Run it for real

Step 1 Fork the repo

Fork Last Light so you can customize skills, tweak prompts, and track your own changes. Pull upstream updates whenever you want.

# Fork on GitHub first, then clone your fork
git clone https://github.com/YOUR-USERNAME/lastlight.git
cd lastlight

# Add upstream so you can pull updates later
git remote add upstream https://github.com/cliftonc/lastlight.git

Your skills, deployment config, and Dockerfile are yours to modify. The skills/ directory is where all the behavior lives — edit freely.

Step 2 Configure secrets

All secrets live in a secrets/ directory that's gitignored and mounted read-only into the container.

# Copy the environment template
cp .env.example secrets/.env

# Place your GitHub App private key
cp ~/path-to/your-app.private-key.pem secrets/

Edit secrets/.env with your:

• GitHub App credentials — App ID, Installation ID, and private key path
• Webhook secret — must match your GitHub App's webhook settings
• Domain — your public hostname for automatic TLS (or localhost for dev)
• Anthropic API key — for Claude API access (or use claude login for subscription-based auth)
• Model overrides (optional) — CLAUDE_MODELS as JSON to route architect/executor/reviewer phases to different models
• Approval gates (optional) — APPROVAL_GATES=post_architect,post_reviewer to pause at human-in-the-loop checkpoints
• Admin dashboard (recommended) — ADMIN_PASSWORD and a stable ADMIN_SECRET for persistent login sessions
• Slack chat (optional) — SLACK_BOT_TOKEN and SLACK_APP_TOKEN for the in-process chat skill (Socket Mode)
• Slack OAuth login (optional) — SLACK_OAUTH_CLIENT_ID, SLACK_OAUTH_CLIENT_SECRET, SLACK_OAUTH_REDIRECT_URI, and optionally SLACK_ALLOWED_WORKSPACE to restrict login to one team

See the Configuration reference for every variable the harness reads, with defaults and descriptions.

Step 3 Build & run

The Docker image is self-contained — Claude Code CLI, the MCP server, all skills, and dependencies are baked in. Secrets are injected at runtime via the mounted volume.

# Set your public domain (for Caddy TLS)
export DOMAIN=lastlight.example.com

# Build and start
docker compose up -d

# Watch the logs
docker compose logs -f agent

If this is your first time, log in to Claude Code inside the container:

# One-time auth — persists in the Docker volume
docker exec -it lastlight-agent-1 claude login

Follow the URL in your browser to authenticate. The auth token survives container restarts and rebuilds.

What happens:

• Agent container starts, symlinks your secrets, generates a GitHub token, and starts the webhook listener on port 8644
• Caddy container provisions a Let's Encrypt certificate for your domain and reverse-proxies HTTPS to the agent
• For local dev, set DOMAIN=localhost — Caddy serves HTTP only, no TLS

Verify it's running:

# Health check
curl https://lastlight.example.com/health

# Or locally
curl http://localhost/health

# docker-compose.override.yml
services:
  agent:
    ports:
      - "127.0.0.1:8644:8644"
  caddy:
    profiles:
      - disabled

lastlight.example.com {
    reverse_proxy localhost:8644
}

server {
    listen 443 ssl;
    server_name lastlight.example.com;
    location / {
        proxy_pass http://127.0.0.1:8644;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Step 4 Point GitHub webhooks

In your GitHub App settings, set the webhook URL and subscribe to events.

• Webhook URL: https://lastlight.example.com/webhooks/github
• Secret: same value as WEBHOOK_SECRET in your secrets/.env
• Events: Issues, Pull requests, Issue comments, PR review comments, PR reviews

Install the GitHub App on the repos (or org) you want Last Light to manage. Test by opening an issue — the bot should triage it within seconds.

Step 5 Running in Kubernetes optional

The same Docker image works in K8s. Skip Caddy — use your cluster's Ingress controller for TLS instead.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: lastlight
spec:
  replicas: 1
  selector:
    matchLabels:
      app: lastlight
  template:
    metadata:
      labels:
        app: lastlight
    spec:
      containers:
      - name: agent
        image: your-registry/lastlight:latest
        ports:
        - containerPort: 8644
        volumeMounts:
        - name: secrets
          mountPath: /opt/lastlight/secrets
          readOnly: true
        - name: state
          mountPath: /opt/lastlight/sessions
      volumes:
      - name: secrets
        secret:
          secretName: lastlight-secrets
      - name: state
        persistentVolumeClaim:
          claimName: lastlight-state
---
apiVersion: v1
kind: Service
metadata:
  name: lastlight
spec:
  selector:
    app: lastlight
  ports:
  - port: 8644
    targetPort: 8644

Create the K8s Secret from your local files: kubectl create secret generic lastlight-secrets --from-file=.env=secrets/.env --from-file=your-app.pem=secrets/your-app.private-key.pem