# Dokploy deployment

RedditBot now uses extension dumps as its only account-authentication path. The container does not expose VNC, start Google Chrome, submit Reddit credentials, or sniff Matrix tokens.

## Environment

Configure only the application secrets required by the Compose file:

- `OPENROUTER_API_KEY`
- `WEB_DASHBOARD_TOKEN`

Optional agent credentials:

- `REDDIT_BOT_AGENT_READ_TOKEN` permits authenticated GET/SSE access but cannot mutate state.
- `REDDIT_BOT_AGENT_CONTROL_TOKEN` additionally permits versioned control and sync-job operations.

Use separate long random values. Neither agent token can invoke legacy send,
session-import, account-activation, or configuration mutations. The dashboard
token remains the administrator credential.

Do not configure Reddit usernames, passwords, display servers, CDP endpoints, or remote-browser ports.

## Account activation

1. Deploy the service and open the dashboard.
2. Install the extension from `extensions/reddit-session-exporter` in your local Chrome profile.
3. Sign in to Reddit locally, open Reddit Chat, and wait for the extension badge to show `OK`.
4. Export `redditbot-session.json` and upload it under **Settings > Access**.
5. Delete the local JSON file after the dashboard verifies it.

The dump contains both Reddit cookies and a Matrix bearer token. Until both identities verify, the bot, response checks, chat, media sync, and dashboard start control remain paused. If either credential expires, import a new dump.

## Persistence

The `reddit_bot_data` volume retains the database, the imported Playwright cookie profile, and the verified Matrix credential across deployments. Back up this volume as sensitive account data.