refactor(env): Phase 2 - Migrate API tier to env-tier-api anchor

[POWERFULMOVES]

Summary

Phase 2 of 6-tier env consolidation: API tier migration

API tier services now receive only data tier URLs and internal credentials - no external API keys.

Changes

• Fixed tier anchor syntax - Block-style env_file with required: false
• Migrated postgrest - PostgREST database gateway
• Migrated presign - MinIO URL presigner
• Migrated retrieval-eval - Hi-RAG evaluation service
• Created env.tier-api.example - With secure defaults

API Tier Services

Service	Purpose	Previous	New
postgrest	PostgREST DB gateway	legacy env_file	<<: *env-tier-api ✅
presign	MinIO URL presigner	legacy env_file	<<: *env-tier-api ✅
retrieval-eval	Hi-RAG eval	legacy env_file	<<: *env-tier-api ✅

Security Impact

API tier services now receive only:

• PostgreSQL credentials (POSTGRES_USER/PASSWORD)
• MinIO credentials (MINIO_ACCESS_KEY/SECRET_KEY)
• Presign secret (PRESIGN_SHARED_SECRET)
• JWT secret (SUPABASE_JWT_SECRET)
• Internal service URLs

No longer receive: External API keys (OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.)

Test Plan

• docker compose config validates without syntax errors
• API tier services properly inherit from anchor
• Tier anchor count: 10 services now use tier anchors

Related PRs

• refactor(env): Phase 1 - Migrate data tier to env-tier-data anchor #349 - Phase 1: Data tier migration

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Improved environment file loading configuration to be more robust by making missing files non-fatal and centralizing settings across service tiers.

• Documentation

  • Added example API Tier environment configuration template for deployment setup reference.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR restructures Docker Compose environment file loading from flat optional lists to structured YAML blocks with explicit required: false properties. Multiple services are consolidated to use centralized YAML anchors instead of redundant env_file declarations, and an example tier configuration template is added.

Changes

Cohort / File(s)	Summary
Tier Environment Anchors pmoves/docker-compose.yml	Updated 6 YAML anchors (x-env-tier-data, x-env-tier-api, x-env-tier-worker, x-env-tier-agent, x-env-tier-media, x-env-tier-llm) from flat optional-list syntax to structured blocks with path and required: false entries for each env file.
Service Consolidation pmoves/docker-compose.yml	Four services (postgrest, retrieval-eval, presign, hi-rag-gateway-v2) refactored to use <<: *env-tier-api anchor reference instead of explicit env_file lists, centralizing environment loading.
Configuration Template pmoves/env.tier-api.example	New example file added defining placeholder values for PostgreSQL, MinIO, Hi-RAG gateway, Qdrant, and Meilisearch connections and credentials for the API tier.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 Through YAML anchors, we hop with glee,
Tier configs now structured, neat and free,
Env files optional—no fails in sight,
Services unified, all bundled tight! 🌟

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately reflects the main change: migrating the API tier to the env-tier-api anchor as Phase 2 of environment consolidation.
Description check	✅ Passed	The PR description includes a clear summary of changes, a comprehensive test plan, and detailed security impact analysis, though it lacks explicit documentation of testing commands/output and a formal Required Checks section.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch env-consolidation-api-tier

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 5cb33ba and 5138957.

📒 Files selected for processing (2)

• pmoves/docker-compose.yml
• pmoves/env.tier-api.example

🧰 Additional context used

📓 Path-based instructions (1)

pmoves/**/docker-compose.yml

📄 CodeRabbit inference engine (pmoves/AGENTS.md)

Use Compose profiles (data, workers) to scope what runs locally in docker-compose.yml

Files:

• pmoves/docker-compose.yml

🧠 Learnings (4)

📚 Learning: 2025-12-15T12:03:17.291Z

Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-15T12:03:17.291Z
Learning: Applies to pmoves/env.shared.example : Copy env.shared.example → env.shared and fill in secrets; never commit real secrets in env.shared

Applied to files:

• pmoves/env.tier-api.example

📚 Learning: 2025-12-07T11:03:53.415Z

Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: pmoves/AGENTS.md:0-0
Timestamp: 2025-12-07T11:03:53.415Z
Learning: Applies to pmoves/**/environment.yml : Preferred Python: Conda 3.11+ (env name: `PMOVES.AI` or `pmoves-ai`); use `environment.yml` at repo root for setup

Applied to files:

• pmoves/env.tier-api.example

📚 Learning: 2025-12-15T12:03:17.291Z

Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-15T12:03:17.291Z
Learning: Applies to {.env,.env.local,pmoves/env.shared,pmoves/.env} : Never commit secrets; keep personal scratch in ignored files only, and store shared credentials in GitHub Actions secrets with environment scoping

Applied to files:

• pmoves/docker-compose.yml

📚 Learning: 2025-12-07T11:03:53.415Z

Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: pmoves/AGENTS.md:0-0
Timestamp: 2025-12-07T11:03:53.415Z
Learning: Keep shared defaults in `env.shared` and machine-specific overrides in `.env.local`. Copy `env.shared.example` → `env.shared`; never commit secrets

Applied to files:

• pmoves/docker-compose.yml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Analyze (python)

🔇 Additional comments (11)

pmoves/env.tier-api.example (4)

10-19: LGTM! PostgreSQL configuration is well-documented.

Clear instructions for matching credentials with env.tier-data and generating JWT secrets. The required field annotations help prevent configuration errors.

---

21-30: LGTM! MinIO configuration follows best practices.

Credentials properly marked as required with clear instructions to match env.tier-data values. The openssl rand -hex 32 command for PRESIGN_SHARED_SECRET is appropriate.

---

32-38: LGTM! Hi-RAG and Qdrant configuration is appropriate.

Internal service URLs use Docker network hostnames correctly, and the collection name aligns with the system's default configuration.

---

40-42: LGTM! Meilisearch configuration properly references shared credentials.

Clear instruction to match env.tier-data MEILI_MASTER_KEY ensures consistency across tiers.

Based on learnings: This template follows the pattern of env.shared.example—copy to env.tier-api and fill in secrets; never commit real secrets.

pmoves/docker-compose.yml (7)

5-45: LGTM! Tier anchor definitions are correctly structured.

The block-style env_file with required: false properties is the correct Docker Compose syntax for optional environment files. This approach provides graceful fallback when tier-specific files don't exist, improving developer experience. All six tier anchors follow the same consistent pattern.

---

76-76: LGTM! PostgREST successfully migrated to API tier anchor.

The service correctly uses <<: *env-tier-api and will now load env.tier-api and .env.local files. The explicit environment variables in lines 77-82 properly override/extend the anchor's base configuration.

---

197-197: LGTM! retrieval-eval successfully migrated to API tier anchor.

The service correctly uses <<: *env-tier-api. The explicit environment variables (lines 198-200) provide service-specific configuration while inheriting API tier credentials.

---

214-214: LGTM! presign successfully migrated to API tier anchor.

The service correctly uses <<: *env-tier-api. The explicit MinIO environment variables (lines 215-222) properly reference the credentials that will be loaded from env.tier-api.

---

665-665: LGTM! hi-rag-gateway-v2 successfully migrated to API tier anchor.

The service correctly uses <<: *env-tier-api. This aligns with the PR objectives and ensures the Hi-RAG gateway receives only internal credentials and data-tier URLs.

---

834-834: LGTM! gpu-orchestrator successfully migrated to API tier anchor.

The service correctly uses <<: *env-tier-api. The explicit environment variables (lines 835-842) provide service-specific configuration while inheriting API tier credentials. This service appropriately uses the API tier since it coordinates with NATS and orchestrates GPU models via internal service URLs.

---

602-602: Clarify that env.tier-media must be created by the developer with MinIO credentials.

The pmoves-yt service correctly uses the <<: *env-tier-media anchor which loads env.tier-media and .env.local (both marked required: false). However, env.tier-media does not exist in the repository—it is a developer-created secrets file (gitignored) following the pattern established in env.tier-api.example. The service requires MINIO_ACCESS_KEY and MINIO_SECRET_KEY with no fallback defaults, so developers must create env.tier-media and populate these credentials before running the service, or provide them via .env.local.

The service profiles are correct: ["orchestration", "workers", "agents"].

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Update service list to include gpu-orchestrator.

The docker-compose.yml file shows that gpu-orchestrator (line 834) also uses the env-tier-api anchor, but it's not listed here. Including all services helps users understand the scope of this tier configuration.

🔎 Proposed fix

-# Services: postgrest, presign, retrieval-eval, hi-rag-gateway-v2
+# Services: postgrest, presign, retrieval-eval, hi-rag-gateway-v2, gpu-orchestrator

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	# Services: postgrest, presign, retrieval-eval, hi-rag-gateway-v2
	# Services: postgrest, presign, retrieval-eval, hi-rag-gateway-v2, gpu-orchestrator

🤖 Prompt for AI Agents

In pmoves/env.tier-api.example around line 4, the service list comment omits
gpu-orchestrator; update the comment to include "gpu-orchestrator" alongside
postgrest, presign, retrieval-eval, and hi-rag-gateway-v2 so the list matches
docker-compose usage and accurately documents all services that use the
env-tier-api anchor.