cloud-config.yaml.example

# Cloud deployment environment-variable overrides

`config.yaml` is now **host-agnostic and shared** across all hosts (commit `2e5c7a1`).
It contains only `${VAR:-default}` references — never host-specific values.
Cloud ECS does **not** use a separate `config.yaml`; it uses the same tracked file
and overrides local-vs-cloud behavior through the gitignored `.env`.

For a full cloud `.env` template, see [`docs/cloud-env.example`](cloud-env.example).

## Key cloud-side overrides

Copy these into `~/.local/share/mini-agent/.env` on the ECS instance:

```bash
# Disable local-only subsystems on cloud
SCHEDULER_ENABLED=false
TELEGRAM_ENABLED=false
NOTIFICATIONS_TELEGRAM=false

# Web: loopback-only behind nginx, stealth 444 errors
WEB_BIND_PUBLIC=false
WEB_SILENT_ERRORS=true
WEB_ALLOWED_ORIGIN=https://example.com

# Multi-tenant auth
AUTH_ENABLED=true
AUTH_ADMIN_EMAIL=admin@example.com
AUTH_ADMIN_PASSWORD=<same-as-web-api-password>

# Sync: cloud is passive; local pulls/pushes
LOCAL_ORIGIN=1
SYNC_ENABLED=false
SYNC_NODE_ID=cloud-ecs

# pi RPC path on cloud (<user> uses a standalone node-v22 package)
PI_PATH=/home/user/.local/share/pi-node/node-v22.23.1-linux-x64/bin/pi

# Optional paths
BLOG_POSTS=/home/user/<your-blog-repo>/src/content/posts
PI_WORKSPACE=./pi-workspace
```

## Service file

Only `mini-agent.service` remains `skip-worktree` on ECS because it carries the
<user> variant (`Environment=PATH=...`, `EnvironmentFile=.env`, no
`LoadCredentialEncrypted`). Before pulling, verify:

```bash
git ls-files -v mini-agent.service   # expect S
```

If it shows `H`, re-set: `git update-index --skip-worktree mini-agent.service`.

## Still need a YAML body?

If you arrived here looking for the old cloud-specific `config.yaml`, use the
root `config.yaml` instead — it is the shared file. All per-host differences are
in `.env`.