Рабочий вариант

docker-compose.yml

@@ -42,13 +42,17 @@ services:
       RAG_DB_DSN: "postgresql://${POSTGRES_USER:-rag}:${POSTGRES_PASSWORD:-rag_secret}@postgres:5432/${POSTGRES_DB:-rag}"
       # In container repo is always at /data (mounted below). Use RAG_REPO_HOST in .env for host path.
       RAG_REPO_PATH: "/data"
-      RAG_EMBEDDINGS_DIM: ${RAG_EMBEDDINGS_DIM:-1536}
+      # Accept host key on first connect; git fetch uses SSH from /root/.ssh (mounted below).
+      GIT_SSH_COMMAND: "ssh -o StrictHostKeyChecking=accept-new"
+      RAG_EMBEDDINGS_DIM: ${RAG_EMBEDDINGS_DIM:-1024}
       GIGACHAT_CREDENTIALS: ${GIGACHAT_CREDENTIALS:-}
       GIGACHAT_EMBEDDINGS_MODEL: ${GIGACHAT_EMBEDDINGS_MODEL:-Embeddings}
       WEBHOOK_SECRET: ${WEBHOOK_SECRET:-}
     volumes:
       # Host path: set RAG_REPO_HOST in .env (e.g. /Users/you/repo). Falls back to RAG_REPO_PATH then ./data.
       - ${RAG_REPO_HOST:-${RAG_REPO_PATH:-./data}}:/data
+      # SSH for git fetch (webhook): put deploy key and known_hosts in RAG_SSH_DIR. See docker/ssh/README.md.
+      - ${RAG_SSH_DIR:-./docker/ssh}:/root/.ssh:ro
     entrypoint: ["rag-agent"]
     command: ["serve", "--host", "0.0.0.0", "--port", "8000"]
     networks: