fix(cipher-api): PORT env mismatch causes permanent unhealthy (415 failing streak) by POWERFULMOVES · Pull Request #2357 · POWERFULMOVES/PMOVES.AI

POWERFULMOVES · 2026-08-03T15:14:39Z

Summary

cipher-api has been unhealthy for 3+ hours with a 415-streak healthcheck failure. Root cause: the ByteRover upstream Dockerfile hardcodes PORT=3000, but PMOVES compose sets only PMOVES_PORT=8105 — which the upstream code ignores. The CMD (node ... --port $PORT) reads $PORT, so the app listens on :3000 inside the container while:

The healthcheck probes :8105 (always connection refused)
The port mapping binds host 8105 → container 8105 (nothing there)
All downstream references (CIPHER_URL, CIPHER_MCP_URL, CIPHER_MEMORY_URL) use :8105

Fix: Add PORT=8105 as a compose env override in both docker-compose.yml and docker-compose.agents.yml. This aligns the app's listen port with the healthcheck, port mapping, and all downstream service references.

This is z890-Claude's #1 blocker — "the memory stack is one service short, cipher-api is unhealthy so the write path isn't provable end-to-end."

1-line fix per file, backwards-compatible, no secrets.

💘 Generated with Crush

cipher-api was unhealthy (415 failing streak) because the ByteRover upstream Dockerfile hardcodes PORT=3000, but the PMOVES compose sets PMOVES_PORT=8105 (which the upstream code ignores). The CMD reads $PORT, so the app listened on :3000 inside the container while the healthcheck probed :8105 and the port mapping bound host 8105 to container 8105. Adding PORT=8105 as a compose env override aligns the app's listen port with the healthcheck, port mapping, and all downstream service references (CIPHER_URL, CIPHER_MCP_URL, CIPHER_MEMORY_URL all use :8105). 💘 Generated with Crush Assisted-by: Crush:glm-5.2

coderabbitai · 2026-08-03T15:14:48Z

Warning

Review limit reached

@POWERFULMOVES, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 17 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3fa7fa7e-7841-422f-9c58-aa1840ea9c0f

📥 Commits

Reviewing files that changed from the base of the PR and between bf317e4 and d3c6aa5.

📒 Files selected for processing (2)

pmoves/docker-compose.agents.yml
pmoves/docker-compose.yml

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-03T15:15:14Z

Docker Hardening Validation

Hardening Validation Report

Validated: Mon Aug 3 15:15:13 UTC 2026

Services Checked

PMOVES.AI Docker Hardening Validation

[INFO] Checking: pmoves/docker-compose.hardened.yml

[INFO] Validating: hi-rag-gateway-v2
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: extract-worker
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: langextract
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: presign
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: render-webhook
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: retrieval-eval
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pdf-ingest
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: jellyfin-bridge
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: invidious-companion-proxy
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: ffmpeg-whisper
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-video
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-audio
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-v2-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: deepresearch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supaserch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: publisher-discord
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: mesh-agent
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-req
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-res
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: comfy-watcher
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: grayjay-plugin-host
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: agent-zero
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: p7-room-orchestrator
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: archon
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: channel-monitor
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pmoves-yt
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: notebook-sync
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supabase_service_role_key
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

[INFO] Validating: supabase_jwt_secret
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

[INFO] Validating: p7_control_token
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

======================================
Summary: 112 passed, 43 warnings, 0 errors

Regenerated via make compose-split. cipher-api PORT=8105 fix (#2357) confirmed present in both source and generated agents overlay — survives secrets-funnel (funnel only touches env files, not compose). 💘 Generated with Crush Assisted-by: Crush:glm-5.2

POWERFULMOVES merged commit 7698608 into main Aug 3, 2026
30 checks passed

POWERFULMOVES deleted the fix/cipher-api-port-mismatch branch August 3, 2026 15:14

github-actions Bot added the compose Compose files / service Dockerfiles label Aug 3, 2026

This was referenced Aug 3, 2026

chore(make): add up-cipher-nobuild target #2361

Merged

chore(compose): sync split overlays (PORT=8105 confirmed durable) #2364

Merged

Navigation Menu

fix(cipher-api): PORT env mismatch causes permanent unhealthy (415 failing streak) - #2357

fix(cipher-api): PORT env mismatch causes permanent unhealthy (415 failing streak)#2357
POWERFULMOVES merged 1 commit into
mainfrom
fix/cipher-api-port-mismatch

POWERFULMOVES commented Aug 3, 2026

Uh oh!

coderabbitai Bot commented Aug 3, 2026

Review limit reached

Uh oh!

Uh oh!

github-actions Bot commented Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

POWERFULMOVES commented Aug 3, 2026

Summary

Uh oh!

coderabbitai Bot commented Aug 3, 2026

Review limit reached

Uh oh!

Uh oh!

github-actions Bot commented Aug 3, 2026

Docker Hardening Validation

Hardening Validation Report

Validated: Mon Aug 3 15:15:13 UTC 2026

Services Checked

PMOVES.AI Docker Hardening Validation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant