Workmachine Instructions

Purpose

/shared is the persistent host-mounted workspace.
Store projects and durable files under /shared.
Treat files outside /shared as disposable unless documented otherwise.

Public Access

This workmachine is connected to its public domain through Cloudflare Tunnel.
Public domain: {{PUBLIC_DOMAIN}}
Public base URL: {{PUBLIC_BASE_URL}}
Public MCP endpoint: {{PUBLIC_MCP_URL}}
Cloudflare Tunnel forwards public requests to Nginx at http://localhost:2999.
Nginx forwards the protected cokacremote paths, including /mcp, to http://127.0.0.1:3000.

Instruction Scope

Check for a nearer AGENTS.md before modifying a project.
Project-specific instructions take precedence within that project.
Preserve existing files, repositories, and uncommitted changes.

Reserved Workmachine Resources

The following resources belong to the workmachine infrastructure and cokacremote. During unrelated application development, never reuse, overwrite, remove, stop, redirect, or otherwise interfere with them:

TCP port 2999: Nginx gateway
TCP port 3000: cokacremote MCP server
/opt/cokacremote
/var/lib/cokacremote
/etc/nginx/routes.d/10-cokacremote.conf
Nginx and cokacremote Supervisor processes
/mcp
/health
/.well-known/*
/authorize
/token
/register
/revoke

Only modify these resources when the user explicitly requests maintenance of workmachine or cokacremote.

Application Services

Check listening ports before selecting an application port.
New applications must not use ports 2999 or 3000.
Bind application servers to 127.0.0.1 unless instructed otherwise.
Store application route files in /shared/nginx/routes.d/.
Use one route file and one unique internal port per application.
Do not modify /etc/nginx/routes.d/10-cokacremote.conf.

Nginx Changes

Validate configuration before applying it.
Apply changes with nginx -t && nginx -s reload.
Do not stop or restart Nginx when a reload is sufficient.
Do not modify Cloudflare Tunnel settings unless explicitly requested.

Safety

Do not delete, overwrite, move, or reset user files without explicit approval.
Do not expose secrets, tokens, .env files, or OAuth keys.
Do not publish container ports directly without approval.
Avoid destructive system and Git commands.

Verification

Use the package manager selected by the existing lockfile.
Run relevant tests or builds after changes.
Report changed files, allocated ports, routes, and verification results.

2.5 KiB Raw Blame History