Skip to content

refactor(env): Phase 2 - Migrate API tier to env-tier-api anchor #350

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
POWERFULMOVES merged 1 commit into from
Dec 24, 2025
Merged

refactor(env): Phase 2 - Migrate API tier to env-tier-api anchor #350

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 33 additions & 9 deletions pmoves/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,22 +3,46 @@
# Each tier receives ONLY the secrets it needs (principle of least privilege)
# =============================================================================
x-env-tier-data: &env-tier-data
env_file: [ env.tier-data?, .env.local ] # ? = optional, won't fail if missing
env_file:
- path: env.tier-data
required: false
- path: .env.local
required: false

x-env-tier-api: &env-tier-api
env_file: [ env.tier-api?, .env.local ] # ? = optional, won't fail if missing
env_file:
- path: env.tier-api
required: false
- path: .env.local
required: false

x-env-tier-worker: &env-tier-worker
env_file: [ env.tier-worker?, .env.local ] # ? = optional, won't fail if missing
env_file:
- path: env.tier-worker
required: false
- path: .env.local
required: false

x-env-tier-agent: &env-tier-agent
env_file: [ env.tier-agent?, .env.local ] # ? = optional, won't fail if missing
env_file:
- path: env.tier-agent
required: false
- path: .env.local
required: false

x-env-tier-media: &env-tier-media
env_file: [ env.tier-media?, .env.local ] # ? = optional, won't fail if missing
env_file:
- path: env.tier-media
required: false
- path: .env.local
required: false

x-env-tier-llm: &env-tier-llm
env_file: [ env.tier-llm?, .env.local ] # ? = optional, won't fail if missing
env_file:
- path: env.tier-llm
required: false
- path: .env.local
required: false

# Legacy: Full env for services not yet migrated to tier-based
x-env-legacy: &env-legacy
Expand Down Expand Up @@ -49,7 +73,7 @@ services:
image: postgrest/postgrest:latest
restart: unless-stopped
depends_on: [ postgres ]
env_file: [ env.shared.generated, env.shared, .env.generated, .env.local ]
<<: *env-tier-api
environment:
- PGRST_DB_URI=postgres://${POSTGRES_USER:-pmoves}:${POSTGRES_PASSWORD:-pmoves}@postgres:5432/${POSTGRES_DB:-pmoves}
- PGRST_DB_SCHEMA=${PGRST_DB_SCHEMA:-public,pmoves_core}
Expand Down Expand Up @@ -170,7 +194,7 @@ services:
retrieval-eval:
build: ./services/retrieval-eval
restart: unless-stopped
env_file: [ env.shared.generated, env.shared, .env.generated, .env.local ]
<<: *env-tier-api
environment:
- HIRAG_URL=http://hi-rag-gateway-v2:8086
- EVAL_HTTP_PORT=${EVAL_HTTP_PORT:-8090}
Expand All @@ -187,7 +211,7 @@ services:
presign:
build: ./services/presign
restart: unless-stopped
env_file: [ env.shared.generated, env.shared, .env.generated, .env.local ]
<<: *env-tier-api
environment:
- MINIO_ENDPOINT=${MINIO_ENDPOINT:-minio:9000}
- MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY}
Expand Down
42 changes: 42 additions & 0 deletions pmoves/env.tier-api.example
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
# =============================================================================
# PMOVES API Tier Environment Variables
# =============================================================================
# Services: postgrest, presign, retrieval-eval, hi-rag-gateway-v2

@coderabbitai coderabbitai Bot Dec 24, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Update service list to include gpu-orchestrator.

The docker-compose.yml file shows that gpu-orchestrator (line 834) also uses the env-tier-api anchor, but it's not listed here. Including all services helps users understand the scope of this tier configuration.

🔎 Proposed fix 
-# Services: postgrest, presign, retrieval-eval, hi-rag-gateway-v2
+# Services: postgrest, presign, retrieval-eval, hi-rag-gateway-v2, gpu-orchestrator
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Services: postgrest, presign, retrieval-eval, hi-rag-gateway-v2
# Services: postgrest, presign, retrieval-eval, hi-rag-gateway-v2, gpu-orchestrator
🤖 Prompt for AI Agents 
In pmoves/env.tier-api.example around line 4, the service list comment omits
gpu-orchestrator; update the comment to include "gpu-orchestrator" alongside
postgrest, presign, retrieval-eval, and hi-rag-gateway-v2 so the list matches
docker-compose usage and accurately documents all services that use the
env-tier-api anchor.

# Scope: Data tier URLs, internal service credentials (NO external API keys)
#
# Copy to `env.tier-api` and fill in real values. The file is gitignored.
# =============================================================================

# PostgreSQL Connection (for PostgREST)
POSTGRES_USER=pmoves
# REQUIRED: Must match env.tier-data POSTGRES_PASSWORD
POSTGRES_PASSWORD=
POSTGRES_DB=pmoves
PGRST_DB_SCHEMA=public,pmoves_core
PGRST_DB_ANON_ROLE=anon
PGRST_SERVER_PORT=3000
# REQUIRED: Generate with `openssl rand -base64 32`
SUPABASE_JWT_SECRET=

# MinIO Connection (for Presign)
MINIO_ENDPOINT=minio:9000
# REQUIRED: Must match env.tier-data MINIO credentials
MINIO_ACCESS_KEY=
MINIO_SECRET_KEY=
MINIO_SECURE=false
AWS_DEFAULT_REGION=us-east-1
ALLOWED_BUCKETS=assets,outputs
# REQUIRED: Generate with `openssl rand -hex 32`
PRESIGN_SHARED_SECRET=

# Hi-RAG Gateway (for retrieval-eval)
HIRAG_URL=http://hi-rag-gateway-v2:8086
EVAL_HTTP_PORT=8090

# Qdrant Connection (for Hi-RAG)
QDRANT_URL=http://qdrant:6333
QDRANT_COLLECTION=pmoves_chunks_qwen3

# Meilisearch Connection (for Hi-RAG)
# REQUIRED: Must match env.tier-data MEILI_MASTER_KEY
MEILI_MASTER_KEY=
Loading