opencode-devbox/.env.example

# opencode-devbox environment configuration
# Copy this file to .env and fill in your values:
#   cp .env.example .env

# ── LLM Provider ─────────────────────────────────────────────────────
# Which provider to auto-configure (anthropic, openai, amazon-bedrock)
OPENCODE_PROVIDER=anthropic

# Model override (optional, defaults per provider)
# OPENCODE_MODEL=anthropic/claude-sonnet-5

# ── API Keys (set the one matching your provider) ────────────────────
# ANTHROPIC_API_KEY=
# OPENAI_API_KEY=
# GEMINI_API_KEY=

# ── AWS Bedrock (if using amazon-bedrock provider) ───────────────────
# AWS_REGION=eu-west-1
# AWS_PROFILE=default
# AWS_ACCESS_KEY_ID=
# AWS_SECRET_ACCESS_KEY=

# ── Git Configuration ────────────────────────────────────────────────
GIT_USER_NAME=
GIT_USER_EMAIL=

# ── Workspace ────────────────────────────────────────────────────────
# Path on host to mount as /workspace in the container
WORKSPACE_PATH=~/projects

# Path to SSH keys on host
SSH_KEY_PATH=~/.ssh

# ── MemPalace memory (local by default) ───────────────────────────
# By default each container runs its OWN MemPalace (a local stdio server;
# palace stored at ~/.mempalace). Uncomment the devbox-palace volume in
# docker-compose.yml to persist it across container recreation.
#
# To instead share ONE MemPalace across several containers / harnesses
# (pi + opencode + native), point every container at an external HTTP
# endpoint. When MEMPALACE_REMOTE_URL is set, no local mempalace-mcp is
# spawned and the devbox-palace volume is irrelevant.
#   Serve it with:  mempalace-mcp --transport http --host 0.0.0.0 --port 8765
# MEMPALACE_REMOTE_URL=http://mempalace.lan:8765/mcp
# MEMPALACE_REMOTE_TOKEN=          # optional — sent as: Authorization: Bearer <token>

# ── LAN access from the container (host-OS-agnostic) ─────────────────
# On VM-backed hosts (macOS OrbStack / Docker Desktop, also Docker Desktop
# on Windows) the container runs in a Linux VM and CANNOT reach the host's
# directly-attached LAN peers by default. On native Linux Docker the LAN is
# reachable directly and nothing is needed. The entrypoint detects this and,
# on VM-backed hosts, generates ~/.ssh-local/config so the host can be used
# as an SSH jump (use the `dssh` alias). Reach the host itself with
# `dssh host`. To reach named LAN peers, put `ProxyJump host` overrides in a
# host-owned ~/.config/devbox-shell/ssh-lan.conf (bind-mounted in) rather than
# editing your ~/.ssh/config — see ssh-lan.conf.example. Public-IP hosts (and
# anything reached via a public jump host) connect directly, no jump needed.
#
# DEVBOX_LAN_ACCESS: auto (default) | jump | off
#   auto = set up the jump only on VM-backed hosts; no-op on native Linux.
#   jump = always set up (e.g. native Linux with extra_hosts host-gateway).
#   off  = disable entirely.
# DEVBOX_LAN_ACCESS=auto
#
# HOST_SSH_USER: your username on the host. REQUIRED for the jump to
# authenticate. On first start the entrypoint prints the public key to
# authorize on the host (append to the host's ~/.ssh/authorized_keys) and
# reminds you to enable the host's SSH server (e.g. macOS Remote Login).
# HOST_SSH_USER=
#
# DEVBOX_HOST_ALIAS: host hostname to reach (default host.docker.internal).
# DEVBOX_HOST_ALIAS=host.docker.internal
#
# DEVBOX_LAN_AUTOJUMP_PRIVATE: 1 = ProxyJump ANY RFC1918 (private) IP through
# the host, so bare `dssh user@<ip>` works on whatever LAN the (roaming) host
# is currently joined to, without naming peers. Matches the typed address, not
# the resolved HostName, so named hosts with their own ProxyJump are unaffected.
# DEVBOX_LAN_AUTOJUMP_PRIVATE=0

# ── Skillset (agent skills and instructions) ─────────────────────────
# If you have a skillset repo, the entrypoint auto-deploys skills and
# instructions on container start using relative symlinks (portable
# across host/container).
#
# Detection is automatic if the skillset lives directly at the workspace
# root (i.e. WORKSPACE_PATH/skillset → /workspace/skillset in container).
#
# If the skillset lives in a subdirectory of your workspace, set
# SKILLSET_CONTAINER_PATH to its location *inside the container*. This
# is determined by the workspace mount: whatever is at
# WORKSPACE_PATH/<subpath> on the host becomes /workspace/<subpath>
# in the container.
#
# Examples:
#   Host skillset at ~/projects/skillset        → already at /workspace/skillset (auto-detected, no config needed)
#   Host skillset at ~/projects/tools/skillset  → SKILLSET_CONTAINER_PATH=/workspace/tools/skillset
#   Host skillset at ~/projects/local/skillset  → SKILLSET_CONTAINER_PATH=/workspace/local/skillset
#
# Alternatively, mount the skillset repo at a dedicated path using the
# SKILLSET_PATH volume in docker-compose.yml (see comments there). In
# that case the entrypoint finds it at ~/skillset automatically.
#
# SKILLSET_CONTAINER_PATH=

# ── Locale (defaults to en_US.UTF-8) ─────────────────────────────────
# LANG=sv_SE.UTF-8
# LANGUAGE=sv_SE:sv
# LC_ALL=sv_SE.UTF-8

# ── oh-my-opencode-slim (multi-agent orchestration) ──────────────────
# Requires image built with INSTALL_OMOS=true
# ENABLE_OMOS=false
# OMOS_TMUX=false              # Enable tmux multiplexer integration
# OMOS_SKILLS=true             # Symlink bundled OMOS skills (clonedeps, codemap,
#                              # deepwork, oh-my-opencode-slim, simplify) from the
#                              # image into ~/.agents/skills/ each start; updates
#                              # on image pull. Independent of ENABLE_OMOS.
#                              # See docs/omos-skills.md
# OMOS_RESET=false             # Force regenerate oh-my-opencode-slim config on next start (does not affect skills)

# ── Background subagents (opencode experimental flag) ────────────────
# Baked ON in the image (ENV in Dockerfile.base) because OMOS V2+ default
# orchestration depends on opencode's native background subagents. Uncomment
# to opt out (e.g. to force blocking/foreground orchestration).
# OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS=false