feat(deploy): bake config.yaml into image + auto-migrate MCP to DB

Production deploys no longer need to mount a config directory — config.yaml
is now a Docker image artifact, supplying bootstrap defaults only. Secrets
still come from env vars; dynamic settings (routing, prompts, slot models,
MCP servers, feature flags) live in kv_settings.

First-boot MCP migration: when the DB key cfg.mcp.servers is empty and
config/mcp.json exists, the bot writes the file contents to the DB. Next
restart can run with that mount removed too.

Repo config/config.yaml is updated to match the trimmed deploy version
(7 named slots, no redundant base_urls, no ollama inference slot) so the
baked defaults reflect the current production shape.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Alexey Panfilov

Dockerfile

@@ -40,5 +40,10 @@ RUN apk add --no-cache ca-certificates tzdata
 WORKDIR /app
 
 COPY --from=builder /app/bin/agent .
+# Bake the default config.yaml into the image. Production deploys no longer
+# need to mount a config directory — secrets come from env, dynamic settings
+# live in kv_settings, and this file supplies the bootstrap defaults. For dev
+# you can still mount over it via volumes.
+COPY --from=builder /app/config/config.yaml ./config/config.yaml
 
 ENTRYPOINT ["./agent"]

cmd/agent/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"log/slog"
 	"os"
 	"os/signal"
@@ -231,12 +232,15 @@ func main() {
 
 	// Init MCP client. DB (kv_settings) wins over the legacy mcp.json file —
 	// the admin UI writes there, so any user-edited list is authoritative.
+	// On first boot with an empty DB, the file is auto-migrated so the next
+	// restart can run with the config.yaml volume unmounted.
 	var mcpClient *mcp.Client
 	var mcpServers map[string]config.MCPServerConfig
 	var mcpSource string
-	if ss, ok := s.(llm.SettingsStore); ok {
+	settingsStoreEarly, _ := s.(llm.SettingsStore)
+	if settingsStoreEarly != nil {
 		mcpCtx, mcpCancel := context.WithTimeout(context.Background(), 3*time.Second)
-		if dbServers, found, dbErr := adminapi.LoadMCPServersFromSettings(mcpCtx, ss); dbErr != nil {
+		if dbServers, found, dbErr := adminapi.LoadMCPServersFromSettings(mcpCtx, settingsStoreEarly); dbErr != nil {
 			logger.Warn("failed to load MCP servers from DB; falling back to file", "err", dbErr)
 		} else if found {
 			mcpServers = dbServers
@@ -252,6 +256,19 @@ func main() {
 		mcpServers = fileServers
 		if fileServers != nil {
 			mcpSource = "file"
+			// Auto-migrate: write the file contents to kv_settings so future
+			// boots don't depend on the file being present.
+			if settingsStoreEarly != nil {
+				migCtx, migCancel := context.WithTimeout(context.Background(), 3*time.Second)
+				if data, mErr := json.Marshal(fileServers); mErr == nil {
+					if pErr := settingsStoreEarly.PutSetting(migCtx, adminapi.SettingKeyMCPServers, string(data)); pErr != nil {
+						logger.Warn("MCP auto-migration failed", "err", pErr)
+					} else {
+						logger.Info("MCP config auto-migrated file → DB", "servers", len(fileServers))
+					}
+				}
+				migCancel()
+			}
 		}
 	}
 	logger.Info("MCP config loaded", "servers", len(mcpServers), "source", mcpSource)

config/config.yaml

@@ -4,105 +4,81 @@ telegram:
     - ${TELEGRAM_OWNER_CHAT_ID}
   owner_chat_id: ${TELEGRAM_OWNER_CHAT_ID}
 
-# Each entry's KEY is its routing name (referenced from `routing.*` below).
-# Each entry's `provider` field selects the backend implementation.
-# Known providers: openrouter, gemini, ollama, claude-bridge, local, hf-tei, openai.
-# The key "embedding" is reserved for the MCP embedding provider.
+# Each entry's KEY is its routing name. `provider` field selects the backend
+# TYPE and the initial credentials; at runtime, the admin UI can swap both
+# the provider type AND the model for any slot (via BuildBackendFactories).
+#
+# base_url is omitted for openrouter/gemini/claude-bridge/ollama — those
+# have built-in defaults (llm.ApplyProviderDefaults). Override via env vars:
+#   OPENROUTER_BASE_URL, CLAUDE_BRIDGE_URL, OLLAMA_BASE_URL.
 models:
-  # --- OpenRouter slots — one per role so each can be reassigned independently
-  #     from the admin UI. Initial models are suggestions; override via UI. ---
-  simple-or:
+  # --- One slot per routing role. Admin UI picks provider+model per slot. ---
+  simple:
     provider: openrouter
-    model: qwen/qwen3.5-flash-02-23        # V T R, 1M ctx, $0.065/$0.26
+    model: qwen/qwen3.5-flash-02-23
     api_key: ${OPENROUTER_API_KEY}
     max_tokens: 2048
-    base_url: https://openrouter.ai/api/v1
-
-  default-or:
+  default:
     provider: openrouter
-    model: qwen/qwen3.5-flash-02-23        # same as simple initially; diverge in UI
+    model: qwen/qwen3.5-flash-02-23
     api_key: ${OPENROUTER_API_KEY}
     max_tokens: 4096
-    base_url: https://openrouter.ai/api/v1
-
-  complex-or:                              # alt to claude-bridge if bridge is off
-    provider: openrouter
-    model: qwen/qwen3-235b-a22b-thinking-2507
-    api_key: ${OPENROUTER_API_KEY}
-    max_tokens: 8192
-    base_url: https://openrouter.ai/api/v1
-
-  compaction-or:
+  complex:
+    provider: claude-bridge
+    api_key: ${CLAUDE_BRIDGE_TOKEN}
+    max_tokens: 120
+  classifier:
+    provider: gemini
+    model: gemini-2.5-flash-lite
+    api_key: ${GEMINI_API_KEY}
+    max_tokens: 64
+  compaction:
     provider: openrouter
-    model: qwen/qwen3.5-9b                 # min workable, 262k ctx, $0.10/$0.15
+    model: qwen/qwen3.5-9b
     api_key: ${OPENROUTER_API_KEY}
     max_tokens: 2048
-    base_url: https://openrouter.ai/api/v1
-
-  # --- Gemini (direct Google API) — fallback + multimodal/transcription. ---
-  gemini-flash-lite:
+  fallback:
     provider: gemini
-    model: gemini-3.1-flash-lite-preview
+    model: gemini-2.5-flash-lite
     api_key: ${GEMINI_API_KEY}
     max_tokens: 2048
-    base_url: https://generativelanguage.googleapis.com/v1beta/openai/
-  gemini-flash:
+  multimodal:
     provider: gemini
-    model: gemini-3-flash-preview
+    model: gemini-2.5-flash
     api_key: ${GEMINI_API_KEY}
     max_tokens: 4096
-    base_url: https://generativelanguage.googleapis.com/v1beta/openai/
 
-  # --- MCP embedding (hf-tei self-hosted). ---
+  # --- Embedding (hf-tei in memory-embeddings container). Not an LLM slot. ---
   embedding:
     provider: hf-tei
-    base_url: https://embed.dzarlax.dev   # or http://embed-service:8080 in Docker
-    api_key: ${EMBED_API_KEY}             # format: "user:password" for Basic Auth
-
-  # --- Local Ollama — cheap fast classifier on host GPU. ---
-  classifier:
-    provider: ollama
-    model: qwen3:0.6b
-    base_url: http://host.docker.internal:11434
-    max_tokens: 64
-    no_think: true
-
-  # --- Claude via host-side bridge (wraps `claude -p` CLI). ---
-  claude-bridge:
-    provider: claude-bridge
-    base_url: http://host.docker.internal:9900
-    api_key: ${CLAUDE_BRIDGE_TOKEN}
-    max_tokens: 120
+    base_url: http://memory-embeddings:80
 
 routing:
-  simple: simple-or
-  default: default-or
-  complex: claude-bridge         # via Anthropic Max subscription (host bridge)
-  compaction: compaction-or
-  fallback: gemini-flash-lite    # DIRECT Google — different vendor, survives OR outage
-  multimodal: gemini-flash       # DIRECT Google — native input_audio for voice
-  classifier: classifier         # local Ollama
+  simple: simple
+  default: default
+  complex: complex
+  compaction: compaction
+  fallback: fallback
+  multimodal: multimodal
+  classifier: classifier
   classifier_timeout: 15
-  classifier_min_length: 0       # 0 = always; >0 = min chars; <0 = disabled
+  classifier_min_length: 0
 
 tool_filter:
   top_k: 20
 
 # Web search — gives LLM access to real-time web results.
 # provider: "tavily" (free 1000/mo, LLM-ready answer+sources) or "ollama" (Ollama Cloud).
-# Get Tavily key at app.tavily.com (no card required for free tier).
 web_search:
   enabled: true
   provider: tavily
   api_key: ${TAVILY_API_KEY}
 
 # Web fetch — extract main article text from a URL.
-# Primary: HTTP GET + go-readability (no cost, no API key).
-# Fallback: headless Chrome via CDP (for JS-heavy / bot-protected sites).
-# Leave cdp_url empty to disable fallback.
+# Primary: HTTP GET + go-readability. Fallback: shared infra-chrome (CDP).
 web_fetch:
   enabled: true
-  cdp_url: ${WEB_FETCH_CDP_URL:-}
+  cdp_url: http://infra-chrome:9222
 
 # Filesystem access — gives the assistant read/write access to a local directory.
 # Mount the directory into the container via volumes in docker-compose.yml.
@@ -122,14 +98,15 @@ voice_api:
   token: ${VOICE_API_TOKEN}
   chat_id: 9999
 
-# Admin web UI — browse OpenRouter models, assign to slots, edit routing roles.
-# Auth priority: authentik forward-auth (if trust_forward_auth) → cookie → bearer.
-# When running behind Traefik with an Authentik middleware, set trust_forward_auth: true
-# and let the middleware handle access control.
+# Admin web UI — behind Traefik + Authentik.
 admin_api:
-  enabled: ${ADMIN_API_ENABLED:-false}
+  enabled: true
   listen: ":8087"
   token: ${ADMIN_API_TOKEN}
-  trust_forward_auth: ${ADMIN_TRUST_FORWARD_AUTH:-false}
+  trust_forward_auth: true
   forward_auth_header: X-authentik-username
-  base_url: ${ADMIN_API_BASE_URL}
+  base_url: https://assistant.dzarlax.dev
+
+# Artificial Analysis API — overlays Intelligence Index scores onto model capabilities.
+# Register at artificialanalysis.ai → API Keys. Free tier: 1000 req/day.
+artificial_analysis_api_key: ${AA_API_KEY}