README.md

# cursor-agent-api-proxy

OpenAI-compatible HTTP API wrapping `cursor-agent` via **ACP** (`agent acp`). Deployed on **node4-k3s**.

- **Image**: `dcr.trinitysan.by/infra/cursor-agent-api-proxy`
- **Deploy**: `deploy/` (PVC, Deployment, Service, ServiceExport)
- **Flux image automation**: `flux/` (ImageRepository / ImagePolicy / ImageUpdateAutomation)

Infra on node4 keeps thin Flux glue (Namespace, SecretAdapters, `GitRepository`, Kustomizations) in `infrastructure/node4-k3s/131-cursor-agent-api.yaml`. Public HTTPS + Authentik live on node2 (`245-authentik-cursor-agent-api`).

## Access

| Endpoint | Detail |
|----------|--------|
| Public | `https://cursor-api.trinitysan.by` (Authentik outpost on node2) |
| In-cluster / MCS | `cursor-agent-api.cursor-agent-api.svc.clusterset.local:4646` |
| Health | `GET /health` |

## CI

Gitea Actions (`.gitea/workflows/build-and-push.yaml`) on `master` and `workflow_dispatch` pushes:

| Tag | Purpose |
|-----|---------|
| `:latest` | Convenience |
| `:<git-sha>` | Immutable full SHA |
| `:<run_number>-<git-sha>` | Sortable; elected by Flux ImagePolicy |

Repo (or org) secrets: `DCR_USERNAME`, `DCR_PASSWORD` for DCR push (set on `infra/cursor-agent-api-proxy` if org secrets are not inherited).

## Local build / E2E

```bash
docker build -t cursor-agent-api-proxy:latest .
# Requires CURSOR_API_KEY in env or .env
./scripts/e2e-docker.sh
```

## Flux update flow

1. CI pushes `run_number-sha` to DCR
2. ImageRepository scans; ImagePolicy picks highest `run_number`
3. ImageUpdateAutomation commits the new tag into `deploy/010-cursor-agent-api.yaml`
4. Kustomization applies; Deployment rolls

Requires a Gitea PAT with **read+write** on this repo (`GITEA_CURSOR_AGENT_API_GITOPS_TOKEN` on node4, see infra `060-external-secrets.yaml.template`).
Initial segregate: proxy source, deploy manifests, ImagePolicy Flux CRs. 2026-09-21 10:31:36 +03:00			`# cursor-agent-api-proxy`

			OpenAI-compatible HTTP API wrapping `cursor-agent` via ACP (`agent acp`). Deployed on node4-k3s.

			- Image: `dcr.trinitysan.by/infra/cursor-agent-api-proxy`
			- Deploy: `deploy/` (PVC, Deployment, Service, ServiceExport)
			- Flux image automation: `flux/` (ImageRepository / ImagePolicy / ImageUpdateAutomation)

			Infra on node4 keeps thin Flux glue (Namespace, SecretAdapters, `GitRepository`, Kustomizations) in `infrastructure/node4-k3s/131-cursor-agent-api.yaml`. Public HTTPS + Authentik live on node2 (`245-authentik-cursor-agent-api`).

			`## Access`

			`\| Endpoint \| Detail \|`
			`\|----------\|--------\|`
			\| Public \| `https://cursor-api.trinitysan.by` (Authentik outpost on node2) \|
			\| In-cluster / MCS \| `cursor-agent-api.cursor-agent-api.svc.clusterset.local:4646` \|
			\| Health \| `GET /health` \|

			`## CI`

			Gitea Actions (`.gitea/workflows/build-and-push.yaml`) on `master` and `workflow_dispatch` pushes:

			`\| Tag \| Purpose \|`
			`\|-----\|---------\|`
			\| `:latest` \| Convenience \|
			\| `:<git-sha>` \| Immutable full SHA \|
			\| `:<run_number>-<git-sha>` \| Sortable; elected by Flux ImagePolicy \|

Document DCR Actions secrets requirement for image CI. 2026-09-21 11:09:12 +03:00			Repo (or org) secrets: `DCR_USERNAME`, `DCR_PASSWORD` for DCR push (set on `infra/cursor-agent-api-proxy` if org secrets are not inherited).
Initial segregate: proxy source, deploy manifests, ImagePolicy Flux CRs. 2026-09-21 10:31:36 +03:00
			`## Local build / E2E`

			```bash
			`docker build -t cursor-agent-api-proxy:latest .`
			`# Requires CURSOR_API_KEY in env or .env`
			`./scripts/e2e-docker.sh`
			```

			`## Flux update flow`

			1. CI pushes `run_number-sha` to DCR
			2. ImageRepository scans; ImagePolicy picks highest `run_number`
			3. ImageUpdateAutomation commits the new tag into `deploy/010-cursor-agent-api.yaml`
			`4. Kustomization applies; Deployment rolls`

			Requires a Gitea PAT with read+write on this repo (`GITEA_CURSOR_AGENT_API_GITOPS_TOKEN` on node4, see infra `060-external-secrets.yaml.template`).