Skip to content

fix(hirag): use container DNS for Supabase realtime - #335

Merged
POWERFULMOVES merged 1 commit into
mainfrom
fix/hirag-realtime-container-dns
Dec 19, 2025
Merged

fix(hirag): use container DNS for Supabase realtime#335
POWERFULMOVES merged 1 commit into
mainfrom
fix/hirag-realtime-container-dns

Conversation

@POWERFULMOVES

@POWERFULMOVES POWERFULMOVES commented Dec 19, 2025

Copy link
Copy Markdown
Owner

Summary

  • Fixes Hi-RAG failing to connect to Supabase realtime after Docker restarts
  • Changes default SUPABASE_REALTIME_URL from host.docker.internal:65421 to supabase_kong_PMOVES.AI:8000
  • Direct container-to-container DNS resolution is more reliable in WSL2 environments

Problem

The host.docker.internal hostname resolves to Docker Desktop's gateway IP (192.168.65.254) in WSL2, which doesn't properly route to host-bound ports. This caused connection failures:

websockets.exceptions.InvalidMessage: did not receive a valid HTTP response
ERROR:hirag.gateway.v2:Supabase realtime listener error; retrying in 60.0s

Solution

Since both Hi-RAG and Supabase Kong containers are on pmoves-net, use direct container DNS:

Before After
ws://host.docker.internal:65421/realtime/v1 ws://supabase_kong_PMOVES.AI:8000/realtime/v1

Test plan

  • Verified container-to-container DNS resolves correctly
  • Tested connection with new URL returns {"message":"Success"}
  • Recreate Hi-RAG containers and verify realtime connection works

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores
    • Updated real-time service connection endpoint configuration across multiple application services for proper connectivity infrastructure alignment.

✏️ Tip: You can customize this high-level summary in your review settings.

…ocker.internal

The host.docker.internal hostname resolves to Docker Desktop's gateway IP
(192.168.65.254) in WSL2, which doesn't properly route to host-bound ports.
This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts.

Changed default SUPABASE_REALTIME_URL from:
  ws://host.docker.internal:65421/realtime/v1
to:
  ws://supabase_kong_PMOVES.AI:8000/realtime/v1

Since both containers are on pmoves-net, direct container-to-container DNS
resolution works reliably.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Dec 19, 2025

Copy link
Copy Markdown
Contributor

Walkthrough

The Supabase real-time WebSocket endpoint URL is updated from ws://host.docker.internal:65421/realtime/v1 to ws://supabase_kong_PMOVES.AI:8000/realtime/v1 across Docker Compose configurations and a service initialization script. This changes the runtime connection point for Supabase real-time services without altering logic or control flow.

Changes

Cohort / File(s) Summary
Docker Compose Configuration
pmoves/docker-compose.yml, pmoves/docker-compose.gpu-image.yml
Updated SUPABASE_REALTIME_URL environment variable across three service blocks (hi-rag-gateway, hi-rag-gateway-v2, hi-rag-gateway-v2-gpu) to point to the new Supabase Kong endpoint.
Service Initialization Script
pmoves/services/hi-rag-gateway-v2/scripts/wait-for-deps.sh
Updated default Supabase realtime WebSocket URL to align with Docker Compose configuration changes.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

These are straightforward, repetitive configuration changes affecting only environment variables across a small number of files with no functional logic modifications.

Possibly related PRs

Poem

🐰 A hop, a skip, from docker's den,
New URLs guide us once again,
From localhost to Kong we spring,
Real-time whispers on the wing! 🌐✨

Pre-merge checks and finishing touches

❌ Failed checks (1 inconclusive)
Check name Status Explanation Resolution
Description check ❓ Inconclusive The description provides a clear summary, explains the problem and solution with evidence, but omits required sections like Testing commands and Required Checks checkboxes. Add a Testing section with actual commands run, and include the Required Checks checklist from the template to fully comply with repository standards.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely summarizes the main change: using container DNS instead of host.docker.internal for Supabase realtime connections.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix/hirag-realtime-container-dns

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between a4c1f48 and b371a12.

📒 Files selected for processing (3)
  • pmoves/docker-compose.gpu-image.yml (1 hunks)
  • pmoves/docker-compose.yml (2 hunks)
  • pmoves/services/hi-rag-gateway-v2/scripts/wait-for-deps.sh (1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
pmoves/**/docker-compose.yml

📄 CodeRabbit inference engine (pmoves/AGENTS.md)

Use Compose profiles (data, workers) to scope what runs locally in docker-compose.yml

Files:

  • pmoves/docker-compose.yml
🧠 Learnings (3)
📚 Learning: 2025-12-15T12:03:17.291Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-15T12:03:17.291Z
Learning: UI updates: run make -C pmoves notebook-workbench-smoke ARGS='--thread=<uuid>' to lint the Next.js bundle and validate Supabase connectivity; reference pmoves/docs/UI_NOTEBOOK_WORKBENCH.md

Applied to files:

  • pmoves/services/hi-rag-gateway-v2/scripts/wait-for-deps.sh
📚 Learning: 2025-12-07T11:03:53.415Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: pmoves/AGENTS.md:0-0
Timestamp: 2025-12-07T11:03:53.415Z
Learning: Applies to pmoves/ui/**/*.{js,jsx,ts,tsx} : UI updates: run `make -C pmoves notebook-workbench-smoke ARGS="--thread=<uuid>"` to lint the Next.js bundle and validate Supabase connectivity; reference `pmoves/docs/UI_NOTEBOOK_WORKBENCH.md`

Applied to files:

  • pmoves/services/hi-rag-gateway-v2/scripts/wait-for-deps.sh
📚 Learning: 2025-12-15T12:02:18.878Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: pmoves/docs/ARTSTUFF/realtime/GEMINI.md:0-0
Timestamp: 2025-12-15T12:02:18.878Z
Learning: Applies to pmoves/docs/ARTSTUFF/realtime/**/*{pinokio,install,start,update,reset}.{js,json} : Preserve existing functionality and only modify necessary parts when working with existing launcher scripts

Applied to files:

  • pmoves/services/hi-rag-gateway-v2/scripts/wait-for-deps.sh
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Analyze (python)
🔇 Additional comments (4)
pmoves/docker-compose.yml (2)

572-572: Updated realtime URL uses container DNS for improved WSL2 compatibility.

The change from host.docker.internal:65421 to supabase_kong_PMOVES.AI:8000 addresses the PR objective to use container-to-container DNS. The service is correctly connected to the supabase_net (pmoves-net) network at line 583, which should enable direct communication with the Supabase Kong container.

Please verify the container name and connectivity as noted in the wait-for-deps.sh review comment.


677-677: Consistent URL update for GPU variant.

The change mirrors the update made to hi-rag-gateway-v2 at line 572. The service is properly connected to supabase_net at line 701.

Verification of container name and network connectivity (see wait-for-deps.sh comment) applies here as well.

pmoves/docker-compose.gpu-image.yml (1)

27-27: Consistent URL update across GPU image compose file.

The change aligns with updates in the main docker-compose.yml. The service is connected to the external pmoves-net network (defined as pmoves at lines 49-51), enabling container-to-container DNS resolution.

Verification of the container name and network connectivity (see wait-for-deps.sh comment) applies to this configuration as well.

pmoves/services/hi-rag-gateway-v2/scripts/wait-for-deps.sh (1)

16-16: Verify container name and confirm correct Supabase network assignment.

The default URL uses supabase_kong_PMOVES.AI:8000/realtime/v1, which has an unusual .AI suffix not found in standard Supabase documentation. Port 8000 is correct for Kong, and /realtime/v1 is the correct Supabase Realtime path. However, verify:

  • The actual container name matches supabase_kong_PMOVES.AI (or confirm the correct name if running via Supabase CLI)
  • Services are connecting to the supabase_net network (not pmoves-net)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines 14 to 17
set -e

SUPABASE_URL="${SUPABASE_REALTIME_URL:-ws://host.docker.internal:65421/realtime/v1}"
SUPABASE_URL="${SUPABASE_REALTIME_URL:-ws://supabase_kong_PMOVES.AI:8000/realtime/v1}"
DISABLED="${SUPABASE_REALTIME_DISABLED:-false}"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Realtime default uses non-existent Supabase host

The new fallback SUPABASE_REALTIME_URL points at ws://supabase_kong_PMOVES.AI:8000/realtime/v1, but the Supabase CLI stack we join on pmoves-net exposes Kong as supabase-kong (see the botz-gateway defaults in pmoves/docker-compose.yml lines 832-839). There is no container registering the _PMOVES.AI hostname, so on a stock make -C pmoves supa-start run the wait-for-deps probe will DNS fail and Hi-RAG’s realtime listener will never come up unless users override the variable. This regresses the out-of-the-box configuration you were trying to fix for WSL.

Useful? React with 👍 / 👎.

@POWERFULMOVES
POWERFULMOVES merged commit 92ad051 into main Dec 19, 2025
7 checks passed
POWERFULMOVES added a commit that referenced this pull request Jan 2, 2026
…ocker.internal (#335)

The host.docker.internal hostname resolves to Docker Desktop's gateway IP
(192.168.65.254) in WSL2, which doesn't properly route to host-bound ports.
This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts.

Changed default SUPABASE_REALTIME_URL from:
  ws://host.docker.internal:65421/realtime/v1
to:
  ws://supabase_kong_PMOVES.AI:8000/realtime/v1

Since both containers are on pmoves-net, direct container-to-container DNS
resolution works reliably.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Jan 2, 2026
…ocker.internal (#335)

The host.docker.internal hostname resolves to Docker Desktop's gateway IP
(192.168.65.254) in WSL2, which doesn't properly route to host-bound ports.
This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts.

Changed default SUPABASE_REALTIME_URL from:
  ws://host.docker.internal:65421/realtime/v1
to:
  ws://supabase_kong_PMOVES.AI:8000/realtime/v1

Since both containers are on pmoves-net, direct container-to-container DNS
resolution works reliably.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Jan 2, 2026
* fix(security): GPU access + production hardening (health checks, image pins, required password) (#355)

* docs: address PR review comments for env tier consolidation

- Add GPU Orchestrator and E2B Runner to services-catalog.md
- Add gpu-orchestrator to env.tier-api.example service list
- Create learnings file documenting 6-tier env architecture
- Add env.tier-*.example files for worker, media, agent tiers

Addresses nitpick comments from PRs #349-354.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(gpu): ensure GPU access for all CUDA-enabled services

- gpu-orchestrator: Add GPU deploy section + NVIDIA_VISIBLE_DEVICES
- ultimate-tts-studio: Add NVIDIA_VISIBLE_DEVICES env var
- hi-rag-gateway-gpu: Add NVIDIA_VISIBLE_DEVICES env var
- hi-rag-gateway-v2-gpu: Add NVIDIA_VISIBLE_DEVICES env var
- media-audio: Change base image to nvidia/cuda:12.4.1-runtime-ubuntu22.04
  (was python:3.11-slim which caused silent CPU fallback)

This fixes silent CPU fallbacks where PyTorch CUDA packages were installed
but the CUDA runtime was not available in the container.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(security): production hardening - health checks and image pinning

Critical security and reliability fixes:

1. **POSTGRES_PASSWORD now required** - Changed from insecure default
   `:-pmoves` to required syntax `${VAR:?error}`. Compose will fail if
   POSTGRES_PASSWORD is not set (lines 59, 78, 937).

2. **Pinned 8 :latest images to specific versions:**
   - postgrest/postgrest:latest → v12.2.3
   - minio/minio:latest → RELEASE.2024-12-18T13-15-44Z
   - ollama/ollama:latest → 0.5.4
   - tensorzero/gateway:latest → 2024.12.18
   - tensorzero/ui:latest → 2024.12.18
   - invidious:latest → 2024.12.09
   - invidious-companion:latest → 2024.12.20
   - grayjay:latest → 2024.11.01

3. **Added health checks to 37 services** (52 total, up from 15):
   - Data tier: qdrant, meilisearch, minio
   - API tier: hi-rag-*, retrieval-eval, presign, render-webhook
   - Worker tier: extract-worker, pdf-ingest, langextract, notebook-sync,
     ffmpeg-whisper, media-video, media-audio, pmoves-yt, channel-monitor
   - Agent tier: agent-zero, mesh-agent, deepresearch, supaserch
   - TensorZero: gateway, ui, ollama
   - Others: publisher-discord, messaging-gateway, jellyfin-bridge

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(health): address PR review critical issues

Fixes critical issues identified by PR review:

MinIO:
- Change health check from `mc ready local` to curl-based
  (minio/minio image doesn't include mc binary)

NATS:
- Add `-m 8222` flag to enable HTTP monitoring port
  (health check was targeting port that wasn't enabled)

Health checks:
- comfy-watcher: verify module imports instead of just `import sys`
- mesh-agent: verify main module and NATS client availability

Missing start_period:
- postgres: add 15s start_period
- chat-relay: add 30s start_period
- n8n-agent: add 30s start_period
- invidious-postgres: add 15s start_period

All 52 health checks now have start_period defined.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): use container DNS for Supabase realtime instead of host.docker.internal (#335)

The host.docker.internal hostname resolves to Docker Desktop's gateway IP
(192.168.65.254) in WSL2, which doesn't properly route to host-bound ports.
This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts.

Changed default SUPABASE_REALTIME_URL from:
  ws://host.docker.internal:65421/realtime/v1
to:
  ws://supabase_kong_PMOVES.AI:8000/realtime/v1

Since both containers are on pmoves-net, direct container-to-container DNS
resolution works reliably.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

* fix(tts): use nvidia/cuda base and fix Higgs Audio pydantic error

- Switch runtime stage to nvidia/cuda:12.4.1-cudnn-runtime-ubuntu22.04
  (includes nvrtc and full CUDA toolkit for ONNX GPU provider)
- Add LD_LIBRARY_PATH for CUDA libraries
- Install cuda-nvrtc-12-4 package
- Update submodule with Higgs Audio dataclass fix (default_factory)
- Follow Pinokio-matched installation order for dependencies
- Add MCP server support (GRADIO_MCP_SERVER=true)
- Add WSL2/CUDA compatibility settings

Fixes:
- libnvrtc.so.12 missing error
- HiggsAudioResponse mutable default ValueError
- All 7 TTS engines now load correctly

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Jan 3, 2026
…ocker.internal (#335)

The host.docker.internal hostname resolves to Docker Desktop's gateway IP
(192.168.65.254) in WSL2, which doesn't properly route to host-bound ports.
This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts.

Changed default SUPABASE_REALTIME_URL from:
  ws://host.docker.internal:65421/realtime/v1
to:
  ws://supabase_kong_PMOVES.AI:8000/realtime/v1

Since both containers are on pmoves-net, direct container-to-container DNS
resolution works reliably.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Jan 3, 2026
* feat(hirag): add wait-for-deps startup script

Add entrypoint script that waits for Supabase realtime to be healthy
before starting the Hi-RAG application, preventing startup errors on
Docker restarts.

New files:
- scripts/wait-for-deps.sh: Health check script with configurable timeout

Dockerfile changes:
- Install curl for health checks
- Add ENTRYPOINT to run wait-for-deps.sh before uvicorn
- GPU variant: Create wrapper entrypoint for NVIDIA compatibility

Environment variables:
- WAIT_FOR_DEPS_MAX_WAIT: Maximum wait time (default: 120s)
- WAIT_FOR_DEPS_INTERVAL: Check interval (default: 5s)
- SUPABASE_REALTIME_DISABLED: Skip wait if set to true

The script checks Supabase realtime health via HTTP ping before
starting the application, eliminating the ~109 retry errors that
occurred during cold starts.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat(hirag): add exponential backoff with startup grace period

Improve Supabase realtime connection resilience with smarter retry logic
and reduced log noise during startup.

Changes to _geometry_realtime_worker:
- Add exponential backoff: 5s → 10s → 20s → 40s → 60s (max)
- Add startup grace period (120s) with WARNING level logging
- Reset backoff on successful connection
- Track elapsed time for grace period calculation

New environment variables:
- GEOMETRY_REALTIME_MAX_BACKOFF: Maximum retry delay (default: 60s)
- GEOMETRY_REALTIME_STARTUP_GRACE: Grace period duration (default: 120s)

Before: Fixed 5s retry, ERROR level for all failures
After: Exponential backoff, WARNING during startup grace period

This reduces log noise from ~109 ERROR entries to a handful of
WARNING messages during normal startup scenarios.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): address PR review findings for restart stability

- GPU Dockerfile: add non-root user with video group (critical security fix)
- wait-for-deps.sh: add curl timeout (--connect-timeout 5 --max-time 10)
- app.py: add JSON parse failure logging at debug level
- app.py: include exception type in grace period logging messages

These changes address findings from the code-reviewer and silent-failure-hunter
agents that reviewed PR #333.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): implement PR review improvements

- wait-for-deps.sh: add WAIT_FOR_DEPS_ALLOW_DEGRADED flag for explicit degraded mode opt-in
- wait-for-deps.sh: log curl stderr on failure for better debugging
- wait-for-deps.sh: add URL validation before health check
- app.py: add debug-level stack traces during startup grace period
- app.py: add inline documentation for retry configuration vars
- Dockerfile.gpu: fix comment to accurately describe two-phase startup

These improvements address all findings from the code-reviewer,
silent-failure-hunter, and comment-analyzer review agents.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): remove redundant imports in app.py

- Remove duplicate import line (lines 1-2 were near-identical)
- Remove redundant `import time` inside function (already imported at module level)

Addresses CodeRabbit review feedback from PR #333.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): use container DNS for Supabase realtime instead of host.docker.internal (#335)

The host.docker.internal hostname resolves to Docker Desktop's gateway IP
(192.168.65.254) in WSL2, which doesn't properly route to host-bound ports.
This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts.

Changed default SUPABASE_REALTIME_URL from:
  ws://host.docker.internal:65421/realtime/v1
to:
  ws://supabase_kong_PMOVES.AI:8000/realtime/v1

Since both containers are on pmoves-net, direct container-to-container DNS
resolution works reliably.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): restore EvoSwarm mode and HRM integration

Fixes critical dead code in geometry_decode_text function:
- Changed `else` to `elif mode == "swarm"` to make swarm mode reachable
- Integrated HRM refinement in learned mode (maybe_refine)
- Added HRM status in default geometry mode
- Consistent response shape across all modes (namespace, modality, builder_pack)

Before: swarm mode was unreachable due to early returns in if-else
After: proper if-elif-else routing for learned/swarm/default modes

Resolves CodeRabbit review finding in PR #334

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: address PR #334 review issues across 4 files

route.ts (Critical):
- Import and use logError() instead of console.error
- Return HTTP 503 for configuration errors
- Return HTTP 502 for upstream/network failures

app.py (Important):
- Change except Exception to except (ImportError, ModuleNotFoundError)
- Fix variable shadowing: use top_pts instead of re-declaring pts

Dockerfile (Suggestions):
- Remove duplicate comment block at Step 12b
- Replace Pinokio line number references with descriptive names
- Fix huggingface-hub version comment (0.30.0 → 0.25.0)

sync.py (Suggestion):
- Make offline mode opt-in via NOTEBOOK_SYNC_GRACEFUL_DEGRADATION env var
- Fail explicitly if OPEN_NOTEBOOK_API_URL not set (unless env var enabled)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): remove extra_headers from WebSocket (uvloop incompatibility) (#400)

The websockets library's extra_headers parameter is not supported by
uvloop's create_connection(), which is used by uvicorn. Removed the
extra_headers parameter and rely on the apikey URL parameter for
Supabase realtime authentication.

Also:
- Add pmoves/vendor/python/ to .gitignore (unpacked packages)
- Remove 275+ unpacked package files from git tracking

Vendor submodules were already configured with POWERFULMOVES forks.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Jan 18, 2026
* fix(security): GPU access + production hardening (health checks, image pins, required password) (#355)

* docs: address PR review comments for env tier consolidation

- Add GPU Orchestrator and E2B Runner to services-catalog.md
- Add gpu-orchestrator to env.tier-api.example service list
- Create learnings file documenting 6-tier env architecture
- Add env.tier-*.example files for worker, media, agent tiers

Addresses nitpick comments from PRs #349-354.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(gpu): ensure GPU access for all CUDA-enabled services

- gpu-orchestrator: Add GPU deploy section + NVIDIA_VISIBLE_DEVICES
- ultimate-tts-studio: Add NVIDIA_VISIBLE_DEVICES env var
- hi-rag-gateway-gpu: Add NVIDIA_VISIBLE_DEVICES env var
- hi-rag-gateway-v2-gpu: Add NVIDIA_VISIBLE_DEVICES env var
- media-audio: Change base image to nvidia/cuda:12.4.1-runtime-ubuntu22.04
  (was python:3.11-slim which caused silent CPU fallback)

This fixes silent CPU fallbacks where PyTorch CUDA packages were installed
but the CUDA runtime was not available in the container.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(security): production hardening - health checks and image pinning

Critical security and reliability fixes:

1. **POSTGRES_PASSWORD now required** - Changed from insecure default
   `:-pmoves` to required syntax `${VAR:?error}`. Compose will fail if
   POSTGRES_PASSWORD is not set (lines 59, 78, 937).

2. **Pinned 8 :latest images to specific versions:**
   - postgrest/postgrest:latest → v12.2.3
   - minio/minio:latest → RELEASE.2024-12-18T13-15-44Z
   - ollama/ollama:latest → 0.5.4
   - tensorzero/gateway:latest → 2024.12.18
   - tensorzero/ui:latest → 2024.12.18
   - invidious:latest → 2024.12.09
   - invidious-companion:latest → 2024.12.20
   - grayjay:latest → 2024.11.01

3. **Added health checks to 37 services** (52 total, up from 15):
   - Data tier: qdrant, meilisearch, minio
   - API tier: hi-rag-*, retrieval-eval, presign, render-webhook
   - Worker tier: extract-worker, pdf-ingest, langextract, notebook-sync,
     ffmpeg-whisper, media-video, media-audio, pmoves-yt, channel-monitor
   - Agent tier: agent-zero, mesh-agent, deepresearch, supaserch
   - TensorZero: gateway, ui, ollama
   - Others: publisher-discord, messaging-gateway, jellyfin-bridge

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(health): address PR review critical issues

Fixes critical issues identified by PR review:

MinIO:
- Change health check from `mc ready local` to curl-based
  (minio/minio image doesn't include mc binary)

NATS:
- Add `-m 8222` flag to enable HTTP monitoring port
  (health check was targeting port that wasn't enabled)

Health checks:
- comfy-watcher: verify module imports instead of just `import sys`
- mesh-agent: verify main module and NATS client availability

Missing start_period:
- postgres: add 15s start_period
- chat-relay: add 30s start_period
- n8n-agent: add 30s start_period
- invidious-postgres: add 15s start_period

All 52 health checks now have start_period defined.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): use container DNS for Supabase realtime instead of host.docker.internal (#335)

The host.docker.internal hostname resolves to Docker Desktop's gateway IP
(192.168.65.254) in WSL2, which doesn't properly route to host-bound ports.
This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts.

Changed default SUPABASE_REALTIME_URL from:
  ws://host.docker.internal:65421/realtime/v1
to:
  ws://supabase_kong_PMOVES.AI:8000/realtime/v1

Since both containers are on pmoves-net, direct container-to-container DNS
resolution works reliably.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

* fix(tts): use nvidia/cuda base and fix Higgs Audio pydantic error

- Switch runtime stage to nvidia/cuda:12.4.1-cudnn-runtime-ubuntu22.04
  (includes nvrtc and full CUDA toolkit for ONNX GPU provider)
- Add LD_LIBRARY_PATH for CUDA libraries
- Install cuda-nvrtc-12-4 package
- Update submodule with Higgs Audio dataclass fix (default_factory)
- Follow Pinokio-matched installation order for dependencies
- Add MCP server support (GRADIO_MCP_SERVER=true)
- Add WSL2/CUDA compatibility settings

Fixes:
- libnvrtc.so.12 missing error
- HiggsAudioResponse mutable default ValueError
- All 7 TTS engines now load correctly

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Jan 18, 2026
* feat(hirag): add wait-for-deps startup script

Add entrypoint script that waits for Supabase realtime to be healthy
before starting the Hi-RAG application, preventing startup errors on
Docker restarts.

New files:
- scripts/wait-for-deps.sh: Health check script with configurable timeout

Dockerfile changes:
- Install curl for health checks
- Add ENTRYPOINT to run wait-for-deps.sh before uvicorn
- GPU variant: Create wrapper entrypoint for NVIDIA compatibility

Environment variables:
- WAIT_FOR_DEPS_MAX_WAIT: Maximum wait time (default: 120s)
- WAIT_FOR_DEPS_INTERVAL: Check interval (default: 5s)
- SUPABASE_REALTIME_DISABLED: Skip wait if set to true

The script checks Supabase realtime health via HTTP ping before
starting the application, eliminating the ~109 retry errors that
occurred during cold starts.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat(hirag): add exponential backoff with startup grace period

Improve Supabase realtime connection resilience with smarter retry logic
and reduced log noise during startup.

Changes to _geometry_realtime_worker:
- Add exponential backoff: 5s → 10s → 20s → 40s → 60s (max)
- Add startup grace period (120s) with WARNING level logging
- Reset backoff on successful connection
- Track elapsed time for grace period calculation

New environment variables:
- GEOMETRY_REALTIME_MAX_BACKOFF: Maximum retry delay (default: 60s)
- GEOMETRY_REALTIME_STARTUP_GRACE: Grace period duration (default: 120s)

Before: Fixed 5s retry, ERROR level for all failures
After: Exponential backoff, WARNING during startup grace period

This reduces log noise from ~109 ERROR entries to a handful of
WARNING messages during normal startup scenarios.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): address PR review findings for restart stability

- GPU Dockerfile: add non-root user with video group (critical security fix)
- wait-for-deps.sh: add curl timeout (--connect-timeout 5 --max-time 10)
- app.py: add JSON parse failure logging at debug level
- app.py: include exception type in grace period logging messages

These changes address findings from the code-reviewer and silent-failure-hunter
agents that reviewed PR #333.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): implement PR review improvements

- wait-for-deps.sh: add WAIT_FOR_DEPS_ALLOW_DEGRADED flag for explicit degraded mode opt-in
- wait-for-deps.sh: log curl stderr on failure for better debugging
- wait-for-deps.sh: add URL validation before health check
- app.py: add debug-level stack traces during startup grace period
- app.py: add inline documentation for retry configuration vars
- Dockerfile.gpu: fix comment to accurately describe two-phase startup

These improvements address all findings from the code-reviewer,
silent-failure-hunter, and comment-analyzer review agents.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): remove redundant imports in app.py

- Remove duplicate import line (lines 1-2 were near-identical)
- Remove redundant `import time` inside function (already imported at module level)

Addresses CodeRabbit review feedback from PR #333.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): use container DNS for Supabase realtime instead of host.docker.internal (#335)

The host.docker.internal hostname resolves to Docker Desktop's gateway IP
(192.168.65.254) in WSL2, which doesn't properly route to host-bound ports.
This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts.

Changed default SUPABASE_REALTIME_URL from:
  ws://host.docker.internal:65421/realtime/v1
to:
  ws://supabase_kong_PMOVES.AI:8000/realtime/v1

Since both containers are on pmoves-net, direct container-to-container DNS
resolution works reliably.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): restore EvoSwarm mode and HRM integration

Fixes critical dead code in geometry_decode_text function:
- Changed `else` to `elif mode == "swarm"` to make swarm mode reachable
- Integrated HRM refinement in learned mode (maybe_refine)
- Added HRM status in default geometry mode
- Consistent response shape across all modes (namespace, modality, builder_pack)

Before: swarm mode was unreachable due to early returns in if-else
After: proper if-elif-else routing for learned/swarm/default modes

Resolves CodeRabbit review finding in PR #334

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: address PR #334 review issues across 4 files

route.ts (Critical):
- Import and use logError() instead of console.error
- Return HTTP 503 for configuration errors
- Return HTTP 502 for upstream/network failures

app.py (Important):
- Change except Exception to except (ImportError, ModuleNotFoundError)
- Fix variable shadowing: use top_pts instead of re-declaring pts

Dockerfile (Suggestions):
- Remove duplicate comment block at Step 12b
- Replace Pinokio line number references with descriptive names
- Fix huggingface-hub version comment (0.30.0 → 0.25.0)

sync.py (Suggestion):
- Make offline mode opt-in via NOTEBOOK_SYNC_GRACEFUL_DEGRADATION env var
- Fail explicitly if OPEN_NOTEBOOK_API_URL not set (unless env var enabled)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(hirag): remove extra_headers from WebSocket (uvloop incompatibility) (#400)

The websockets library's extra_headers parameter is not supported by
uvloop's create_connection(), which is used by uvicorn. Removed the
extra_headers parameter and rely on the apikey URL parameter for
Supabase realtime authentication.

Also:
- Add pmoves/vendor/python/ to .gitignore (unpacked packages)
- Remove 275+ unpacked package files from git tracking

Vendor submodules were already configured with POWERFULMOVES forks.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Jan 18, 2026
…ocker.internal (#335)

The host.docker.internal hostname resolves to Docker Desktop's gateway IP
(192.168.65.254) in WSL2, which doesn't properly route to host-bound ports.
This caused Hi-RAG to fail connecting to Supabase realtime after Docker restarts.

Changed default SUPABASE_REALTIME_URL from:
  ws://host.docker.internal:65421/realtime/v1
to:
  ws://supabase_kong_PMOVES.AI:8000/realtime/v1

Since both containers are on pmoves-net, direct container-to-container DNS
resolution works reliably.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
@POWERFULMOVES
POWERFULMOVES deleted the fix/hirag-realtime-container-dns branch March 7, 2026 21:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant