Run coding agents on every machine you own.

# docker-compose.yml — generated by `nook server init`. Tags are pinned.
services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: nook
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: nook
    volumes: [pgdata:/var/lib/postgresql/data]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U nook"]
      interval: 5s
      timeout: 5s
      retries: 30

  control-plane:
    image: ghcr.io/nook-os/nook-control:v0.4.10
    restart: unless-stopped
    env_file: .env
    volumes:
      - ./agent-certs:/etc/nook:ro   # agent-listener cert; nodes pin its fingerprint
    depends_on:
      postgres: { condition: service_healthy }
    ports:
      - "8080:8080"   # API + UI backend
      - "8081:8081"   # nodes (mutual TLS)

  web:
    image: ghcr.io/nook-os/nook-web:v0.4.10
    restart: unless-stopped
    environment:
      CONTROL_PLANE_ORIGIN: http://control-plane:8080
    depends_on: [control-plane]
    ports: ["80:80"]

volumes: { pgdata: }

# Traefik labels — from `nook server init` → "Compose behind Traefik".
labels:
  - "traefik.enable=true"
  - "traefik.http.routers.nook-api.rule=Host(`nook.example.com`)
       && (PathPrefix(`/api`) || PathPrefix(`/mcp`)
       || PathPrefix(`/healthz`) || PathPrefix(`/.well-known`))"
  - "traefik.http.routers.nook-api.entrypoints=websecure"
  - "traefik.http.routers.nook-api.tls=true"
  - "traefik.http.services.nook-api.loadbalancer.server.port=8080"

  # Nodes, by SNI, passed through untouched.
  - "traefik.tcp.routers.nook-agent.rule=HostSNI(`agent.nook.example.com`)"
  - "traefik.tcp.routers.nook-agent.entrypoints=websecure"
  - "traefik.tcp.routers.nook-agent.tls.passthrough=true"
  - "traefik.tcp.services.nook-agent.loadbalancer.server.port=8081"

server {
  server_name nook.example.com;
  location / { proxy_pass http://127.0.0.1:80; }
  location /api/ {
    proxy_pass http://127.0.0.1:8080;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
  }
}

# Nodes — TCP, never decrypted.
stream {
  map $ssl_preread_server_name $backend {
    agent.nook.example.com 127.0.0.1:8081;
  }
  server { listen 443; ssl_preread on; proxy_pass $backend; }
}

-- on your Postgres
CREATE ROLE nook LOGIN PASSWORD 'choose-something';
CREATE DATABASE nook OWNER nook;

# run-containers.sh — written by `nook server init` → "docker run".
docker network create nook 2>/dev/null || true

docker run -d --name nook-control --network nook --restart unless-stopped \
  --env-file .env \
  -v "$PWD/agent-certs:/etc/nook:ro" \
  -p 8080:8080 -p 8081:8081 \
  ghcr.io/nook-os/nook-control:v0.4.10

docker run -d --name nook-web --network nook --restart unless-stopped \
  -e CONTROL_PLANE_ORIGIN=http://nook-control:8080 \
  -p 80:80 \
  ghcr.io/nook-os/nook-web:v0.4.10

# .env — generated. The process reads these; DATABASE_URL is your Postgres.
APP_ENV=production
CONTROL_PLANE_BIND=0.0.0.0:8080
PUBLIC_BASE_URL=https://nook.example.com
WEB_ORIGIN=https://nook.example.com
DATABASE_URL=postgres://nook:...@db.example.com:5432/nook
SESSION_SECRET=...        # 32+ chars; rotating it signs everyone out
SECRETS_KEY=...           # at-rest encryption. LOSING THIS LOSES stored secrets
MCP_TOKEN=...

# /etc/systemd/system/nook-control.service — example; the installer writes only .env
[Unit]
Description=NookOS control plane
After=network-online.target
Wants=network-online.target

[Service]
EnvironmentFile=/opt/nook/.env
ExecStart=/usr/local/bin/nook-control
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

# 1. Create the Secret the chart references (external Postgres + session secret).
kubectl create secret generic nook-control-secrets \
  --from-literal=DATABASE_URL='postgres://user:pass@db.example.com:5432/nook' \
  --from-literal=SESSION_SECRET="$(openssl rand -hex 32)"

# 2. Get starter values (writes nook-values.yaml, downloads nothing).
curl -fsSL https://nookos.dev/install.sh | sh -s -- --k8s

# 3. Install from the published chart. Add --version X.Y.Z to pin.
helm install nook oci://ghcr.io/nook-os/charts/nook-control -f nook-values.yaml

# nook-values.yaml — nothing here is a secret.
existingSecret: nook-control-secrets   # the Secret created above

config:
  publicBaseUrl: https://nook.example.com
  webOrigin: https://nook.example.com

ingress:
  host: nook.example.com
  # TLS: reference a Secret, or drive cert-manager with annotations.
  # tls: { enabled: true, secretName: nook-tls }

# Agent mTLS listener (:8081) — how external nodes join. Off by default; its
# TLS terminates INSIDE the control plane, so anything in front must be L4/passthrough.
agent:
  enabled: false
  # publicUrl: agent.nook.example.com:8081
  # tlsSecret: nook-agent-tls