feat(make): add overlay-up-bus — NATS-only bring-up without CHIT passphrase - #1813
Conversation
|
Caution Review failedPull request was closed or merged during review No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughA new Make target ChangesNATS Bus-Only Overlay Target
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…phrase
`make up-bus` uses $(DC), which includes STACK_FILES (the monolith
docker-compose.yml + GPU overlays). docker compose resolves every required
variable across the whole merged project at parse time, so the fail-fast
${CHIT_PROD_PASSPHRASE:?...} guard on the CHIT app services (agent-zero,
evo-controller, hi-rag-gateway-gpu) blocks even a single-service `up -d nats`
on any node that does not hold the voice-activated CHIT passphrase (e.g.
kvm4-2, the canonical NATS hub — currently down fleet-wide for this reason).
Rather than weaken that fail-fast guard across ~19 service definitions in four
protected compose files (a fleet-wide security regression that would let CHIT
services boot with an empty passphrase), this reuses the existing split-overlay
system: OVERLAY_DC layers only docker-compose.base.yml + docker-compose.core.yml
(neither carries the passphrase guard; core.yml's nats uses
${NATS_USER:-nats}/${NATS_PASSWORD:-pmoves} defaults) and starts just
nats + nats-init.
Validated: `docker compose -f base -f core config` parses cleanly with NO real
env files present (only .example), i.e. without the voice passphrase — exit 0,
nats/nats-init present, no passphrase error. The fleet-wide fail-fast guards are
left fully intact.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
f36a85f to
01c57e4
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 01c57e4632
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # up cleanly with the fleet-wide fail-fast guards left fully intact. | ||
| overlay-up-bus: ## Start ONLY the NATS event bus via overlay (no CHIT passphrase / no app services) | ||
| @echo "📨 Starting NATS event bus via overlay (base+core, bus-only)..." | ||
| @$(OVERLAY_DC) $(OVERLAY_CORE) up -d nats nats-init |
There was a problem hiding this comment.
On a clean/CHIT-less node that only has the .example env files, this command still aborts before starting NATS: docker-compose.core.yml has nats inherit service-level env_file: env.shared and env.tier-data (core.yml lines 11-14). The Makefile's --env-file env.shared.example only supplies Compose interpolation and does not satisfy those container env_file paths; Docker documents those entries as required by default (required: true # default), so up fails with a missing env-file error in exactly the fresh-worktree scenario this target is meant to support. Use an override that makes these env_files optional for the bus-only path or create/copy the real files before invoking Compose.
Useful? React with 👍 / 👎.
… check-gate) (#1826) Adds a manual deploy job that brings up / restarts the NATS event bus on the canonical fleet hub (kvm4-2) without interactive SSH — sidestepping the Tailscale check-mode re-auth gate (#1820) that now fronts all fleet SSH. - Targets the kvm4-2 runner via the node-unique `kvm4-2` label just added to it (both VPS runners share `kvm4`, so that label alone can't pin the node). - Operates on the durable /opt/PMOVES.AI checkout, reusing the env chain + pmoves_external network already provisioned there; NATS creds are static `:-` defaults so no secrets are needed. - Idempotently ensures the external-declared pmoves_external network exists, then runs `make overlay-up-bus` (the guard-preserving target from #1813) and verifies varz over the node tailnet IP (NATS_BIND is mesh-only, not localhost). - Uses only `run:` steps (no `uses:`) → exempt from the sha-pinning gate. Companion to #1813 (overlay-up-bus) and #1824 (multi-home nats on pmoves_external). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 participant
Problem
NATS is down fleet-wide because
pmoves-kvm4-2(the canonical NATS hub,nats.pmoves.ai) can't bring it up.make up-bususes$(DC), which includesSTACK_FILES(the monolithdocker-compose.yml+ GPU overlays).docker composeresolves every required variable across the whole merged project at parse time, so the fail-fast${CHIT_PROD_PASSPHRASE:?...}guard on the CHIT app services (agent-zero,evo-controller,hi-rag-gateway-gpu) aborts even a single-serviceup -d natson any node that doesn't hold the voice-activated CHIT passphrase — which kvm4-2 doesn't.Why not just weaken the guard
The guard is a deliberate fail-fast on ~19 service definitions across 4 protected compose files. Converting
:?→:-would let CHIT services boot with an empty passphrase on any under-provisioned node — a fleet-wide security regression — to solve a node-local bring-up problem. Rejected.Fix
Reuse the split-overlay system the repo already ships.
OVERLAY_DClayers onlydocker-compose.base.yml+docker-compose.core.yml:${CHIT_PROD_PASSPHRASE:?}guard (it lives only in the monolith + agents/media overlays).core.yml'snatsuses${NATS_USER:-nats}/${NATS_PASSWORD:-pmoves}defaults (fleet-consistent static creds).base.ymlprovides the networks + thesupabase-storage-datavolume that broke earlier core-only attempts.New target starts only
nats+nats-init. The fleet-wide fail-fast guards are left fully intact.Validation
From a fresh worktree with no real env files (only
.example— an unprovisioned-node stand-in, no voice passphrase):make -n overlay-up-busexpands to:Follow-up (not in this PR)
make overlay-up-buson kvm4-2 once merged + pulled → NATS up on :4222, restoring the fleet bus (p7 launch / chit.signed / geometry bus / branch-trail emitter).🤖 Generated with Claude Code
Summary by CodeRabbit