72 lines
2.5 KiB
Markdown
72 lines
2.5 KiB
Markdown
# Workmachine Instructions
|
|
|
|
## Purpose
|
|
|
|
- `/shared` is the persistent host-mounted workspace.
|
|
- Store projects and durable files under `/shared`.
|
|
- Treat files outside `/shared` as disposable unless documented otherwise.
|
|
|
|
## Public Access
|
|
|
|
- This workmachine is connected to its public domain through Cloudflare Tunnel.
|
|
- Public domain: `{{PUBLIC_DOMAIN}}`
|
|
- Public base URL: `{{PUBLIC_BASE_URL}}`
|
|
- Public MCP endpoint: `{{PUBLIC_MCP_URL}}`
|
|
- Cloudflare Tunnel forwards public requests to Nginx at `http://localhost:2999`.
|
|
- Nginx forwards the protected cokacremote paths, including `/mcp`, to `http://127.0.0.1:3000`.
|
|
|
|
## Instruction Scope
|
|
|
|
- Check for a nearer `AGENTS.md` before modifying a project.
|
|
- Project-specific instructions take precedence within that project.
|
|
- Preserve existing files, repositories, and uncommitted changes.
|
|
|
|
## Reserved Workmachine Resources
|
|
|
|
The following resources belong to the workmachine infrastructure and cokacremote. During unrelated application development, never reuse, overwrite, remove, stop, redirect, or otherwise interfere with them:
|
|
|
|
- TCP port `2999`: Nginx gateway
|
|
- TCP port `3000`: cokacremote MCP server
|
|
- `/opt/cokacremote`
|
|
- `/var/lib/cokacremote`
|
|
- `/etc/nginx/routes.d/10-cokacremote.conf`
|
|
- Nginx and cokacremote Supervisor processes
|
|
- `/mcp`
|
|
- `/health`
|
|
- `/.well-known/*`
|
|
- `/authorize`
|
|
- `/token`
|
|
- `/register`
|
|
- `/revoke`
|
|
|
|
Only modify these resources when the user explicitly requests maintenance of workmachine or cokacremote.
|
|
|
|
## Application Services
|
|
|
|
- Check listening ports before selecting an application port.
|
|
- New applications must not use ports `2999` or `3000`.
|
|
- Bind application servers to `127.0.0.1` unless instructed otherwise.
|
|
- Store application route files in `/shared/nginx/routes.d/`.
|
|
- Use one route file and one unique internal port per application.
|
|
- Do not modify `/etc/nginx/routes.d/10-cokacremote.conf`.
|
|
|
|
## Nginx Changes
|
|
|
|
- Validate configuration before applying it.
|
|
- Apply changes with `nginx -t && nginx -s reload`.
|
|
- Do not stop or restart Nginx when a reload is sufficient.
|
|
- Do not modify Cloudflare Tunnel settings unless explicitly requested.
|
|
|
|
## Safety
|
|
|
|
- Do not delete, overwrite, move, or reset user files without explicit approval.
|
|
- Do not expose secrets, tokens, `.env` files, or OAuth keys.
|
|
- Do not publish container ports directly without approval.
|
|
- Avoid destructive system and Git commands.
|
|
|
|
## Verification
|
|
|
|
- Use the package manager selected by the existing lockfile.
|
|
- Run relevant tests or builds after changes.
|
|
- Report changed files, allocated ports, routes, and verification results.
|