Files
javis_bot/docker/entrypoint.sh
javis-bot 35e754d6ee fix(docker): in-container Gemini CLI OAuth, broadcast audio, ports + hardening
Makes the all-in-one image actually run the new real-time-search features and
closes review gaps:
- Gemini OAuth path: install Node 22 + @google/gemini-cli (pinned 0.46.0) in the
  image; mount a DEDICATED host dir (~/.config/javis/gemini) holding only the
  OAuth creds to /root/.gemini (not the whole ~/.gemini). Verified in-container:
  `gemini -p ... -o json` returns a grounded answer with no API key.
- Broadcast audio: add PulseAudio + a headless null-sink (run-pulse.sh, new
  supervisor program); export XDG_RUNTIME_DIR/PULSE_SERVER so Chrome playback
  and the selfbot `ffmpeg -f pulse -i @DEFAULT_MONITOR@` share one daemon.
  Verified: default sink virtual_speaker, monitor present, ffmpeg capture OK.
- Bind the brain bridge to 127.0.0.1 only (internal, unauthenticated API).
- VNC host port is overridable; this server pins VNC_PORT=5902 (.env) since the
  host already runs Xvnc on 5901.

Verified in-container with CDI GPU passthrough: RTX 5050 visible, NVENC
encoders (h264/hevc/av1) available.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-06-11 01:36:30 +09:00

49 lines
1.9 KiB
Bash
Executable File

#!/usr/bin/env bash
# Container entrypoint: render config from env, set the VNC password, ensure the
# Piper voice exists, then hand off to supervisord (which runs the desktop,
# bridge, and bot).
set -euo pipefail
# --- Defaults (override via .env / compose) ---
: "${VNC_PASSWORD:=javis123}"
: "${VNC_RESOLUTION:=1920x1080}"
: "${OLLAMA_BASE_URL:=http://ollama:11434}"
: "${OLLAMA_CHAT_MODEL:=qwen3:8b}"
: "${OLLAMA_EMBED_MODEL:=nomic-embed-text}"
: "${WHISPER_MODEL:=small}"
: "${WHISPER_DEVICE:=cuda}"
: "${WHISPER_COMPUTE_TYPE:=float16}"
: "${JARVIS_DB_PATH:=/data/jarvis.db}"
: "${BRIDGE_HOST:=0.0.0.0}"
: "${BRIDGE_PORT:=8765}"
: "${PIPER_VOICE:=en_GB-alan-medium}"
: "${PIPER_VOICE_DIR:=/opt/piper-voices}"
: "${TTS_PIPER_MODEL_PATH:=${PIPER_VOICE_DIR}/${PIPER_VOICE}.onnx}"
# Audio: shared PulseAudio socket so Chrome (playback) and the selfbot ffmpeg
# (capture of @DEFAULT_MONITOR@) reach the same headless daemon (run-pulse.sh).
: "${XDG_RUNTIME_DIR:=/run/user/0}"
: "${PULSE_SERVER:=unix:${XDG_RUNTIME_DIR}/pulse/native}"
export VNC_RESOLUTION OLLAMA_BASE_URL OLLAMA_CHAT_MODEL OLLAMA_EMBED_MODEL \
WHISPER_MODEL WHISPER_DEVICE WHISPER_COMPUTE_TYPE JARVIS_DB_PATH \
PIPER_VOICE PIPER_VOICE_DIR TTS_PIPER_MODEL_PATH BRIDGE_HOST BRIDGE_PORT \
XDG_RUNTIME_DIR PULSE_SERVER
mkdir -p /data /app/config "$(dirname "$JARVIS_DB_PATH")"
# --- VNC password file ---
mkdir -p /root/.vnc
echo "$VNC_PASSWORD" | tigervncpasswd -f > /root/.vnc/passwd
chmod 600 /root/.vnc/passwd
# --- Render jarvis brain config from template ---
envsubst < /app/docker/jarvis-config.template.json > /app/config/jarvis.json
export JARVIS_CONFIG_PATH=/app/config/jarvis.json
# --- Ensure the Piper voice exists (best effort) ---
bash /app/docker/download-piper.sh || echo "[entrypoint] piper download failed; TTS may be unavailable"
echo "[entrypoint] display=$DISPLAY ollama=$OLLAMA_BASE_URL whisper=$WHISPER_MODEL/$WHISPER_DEVICE"
exec supervisord -c /app/docker/supervisord.conf