feat(z890): NATS leaf node for multi-node Docker networking - #1034
Conversation
NATS leaf node bridges Docker bridge network to the 5090 hub via the leafnodes protocol. Solves Docker Desktop WSL2 limitation where containers cannot route to LAN/Tailscale IPs. - Add nats-leaf-z890.conf with JetStream, auth, upstream remote - Add nats-leaf service to docker-compose.z890.yml (nats:2.11.8-alpine) - Update mesh-agent with depends_on nats-leaf - Add nats-leaf-data volume for JetStream persistence Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Idempotent PowerShell script configures netsh port proxies for NATS leafnode upstream connection (Docker → host → 5090 LAN). - Add z890_host_setup.ps1 with admin check, -Verify, -Remove modes - Add Make targets: z890-host-setup, z890-host-verify, z890-host-remove - Update LOAD_ENV_Z890 to source env.z890 for correct variable layering - Update up-z890/down-z890/ps-z890/logs-z890 to use LOAD_ENV_Z890 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Docker Hardening ValidationHardening Validation ReportValidated: Thu Mar 19 21:16:45 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughAdds Z890-specific infrastructure setup including new Makefile targets for host configuration, NATS leaf node service, Docker Compose updates with environment variable precedence, and a PowerShell script for Windows host-side port proxy configuration. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 24fed2ca2a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| healthcheck: | ||
| test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8222/varz || exit 1"] |
There was a problem hiding this comment.
This health check only probes the local admin endpoint, so nats-leaf becomes healthy even when the upstream leafnode connection is still down (for example, the host portproxy was not created or 5090 is not listening on :7422). Because mesh-agent now depends on this health status, make up-z890 can start a fully green-looking stack that publishes mesh.node.announce.* into an isolated local broker and never forwards those announcements to 5090—the exact failure mode this change is meant to eliminate.
Useful? React with 👍 / 👎.
| Param( | ||
| [switch]$Remove, | ||
| [switch]$Verify, | ||
| [string]$UpstreamIP = "192.168.1.65" |
There was a problem hiding this comment.
make z890-host-setup invokes this script with its defaults, which means the generated netsh interface portproxy always targets 192.168.1.65. On any installation where the 5090 hub uses a different LAN address or must be reached over Tailscale, the advertised setup path writes a proxy to the wrong host and the leaf can never connect upstream. Since the Make target does not pass an override, this breaks the out-of-the-box flow for every non-matching network.
Useful? React with 👍 / 👎.
🌿 PR Trim — Thread Classification
Summary: Both threads are valid infrastructure improvements but require careful testing against the actual Z890 → 5090 network path. Tracked for the next infrastructure sprint rather than a quick follow-up commit. |
✅ Follow-up Fixes AppliedAll 3 noted infrastructure items addressed in commit
|
Workstream B — Z890 infrastructure (PR #1034 follow-up): - docker-compose.z890.yml: NATS leaf health check now verifies upstream leaf connection via /leafz num_remotes (not just local /varz) - z890_host_setup.ps1: upstream IP auto-detection chain (explicit param → PMOVES_5090_IP env → Tailscale DNS → hardcoded default with warning) - Makefile: z890-host-setup/verify/remove targets accept UPSTREAM_IP param Workstream A — DoX submodule pointer updated to e03ad5d: - TLS fail-closed, credential redaction, cert mount separation - Healthcheck readiness gate, NATS monitoring localhost binding - Shared nats_tls.py utility for consistent TLS across services Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 participant
Summary
nats:2.11.8-alpine) to z890 Docker compose, bridging the Docker bridge network to the 5090 NATS hub via leafnodes protocolz890_host_setup.ps1) for netsh port proxy configuration with admin checks and -Verify/-Remove modesChanges
pmoves/configs/nats-leaf-z890.confpmoves/docker-compose.z890.ymlpmoves/scripts/z890_host_setup.ps1pmoves/MakefileTest plan
make z890-host-verifyshows port 7422 proxied🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Chores