fix(openroom): 758 restarts because nginx pointed at the P7 definition nobody starts - #2922
POWERFULMOVES wants to merge 2 commits into
Conversation
…n nobody starts
pmoves-openroom had restarted 758 times. nginx aborts at startup:
[emerg] host not found in upstream "p7-room-orchestrator:8120"
Measured on pmoves_app before this change:
p7:8120 -> 200
p7-room-orchestrator:8120 -> 000
The name is not invented. docker-compose.yml defines P7 TWICE, and both build
from the SAME file, services/p7-room-orchestrator/Dockerfile:
~3813 p7 -> container pmoves-p7 RUNNING
~4310 p7-room-orchestrator -> container pmoves-p7-room-orchestrator never started
openroom's nginx (PMOVES-OpenRoom apps/webuiapps/nginx/default.conf:24) targets
the second one. This compose file's own comment twelve lines below says the
proxy targets `p7:8120`. Two definitions of one service, and the consumers
disagree about the name.
Adds `p7-room-orchestrator` as a network alias on the service that actually
runs, so both names resolve. Chosen over the source fix because the nginx conf
is baked in at image build: correcting it needs a submodule PR, an image
rebuild and a gitlink bump, three cross-repo steps while the container keeps
looping. The alias stops it now with no rebuild.
This is a STOPGAP and the comment says so. The real defect is the duplicate
definition; deduplicating it is a separate change with a much larger blast
radius, and this must not be read as blessing two names for one service.
Verified after:
p7:8120 and p7-room-orchestrator:8120 -> both 200
pmoves-openroom -> Up, RestartCount 0 (was 774)
http://localhost:5173/webuiapps/ -> 200 (app serving)
/api/p7/ proxy -> reaches p7 (404 FROM p7, not a
dead upstream; nginx starts)
docker compose config -> rc=0
inject_pmoves_networks.py --check -> rc=0
Known Road: compose:handoff:network-planes-and-package-sharing-2026-09-03.md
(operator-granted; recorded in known-roads.jsonl).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X9mpK1ZFjexjthZbvcb94f
|
Important Review skippedAuto reviews are limited based on label configuration. 🏷️ Required labels (at least one) (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Docker Hardening ValidationHardening Validation ReportValidated: Fri Sep 4 03:44:12 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: p7-room-orchestrator [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret [INFO] Validating: p7_control_token ====================================== |
github-actions
Bot
added
compose
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 96017f842a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Reverts the network alias from the previous commit. Review was right that it is worse than the bug it fixed. p7-room-orchestrator is not a dead name -- it is a REAL service that the `agents` and `orchestration` profiles start, on pmoves_app, listening on 8122: p7 8120 ui profile <- the one that runs here p7-room-orchestrator 8122 agents, orchestration <- started by up-agents Aliasing p7 to that name on pmoves_app puts TWO containers behind one DNS name whenever the agents profile is active, which it is on this node. Docker would round-robin, openroom connects on :8120, and roughly half of those requests would reach a container that does not listen there. Intermittent 502s are strictly harder to diagnose than the clean crash loop I was trying to fix. The fix belongs in the config that names the upstream, not in DNS. Done in PMOVES-OpenRoom (fix/p7-upstream-deferred-resolution): a variable in proxy_pass defers resolution to request time, so nginx starts even when the upstream is absent and degrades to a 502 on one route instead of aborting the process. Verified with nginx -t on a network with no p7 present -- old config emerg, new config ok. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X9mpK1ZFjexjthZbvcb94f
|
Closing: this PR's diff against main is empty (0 files) — the nginx/p7-alias fix it carries already landed on main through another commit, so there is nothing left to merge. Found while driving the room-PR queue to land (operator: 'open room prs need to land so i can view room'). The fork-side half remains open at PMOVES-OpenRoom#5 and is being handled there. |
…nx p7 fixes) (#2949) PMOVES-OpenRoom 81ca6f58f -> 162d573f4 (merge of fix/docker-build-node-env into PMOVES.AI-Edition-Hardened). Three fixes the room view needs: - Dockerfile: pnpm i --prod=false — NODE_ENV=production was stripping devDependencies workspace-wide, so vite was absent and the frozen install completed green while leaving no build toolchain - nginx upstream: p7-room-orchestrator:8120 -> :8122 — the session endpoint (POST /rooms/{id}/session) lives only on the legacy orchestrator, route-verified against both services' openapi.json - nginx rooms location: drop try_files under regex+alias ($uri keeps the original request path, so every manifest 404'd despite files present; measured: all 13 rooms 404 pre-fix) Companion parent-side fix (nginx P7 alias) already on main — PR #2922 closed as its diff was empty. Operator: room PRs need to land so the room is viewable. Co-authored-by: Agent Zero <agent.zero@pmoves.ai>
1 participant
758 restarts
pmoves-openroomwas crash-looping. nginx aborts at startup:Measured on
pmoves_app:The name isn't invented — P7 is defined twice
docker-compose.ymlhas two definitions, both building from the sameservices/p7-room-orchestrator/Dockerfile:p7pmoves-p7p7-room-orchestratorpmoves-p7-room-orchestratoropenroom's nginx (
PMOVES-OpenRoom apps/webuiapps/nginx/default.conf:24) targets the second. This compose file's own comment twelve lines below says the proxy targetsp7:8120. Two definitions of one service, and the consumers disagree about the name.Why an alias and not the source fix
The nginx conf is baked in at image build. Correcting it needs a submodule PR + image rebuild + gitlink bump — three cross-repo steps while the container keeps looping. The alias stops it now with no rebuild.
This is a stopgap and the comment in the file says so. The real defect is the duplicate definition; deduplicating is a separate change with a much larger blast radius. Do not read this as blessing two names for one service.
Verified
Known Road:
compose:handoff:network-planes-and-package-sharing-2026-09-03.md(operator-granted, recorded inknown-roads.jsonl).🤖 Generated with Claude Code
https://claude.ai/code/session_01X9mpK1ZFjexjthZbvcb94f