Omarchy Linux, an Arch Linux, so the profile names pacman packages;
|
|
`think` shows what is needed, not the target system.
|
|
|
|
## Agents
|
|
|
|
| Component | Installed as | Configuration | Login, per device |
|
|
|-------------|------------------------------------------------------|----------------------------------------------------------------------|-----------------------------------|
|
|
| Claude Code | native installer, `~/.local/bin/claude`, 2.1.280 | `~/.claude/settings.json`, `~/.claude/CLAUDE.md`, plugin `typesafe` | subscription, interactive |
|
|
| Codex CLI, for the Codex runner only | npm under nvm, Node 24.21.0, codex-cli 0.162.1 | `~/.codex/config.toml` (model, trusted projects), `~/.codex/AGENTS.md` | subscription, `~/.codex/auth.json` |
|
|
| nvm, Node | `~/.nvm`, `default` alias | the Codex runner uses the `default` Node | |
|
|
| JDK | SDKMAN, `~/opt/jdk25` | Gradle starts on it; builds take Temurin 25 from Foojay (ADR 0001) | |
|
|
|
|
The memory of Claude Code lies in `~/.claude/projects/<project>/memory/`; a satellite does not get it (`#sat.memory`).
|
|
|
|
## Gitea Access
|
|
|
|
- `tea` 0.16.0 in `~/bin`, with the logins `javagil` (mi), `claude-code` and `hsh-michaelhoennig`.
|
|
- The global git identity is the human's; a worktree of an agent gets `claude-code` by
|
|
`~/.config/ai-coding-agents/git-push-as-claude-code.sh`, which reads the token from `secrets.env` at each push.
|
|
- The global `credential.helper store` keeps the human's credentials in a file; an agent account must not get it.
|
|
- SSH keys and `~/.ssh/config` belong to the human; an agent pushes over HTTPS with its token.
|
|
|
|
## Secrets
|
|
|
|
`~/.config/ai-coding-agents/secrets.env`, mode 0600:
|
|
|
|
| Group | Names | Needed by a satellite |
|
|
|--------------------------|-----------------------------------------------------------------------------------------------|------------------------|
|
|
| Gitea javagil, agent | `GITEA_CLAUDE_CODE_TOKEN` | yes |
|
|
| Gitea javagil, reviewer | `GITEA_BOT_TOKEN` | yes, Codex runner |
|
|
| Gitea javagil, human | `GITEA_TOKEN`, `GITEA_AUTHOR_TOKEN`, `GITEA_ADMIN_TOKEN`, `GITEA_SETUP_TOKEN` | no |
|
|
| Gitea Hostsharing | `HOSTSHARING_GITEA_READ_TOKEN`, `HOSTSHARING_GITEA_REVIEW_TOKEN` | to be decided |
|
|
| Models | `OPENROUTER_API_KEY`, `TYPESAFE_API_KEY` | yes |
|
|
| werkrevisor statistics | `WERKREVISOR_STATS_SOURCE_TOKEN_*`, `WERKREVISOR_STATS_READ_TOKEN` | to be decided |
|
|
| Taiga | `TAIGA_USER`, `TAIGA_PASSWORD`, besides `~/.config/ai-coding-agents/taiga.refresh` | no, the server reads Taiga |
|
|
|
|
Besides `secrets.env`:
|
|
|
|
- `~/.config/werkregie/relay-token`: the access token of the Werkregie server; all relays share it today.
|
|
- `~/.config/werkregie/dashboard.env`: `TYPESAFE_API_KEY` and `OPENROUTER_API_KEY` for the relay.
|
|
|
|
## Services
|
|
|
|
| Unit (systemd user) | Runs | Needs |
|
|
|------------------------------------|----------------------------------------------------------------------|--------------------------------------------------------------------------|
|
|
| `werkregie-relay.service` | `~/opt/werkregie-dashboard/bin/werkregie-dashboard relay` | runtime bundle, `~/.config/werkregie/dashboard.yml`, relay token, `dashboard.env` |
|
|
| `werkrevisor-codex-runner.timer` | every 5 min `tools/codex-runner` in `~/Projekte/werkrevisor` | werkrevisor checkout, nvm, Codex login, bubblewrap, `secrets.env` |
|
|
|
|
`dashboard.yml` of the relay holds the server URL, the relay name `think`, Matrix (homeserver, rooms, link)
|
|
and the environment names of the keys for Jev and the summaries.
|
|
The Matrix session lies in the state directory of the relay; `matrix login` and `matrix verify` are interactive.
|
|
|
|
## Repositories
|
|
|
|
Checkouts under `~/Projekte`: werkregie, werkator, werkbaum, werkcrappit, werkdock, werkjournal, werkprobe, werkrevisor,
|
|
and the Hostsharing repositories under `~/Projekte/Hostsharing`.
|
|
An agent works in a worktree of its own below `.claude/worktrees/`.
|
|
|
|
## Interactive Steps
|
|
|
|
These steps cannot be copied, because the login belongs to the device:
|
|
|
|
1. Claude Code: subscription login.
|
|
2. Codex, where the Codex runner runs: subscription login.
|
|
3. Matrix, in the main account only: `werkregie-dashboard matrix login`, then `matrix verify` with the recovery key.
|