fix(hardened): Restore critical services and clean git history - #478
fix(hardened): Restore critical services and clean git history#478POWERFULMOVES wants to merge 4 commits into
Conversation
- Restore pmoves/env.tier-* files from main branch - These were missing after PR #474 coordination merge - CHIT services (flute-gateway, consciousness-service) already present in base commit - PMOVESCHIT documentation already present in base commit 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Warning
|
| Cohort / File(s) | Summary |
|---|---|
ClickHouse & Docker Compose features/gateway/docker-compose.yml |
ClickHouse credentials (user and password) updated from hard-coded tensorzero:tensorzero to environment variables with safe defaults via $${CLICKHOUSE_USER:-tensorzero} and $${CLICKHOUSE_PASSWORD:-tensorzero} in both healthcheck test and gateway URL configuration. |
Environment Tier Files pmoves/env.tier-agent, pmoves/env.tier-media, pmoves/env.tier-worker |
Service endpoint updates (Supabase/Archon URLs moved from postgrest:3000 to supabase_kong_PMOVES.AI:8000); placeholder values replaced for sensitive credentials (SUPABASE_SERVICE_ROLE_KEY). Invidious configuration block removed from tier-media. |
Environment Tier Configuration pmoves/env.tier-api, pmoves/env.tier-data, pmoves/env.tier-llm |
Sensitive credentials (Postgres password, Supabase JWT, MinIO keys, Neo4j auth, MeiliSearch master key) replaced with empty values or placeholders and updated with production deployment guidance comments. Neo4j configuration block added to tier-api. Three new optional provider API keys (Moonshot, Venice, Z_AI) added to tier-llm. |
Supabase RLS Policies pmoves/supabase/initdb/06_media_analysis.sql |
Removed anonymous GRANT statements and permissive *_anon_all policies for detections, segments, and emotions tables. Replaced with tenant-isolation RLS policies (*_tenant_isolation) scoped to authenticated role using namespace = current_setting('app.current_tenant', true) for both USING and WITH CHECK clauses. Included exception handling for idempotent policy recreation. |
Supabase Geometry RLS pmoves/supabase/initdb/09_geometry_rls.sql |
Updated four RLS policies (anchors, constellations, shape_points, shape_index) from permissive read_*_all to tenant-scoped read_*_tenant policies, replacing unconditional true USING clause with tenant namespace check. Removed fallback access and hardened access control guidance. |
Estimated code review effort
🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
- fix(infra): TensorZero ClickHouse and GPU Orchestrator startup fixes #451: Modifies ClickHouse-related Docker Compose settings for TensorZero (healthcheck and service URL credentials).
- feat: Local-First TensorZero Gateway & AgentGym Integration #347: Updates
features/gateway/docker-compose.ymlservice definitions for tensorzero-clickhouse and tensorzero-gateway with credential and environment variable handling. - Phase 2 Security Hardening: Complete Implementation #276: Moves TensorZero ClickHouse configuration to environment-variable-driven approach with updated healthcheck and gateway URL settings.
Poem
🐰 Credentials tucked away in secrets safe and sound,
Tenant walls now guard each database ground,
No more hardcoded whispers in the code—
Environment variables light the road!
RLS policies stand firm, secure and tight, 🔐
Your data flows through tenant sight. ✨
🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Description check | The description is missing required sections: Testing with commands/output, Required Checks checkboxes, and Review Coordination checkboxes are not completed. | Complete all required sections: add Testing with actual commands/output, check Required Checks items, and indicate Review Coordination status. |
✅ Passed checks (2 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title accurately reflects the main objective: restoring critical services and cleaning git history with hardened security changes. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands and usage tips.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Security fixes applied: - Replace hardcoded credentials with empty values + REQUIRED comments (POSTGRES_PASSWORD, MINIO_ROOT_USER/PASSWORD, MEILI_MASTER_KEY, etc.) - Fix duplicate GITHUB_RUNNER_CTL_PORT variable (renamed to WEB_PORT) - Remove placeholder API keys (sk-placeholder) from env.tier-llm - Harden RLS policies: require authentication (TO authenticated) - Remove 'pmoves' fallback from tenant isolation policies - Remove anonymous grants from media analysis tables Files modified: - pmoves/env.tier-api: 5 hardcoded credentials replaced - pmoves/env.tier-data: 4 hardcoded credentials replaced - pmoves/env.tier-agent: duplicate port variable fixed - pmoves/env.tier-llm: 3 placeholder API keys removed - pmoves/supabase/initdb/06_media_analysis.sql: RLS hardened - pmoves/supabase/initdb/09_geometry_rls.sql: tenant fallback removed 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Fix all issues with AI agents
In @pmoves/env.tier-data:
- Around line 19-20: The NEO4J_AUTH environment entry is empty which breaks the
docker-compose healthcheck parsing; update the NEO4J_AUTH value to either a
proper credential string like "neo4j/<generated-password>" (generate with
openssl rand -base64 24) or explicitly set it to "none" for development so the
healthcheck's auth parsing (auth="${NEO4J_AUTH}", user="${auth%%/*}",
pass="${auth#*/}") and the cypher-shell call succeed; ensure whichever choice
you make is consistent with the neo4j container auth mode and any healthcheck
handling in docker-compose.yml.
- Around line 14-15: The POSTGRES_PASSWORD is empty which causes the Postgres
container to fail on initial startup; either provide a safe development fallback
or validate early: add a non-empty default for POSTGRES_PASSWORD (mirroring the
postgrest pattern, e.g., use shell-style expansion like
POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-pmoves}) in the postgres service
environment, or add a startup validation check that errors with a clear message
if POSTGRES_PASSWORD is unset/empty before attempting Docker startup; update the
env.tier-data entry and any docker-compose/service environment references to use
this default or to call the validation.
In @pmoves/supabase/initdb/09_geometry_rls.sql:
- Around line 21-46: The RLS policies created by the EXECUTE statements for
read_anchors_tenant, read_constellations_tenant, read_shape_points_tenant, and
read_shape_index_tenant must include the TO authenticated clause and the top
comment should explicitly state "access via authenticated JWT only"; update each
EXECUTE string so it creates the policy with "FOR SELECT TO authenticated USING
(namespace = current_setting(''app.current_tenant'', true))" and edit the header
comment to mirror the hardening pattern (explicitly mention authenticated
JWT-only access).
🧹 Nitpick comments (4)
pmoves/env.tier-worker (1)
24-25: Consider placeholders for MinIO credentials to match security hardening approach.While the Supabase key was replaced with a placeholder, the MinIO credentials still use default values (
minioadmin/minioadmin). For consistency with the security hardening objective, consider replacing these with placeholders and production guidance comments, similar to the approach inpmoves/env.tier-api.♻️ Suggested refinement
# ----- MinIO (Object Storage for Documents) ----- MINIO_ENDPOINT=minio:9000 -MINIO_ACCESS_KEY=minioadmin -MINIO_SECRET_KEY=minioadmin +# REQUIRED: Set unique access key for production deployments +MINIO_ACCESS_KEY= +# REQUIRED: Generate with `openssl rand -base64 32` for production deployments +MINIO_SECRET_KEY= MINIO_SECURE=falsepmoves/env.tier-media (1)
10-11: MinIO default credentials should be replaced with placeholders.Similar to the concern in
pmoves/env.tier-worker, the MinIO credentials here still use default values. For comprehensive security hardening, these should also be converted to empty placeholders with production guidance.♻️ Suggested refinement
# ----- MinIO (Media Storage) ----- MINIO_ENDPOINT=minio:9000 -MINIO_ACCESS_KEY=minioadmin -MINIO_SECRET_KEY=minioadmin +# REQUIRED: Set unique access key for production deployments +MINIO_ACCESS_KEY= +# REQUIRED: Generate with `openssl rand -base64 32` for production deployments +MINIO_SECRET_KEY= MINIO_SECURE=falsefeatures/gateway/docker-compose.yml (1)
41-41: Improved flexibility, but consider consistency with environment section.The use of environment variable defaults (
$${CLICKHOUSE_USER:-tensorzero}) in the healthcheck provides flexibility. However, the service's environment section (lines 22-23) still hard-codes these values. If these environment variables are overridden externally, the healthcheck will use the override, but the service itself will still use the hard-coded values from the environment section, creating a potential mismatch.Consider making the environment section also reference these variables:
♻️ Suggested refinement
environment: - - CLICKHOUSE_USER=tensorzero - - CLICKHOUSE_PASSWORD=tensorzero + - CLICKHOUSE_USER=${CLICKHOUSE_USER:-tensorzero} + - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD:-tensorzero} - CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1This ensures that if
CLICKHOUSE_USERorCLICKHOUSE_PASSWORDare set externally, both the service environment and the healthcheck use the same values.pmoves/env.tier-data (1)
7-7: Clarify the copy instruction.The instruction states "Copy to
env.tier-data" but this file is alreadyenv.tier-data. This appears to be template language that wasn't updated. Consider revising to: "Fill in real values below. This file is gitignored."
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (9)
features/gateway/docker-compose.ymlpmoves/env.tier-agentpmoves/env.tier-apipmoves/env.tier-datapmoves/env.tier-llmpmoves/env.tier-mediapmoves/env.tier-workerpmoves/supabase/initdb/06_media_analysis.sqlpmoves/supabase/initdb/09_geometry_rls.sql
🧰 Additional context used
📓 Path-based instructions (1)
**/{migrations,supabase}/**/*.sql
📄 CodeRabbit inference engine (GEMINI.md)
Perform Supabase RLS (Row-Level Security) hardening according to checklist
Files:
pmoves/supabase/initdb/09_geometry_rls.sqlpmoves/supabase/initdb/06_media_analysis.sql
🧠 Learnings (14)
📓 Common learnings
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-15T12:03:17.291Z
Learning: Applies to services/**/README.md : Update services/*/README.md and pmoves/docs/PMOVES.AI PLANS/ runbooks when touching service operational code
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-15T12:03:17.291Z
Learning: PRs should include clear description, linked issues, affected services, run/rollback notes, and screenshots for UI/flows; start from STARTER_PR_BODY.md and adjust sections as needed
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: GEMINI.md:0-0
Timestamp: 2025-12-07T11:03:07.638Z
Learning: Applies to **/{migrations,supabase}/**/*.sql : Perform Supabase RLS (Row-Level Security) hardening according to checklist
📚 Learning: 2025-12-15T12:03:17.291Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-15T12:03:17.291Z
Learning: Mandatory context before changes: read pmoves/docs/PMOVES.AI PLANS/ROADMAP.md and pmoves/docs/NEXT_STEPS.md to align with current sprint focus
Applied to files:
pmoves/env.tier-llmpmoves/env.tier-agent
📚 Learning: 2025-12-07T11:03:07.638Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: GEMINI.md:0-0
Timestamp: 2025-12-07T11:03:07.638Z
Learning: Applies to **/pmoves/**/*{qwen,gemma,audio,summary}*.py : Integrate Qwen2-Audio provider and add Gemma summaries to PMOVES.YT endpoints
Applied to files:
pmoves/env.tier-llm
📚 Learning: 2025-12-15T12:03:17.291Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-15T12:03:17.291Z
Learning: Applies to pmoves/env.shared.example : Copy env.shared.example → env.shared and fill in secrets; never commit real secrets in env.shared
Applied to files:
pmoves/env.tier-api
📚 Learning: 2025-12-15T12:03:17.291Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-15T12:03:17.291Z
Learning: Applies to {.env,.env.local,pmoves/env.shared,pmoves/.env} : Never commit secrets; keep personal scratch in ignored files only, and store shared credentials in GitHub Actions secrets with environment scoping
Applied to files:
pmoves/env.tier-api
📚 Learning: 2025-12-07T11:03:07.638Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: GEMINI.md:0-0
Timestamp: 2025-12-07T11:03:07.638Z
Learning: Applies to **/.env* : Update `.env` with new feature toggles for personas, packs, and geometry support
Applied to files:
pmoves/env.tier-api
📚 Learning: 2025-12-07T11:03:07.638Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: GEMINI.md:0-0
Timestamp: 2025-12-07T11:03:07.638Z
Learning: Applies to **/{migrations,supabase}/**/*.sql : Perform Supabase RLS (Row-Level Security) hardening according to checklist
Applied to files:
pmoves/env.tier-workerpmoves/supabase/initdb/09_geometry_rls.sqlpmoves/supabase/initdb/06_media_analysis.sql
📚 Learning: 2025-12-15T12:03:17.291Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-15T12:03:17.291Z
Learning: UI updates: run make -C pmoves notebook-workbench-smoke ARGS='--thread=<uuid>' to lint the Next.js bundle and validate Supabase connectivity; reference pmoves/docs/UI_NOTEBOOK_WORKBENCH.md
Applied to files:
pmoves/env.tier-worker
📚 Learning: 2025-12-07T11:03:53.415Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: pmoves/AGENTS.md:0-0
Timestamp: 2025-12-07T11:03:53.415Z
Learning: Populate `OPEN_NOTEBOOK_SURREAL_URL` / `OPEN_NOTEBOOK_SURREAL_ADDRESS` (or legacy `SURREAL_*` aliases) so the Streamlit UI can reach SurrealDB
Applied to files:
pmoves/env.tier-worker
📚 Learning: 2025-12-15T12:03:17.291Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-15T12:03:17.291Z
Learning: Applies to services/**/README.md : Update services/*/README.md and pmoves/docs/PMOVES.AI PLANS/ runbooks when touching service operational code
Applied to files:
pmoves/env.tier-agent
📚 Learning: 2025-12-15T12:03:17.291Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-15T12:03:17.291Z
Learning: Agents/Archon: for full-stack validation, follow the 'All Services Up, Then Tests' section in pmoves/docs/SMOKETESTS.md and the Archon service guide
Applied to files:
pmoves/env.tier-agent
📚 Learning: 2025-12-07T11:03:53.415Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: pmoves/AGENTS.md:0-0
Timestamp: 2025-12-07T11:03:53.415Z
Learning: Applies to pmoves/services/{agent-zero,archon}/**/*.py : For Agents/Archon full-stack validation, follow the 'All Services Up, Then Tests' section in `pmoves/docs/SMOKETESTS.md` and use `make -C pmoves agents-headless-smoke`, `make -C pmoves smoke-gpu`, and `make -C pmoves verify-all`
Applied to files:
pmoves/env.tier-agent
📚 Learning: 2025-12-07T11:03:53.415Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: pmoves/AGENTS.md:0-0
Timestamp: 2025-12-07T11:03:53.415Z
Learning: Register MCP servers for Agent Zero with `A0_MCP_SERVERS` in `pmoves/env.shared` using format: fs: "mcp://filesystem?roots=/data"; archon: "mcp://http?endpoint=http://archon-server:8051"
Applied to files:
pmoves/env.tier-agent
📚 Learning: 2025-12-07T11:03:53.415Z
Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: pmoves/AGENTS.md:0-0
Timestamp: 2025-12-07T11:03:53.415Z
Learning: Pin agent images by setting `AGENT_ZERO_IMAGE`, `ARCHON_IMAGE`, `ARCHON_UI_IMAGE`, and `PMOVES_YT_IMAGE` in `pmoves/env.shared`
Applied to files:
pmoves/env.tier-agent
🔇 Additional comments (11)
pmoves/env.tier-worker (1)
30-30: Good security hardening with placeholder.The replacement of the hard-coded Supabase service role key with a clear placeholder aligns with the PR's security objectives.
pmoves/env.tier-media (1)
18-18: Security hardening applied correctly.The Supabase service role key placeholder is consistent with the PR's credential management approach.
pmoves/env.tier-llm (1)
95-110: LGTM! Optional provider keys added safely.The addition of MOONSHOT_API_KEY, VENICE_API_KEY, and Z_AI_API_KEY follows the existing pattern with empty defaults and clear documentation. The new "Additional Provider Keys" section organizes these optional integrations appropriately.
pmoves/env.tier-api (2)
12-31: Excellent security hardening implementation.The systematic replacement of hard-coded credentials with empty placeholders and clear production guidance comments (using
opensslcommands) is a comprehensive approach to credential management. This aligns perfectly with the PR's security objectives.
45-51: The NEO4J_AUTH format comment is accurate. The codebase consistently validates and uses the "neo4j/password" format: the env_validator explicitly checksv.startswith("neo4j/"), brand_defaults constructs it asf"neo4j/{neo4j_pw}", and the docker-compose healthcheck parses it correctly using shell parameter expansion. This format is standard for the Neo4j Docker image.features/gateway/docker-compose.yml (1)
52-52: Environment-driven URL configuration is a good pattern.The TENSORZERO_CLICKHOUSE_URL now supports environment variable overrides while maintaining safe defaults. This aligns with the PR's goal of moving away from hard-coded credentials.
pmoves/env.tier-agent (2)
19-21: LGTM! Consistent endpoint migration to Kong gateway.The migration from direct PostgREST access (
postgrest:3000) to Kong-routed Supabase (supabase_kong_PMOVES.AI:8000) is consistently applied across all three variables. This centralizes access control through the API gateway, which is a security improvement.Also applies to: 52-52
67-74: GitHub Runner Controller authentication is properly configured via Docker secrets.The GitHub Personal Access Token is injected into the container via Docker secrets (
/run/secrets/github_pat), not as an environment variable. This follows security best practices by keeping credentials out of configuration files. The env.tier-agent file correctly contains only port, log level, repository, and refresh interval configuration.However, the
env.tier-agent.examplefile is incomplete—it doesn't include the GitHub Runner Controller configuration section (lines 67-74), which creates a documentation gap for developers. Update the example file to show the full configuration block for consistency.Likely an incorrect or invalid review comment.
pmoves/supabase/initdb/06_media_analysis.sql (2)
54-61: LGTM! Anonymous access properly removed.The removal of anonymous grants and enabling of RLS on all three tables (
detections,segments,emotions) correctly implements the first step of hardening. This ensures no unauthenticated access is possible at the grant level.Based on learnings, this follows the Supabase RLS hardening checklist.
67-105: Excellent RLS hardening implementation!The tenant-scoped policies meet all security requirements:
✓ Authentication required:
TO authenticatedensures all access requires valid JWT
✓ Tenant isolation:namespace = current_setting('app.current_tenant', true)enforces strict tenant boundaries
✓ No fallback: Comments explicitly confirm removal of 'pmoves' fallback—tenant context is mandatory
✓ Write protection:WITH CHECKclause prevents cross-tenant writes
✓ Comprehensive coverage:FOR ALLapplies to SELECT, INSERT, UPDATE, DELETE
✓ Secure default: Ifapp.current_tenantis not set,current_setting(..., true)returns NULL, denying access
✓ Idempotent: Exception handling allows safe re-application during migrationsBased on learnings, this implementation follows the Supabase RLS hardening checklist correctly.
pmoves/supabase/initdb/09_geometry_rls.sql (1)
28-28: Good practice: Policy names reflect tenant-scoped behavior.The policy renames from
read_*_alltoread_*_tenantclearly communicate the change from permissive to tenant-isolated access. This improves maintainability and makes the security model more obvious to future developers.Also applies to: 33-33, 38-38, 43-43
| # REQUIRED: Generate with `openssl rand -base64 24` for production deployments | ||
| POSTGRES_PASSWORD= |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Find and inspect docker-compose files for postgres service configuration
find . -name "docker-compose*.yml" -o -name "docker-compose*.yaml" | head -20Repository: POWERFULMOVES/PMOVES.AI
Length of output: 1005
🏁 Script executed:
# Check the env.tier-data file to understand the context
cat -n pmoves/env.tier-data | head -20Repository: POWERFULMOVES/PMOVES.AI
Length of output: 1079
🏁 Script executed:
# Search for postgres service definition and how it uses POSTGRES_PASSWORD
rg -A 15 'postgres:' --type yamlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 18211
🏁 Script executed:
# Look for any other environment configuration files that might provide defaults
rg -l 'POSTGRES_PASSWORD' --type yaml --type json --type textRepository: POWERFULMOVES/PMOVES.AI
Length of output: 95
🏁 Script executed:
# Get the full postgres service definition from docker-compose.yml
rg -B 5 -A 30 'postgres:' pmoves/docker-compose.yml | head -60Repository: POWERFULMOVES/PMOVES.AI
Length of output: 1646
🏁 Script executed:
# Check if POSTGRES_PASSWORD is set anywhere in the postgres service definition specifically
rg -B 10 -A 20 'image: ankane/pgvector' pmoves/docker-compose.ymlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 816
🏁 Script executed:
# Look at the env_file anchor definition to understand what's being loaded
grep -n 'id001\|env_file' pmoves/docker-compose.yml | head -20Repository: POWERFULMOVES/PMOVES.AI
Length of output: 493
🏁 Script executed:
# Find the anchor definition for id001 (env-tier-data)
head -100 pmoves/docker-compose.yml | grep -A 3 'x-env\|&id001'Repository: POWERFULMOVES/PMOVES.AI
Length of output: 728
🏁 Script executed:
# Check if there's any default handling in the postgres service definition
cat pmoves/docker-compose.yml | head -50Repository: POWERFULMOVES/PMOVES.AI
Length of output: 1270
🏁 Script executed:
# Search for how PostgreSQL (pgvector) handles missing passwords
web_search "ankane pgvector docker POSTGRES_PASSWORD empty default"Repository: POWERFULMOVES/PMOVES.AI
Length of output: 117
🏁 Script executed:
# Check the initdb scripts that might handle empty passwords
cat -n pmoves/supabase/initdb/README.md 2>/dev/null || echo "README not found, listing initdb directory:"
ls -la pmoves/supabase/initdb/ 2>/dev/null || echo "Directory listing not available"Repository: POWERFULMOVES/PMOVES.AI
Length of output: 1644
🏁 Script executed:
# Search for any README or documentation about postgres setup
find . -name "README*" -path "*/supabase/*" -o -name "*.md" -path "*/postgres*" 2>/dev/null | head -10Repository: POWERFULMOVES/PMOVES.AI
Length of output: 108
🌐 Web query:
PostgreSQL POSTGRES_PASSWORD empty variable behavior docker
💡 Result:
Short answer: The official postgres Docker image requires POSTGRES_PASSWORD to be set to a non-empty value at first initialization. If POSTGRES_PASSWORD is empty or unset when the container initializes an empty PGDATA, the entrypoint fails with the error "Database is uninitialized and superuser password is not specified" and the container will exit (unless you explicitly allow insecure auth via POSTGRES_HOST_AUTH_METHOD=trust, which is not recommended). If the data directory is already initialized, changing or omitting POSTGRES_PASSWORD has no effect. You can supply the password from a file using POSTGRES_PASSWORD_FILE instead of an env var. [1][2]
Sources:
- Official postgres image docs (POSTGRES_PASSWORD must not be empty; _FILE support; only applies on initial startup). [1]
- Common error / behavior discussion (Stack Overflow). [2]
🌐 Web query:
ankane pgvector docker container how to set password
💡 Result:
Use the standard PostgreSQL env vars when you run the ankane/pgvector image—set POSTGRES_PASSWORD (and optionally POSTGRES_USER, POSTGRES_DB). Example:
-
Docker run:
docker run --name pgvector -e POSTGRES_USER=myuser -e POSTGRES_PASSWORD=mysecret -e POSTGRES_DB=mydb -p 5432:5432 -d ankane/pgvector -
docker-compose snippet:
services:
postgres:
image: ankane/pgvector
environment:
POSTGRES_USER: myuser
POSTGRES_PASSWORD: mysecret
POSTGRES_DB: mydb
ports:
- "5432:5432"
After start, connect with psql (you’ll be prompted for the password you set). [1][2][3]
Add a safe default or validation for empty POSTGRES_PASSWORD.
The postgres service will fail to start on first initialization if POSTGRES_PASSWORD is empty. The official PostgreSQL image (which ankane/pgvector inherits) requires a non-empty password and exits with "Database is uninitialized and superuser password is not specified" if the password is missing at initial startup.
Either provide a development default fallback (e.g., POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-pmoves} in the postgres service environment, matching the postgrest pattern) or add explicit validation that fails fast with a clear error message before Docker startup is attempted.
🤖 Prompt for AI Agents
In @pmoves/env.tier-data around lines 14 - 15, The POSTGRES_PASSWORD is empty
which causes the Postgres container to fail on initial startup; either provide a
safe development fallback or validate early: add a non-empty default for
POSTGRES_PASSWORD (mirroring the postgrest pattern, e.g., use shell-style
expansion like POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-pmoves}) in the postgres
service environment, or add a startup validation check that errors with a clear
message if POSTGRES_PASSWORD is unset/empty before attempting Docker startup;
update the env.tier-data entry and any docker-compose/service environment
references to use this default or to call the validation.
| # REQUIRED: Generate password with `openssl rand -base64 24` for production deployments | ||
| NEO4J_AUTH= |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Find docker-compose files and check neo4j service configuration
fd -e yml -e yaml | head -20Repository: POWERFULMOVES/PMOVES.AI
Length of output: 1041
🏁 Script executed:
# Search for neo4j service definition and NEO4J_AUTH configuration
rg -i "neo4j" -A 15 --type yaml -g "docker-compose*.yml"Repository: POWERFULMOVES/PMOVES.AI
Length of output: 44362
🏁 Script executed:
# Also check for any environment file references and NEO4J_AUTH usage
rg "NEO4J_AUTH" -B 2 -A 2Repository: POWERFULMOVES/PMOVES.AI
Length of output: 15589
Fix NEO4J_AUTH to provide either a real password or explicitly use none for development.
The empty NEO4J_AUTH= will cause the healthcheck to fail. The docker-compose healthcheck explicitly parses this value with shell parameter expansion (user="${auth%%/*}", pass="${auth#*/}") and runs cypher-shell with those credentials. An empty value results in empty username and password, causing authentication to fail.
Healthcheck command from docker-compose.yml
healthcheck:
test:
- CMD-SHELL
- auth="$$NEO4J_AUTH"; user="$${auth%%/*}"; pass="$${auth#*/}"; /var/lib/neo4j/bin/cypher-shell
-a bolt://localhost:7687 -u "$$user" -p "$$pass" 'RETURN 1' || exit 1Either:
- Generate and set a real password:
NEO4J_AUTH=neo4j/<generated-password>(as the comment instructs) - Or explicitly disable auth for development:
NEO4J_AUTH=none(and adjust the healthcheck accordingly)
🤖 Prompt for AI Agents
In @pmoves/env.tier-data around lines 19 - 20, The NEO4J_AUTH environment entry
is empty which breaks the docker-compose healthcheck parsing; update the
NEO4J_AUTH value to either a proper credential string like
"neo4j/<generated-password>" (generate with openssl rand -base64 24) or
explicitly set it to "none" for development so the healthcheck's auth parsing
(auth="${NEO4J_AUTH}", user="${auth%%/*}", pass="${auth#*/}") and the
cypher-shell call succeed; ensure whichever choice you make is consistent with
the neo4j container auth mode and any healthcheck handling in
docker-compose.yml.
| # REQUIRED: Set unique username for production deployments | ||
| MINIO_ROOT_USER= | ||
| # REQUIRED: Generate with `openssl rand -base64 32` for production deployments | ||
| MINIO_ROOT_PASSWORD= |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Find docker-compose files and search for minio configuration
fd -t f -e yml -e yaml | grep -i docker-composeRepository: POWERFULMOVES/PMOVES.AI
Length of output: 2737
🏁 Script executed:
# Search for minio service definition in docker-compose files
rg -A 20 'minio:' -t yamlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 12088
🏁 Script executed:
# Search for MINIO_ROOT credential references throughout the codebase
rg 'MINIO_ROOT' -t yaml -t sh -t dockerfileRepository: POWERFULMOVES/PMOVES.AI
Length of output: 101
🏁 Script executed:
# Check how env.tier-data is referenced in docker-compose
rg 'env.tier-data' --type yamlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 786
🏁 Script executed:
# Find all env_file references in docker-compose.yml to understand the file merge order
rg 'env_file' pmoves/docker-compose.yml -A 2 -B 2Repository: POWERFULMOVES/PMOVES.AI
Length of output: 6825
🏁 Script executed:
# Check what env files are defined and their variables
head -50 pmoves/env.tier-dataRepository: POWERFULMOVES/PMOVES.AI
Length of output: 1562
Safe defaults confirmed, but production guidance is misleading due to hardcoded override.
Local development is safe—the minio service has MINIO_ROOT_USER=minioadmin hardcoded in docker-compose.yml's environment section, so it works when env.tier-data credentials are empty. However, the environment section will override any values from env.tier-data. This creates a critical issue: users following the production guidance in env.tier-data (lines 28-30) to set unique credentials will have those values silently ignored. For production deployments, either remove the hardcoded MINIO_ROOT_USER=minioadmin from docker-compose.yml and rely on env.tier-data, or update the env.tier-data comments to clarify that minio uses hardcoded credentials and cannot be changed via env.tier-data.
| -- Tenant-scoped read policies for Geometry Bus tables | ||
| -- SECURITY: Uses namespace-based tenant isolation via app.current_tenant setting | ||
| -- NOTE: Set 'app.current_tenant' with SET LOCAL app.current_tenant = 'tenant_name'; | ||
| -- HARDENED: Removed 'pmoves' fallback - requires explicit tenant for all access | ||
| DO $$ | ||
| BEGIN | ||
| IF NOT EXISTS ( | ||
| SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename='anchors' AND policyname='read_anchors_all' | ||
| SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename='anchors' AND policyname='read_anchors_tenant' | ||
| ) THEN | ||
| EXECUTE 'CREATE POLICY read_anchors_all ON public.anchors FOR SELECT USING (true)'; | ||
| EXECUTE 'CREATE POLICY read_anchors_tenant ON public.anchors FOR SELECT USING (namespace = current_setting(''app.current_tenant'', true))'; | ||
| END IF; | ||
| IF NOT EXISTS ( | ||
| SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename='constellations' AND policyname='read_constellations_all' | ||
| SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename='constellations' AND policyname='read_constellations_tenant' | ||
| ) THEN | ||
| EXECUTE 'CREATE POLICY read_constellations_all ON public.constellations FOR SELECT USING (true)'; | ||
| EXECUTE 'CREATE POLICY read_constellations_tenant ON public.constellations FOR SELECT USING (namespace = current_setting(''app.current_tenant'', true))'; | ||
| END IF; | ||
| IF NOT EXISTS ( | ||
| SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename='shape_points' AND policyname='read_shape_points_all' | ||
| SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename='shape_points' AND policyname='read_shape_points_tenant' | ||
| ) THEN | ||
| EXECUTE 'CREATE POLICY read_shape_points_all ON public.shape_points FOR SELECT USING (true)'; | ||
| EXECUTE 'CREATE POLICY read_shape_points_tenant ON public.shape_points FOR SELECT USING (namespace = current_setting(''app.current_tenant'', true))'; | ||
| END IF; | ||
| IF NOT EXISTS ( | ||
| SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename='shape_index' AND policyname='read_shape_index_all' | ||
| SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename='shape_index' AND policyname='read_shape_index_tenant' | ||
| ) THEN | ||
| EXECUTE 'CREATE POLICY read_shape_index_all ON public.shape_index FOR SELECT USING (true)'; | ||
| EXECUTE 'CREATE POLICY read_shape_index_tenant ON public.shape_index FOR SELECT USING (namespace = current_setting(''app.current_tenant'', true))'; | ||
| END IF; |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check for anonymous grants on geometry tables
rg -i 'grant\s+.*\s+on\s+(table\s+)?(public\.)?(anchors|constellations|shape_points|shape_index)\s+to\s+anon' --type sql -g 'pmoves/**/*.sql'Repository: POWERFULMOVES/PMOVES.AI
Length of output: 49
🏁 Script executed:
# Also search more broadly for GRANT statements to anon on any geometry-related tables
rg -i 'grant.*to\s+anon' pmoves/supabase/initdb/ --type sqlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 1780
🏁 Script executed:
# Examine the full SQL file to understand the context and line 13 reference
cat pmoves/supabase/initdb/09_geometry_rls.sqlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 2421
🏁 Script executed:
# Check the 06_media_analysis.sql file mentioned in the review for comparison
fd '06_media_analysis.sql' pmoves/Repository: POWERFULMOVES/PMOVES.AI
Length of output: 154
🏁 Script executed:
# Check the 06_media_analysis.sql file to compare authentication comments
cat pmoves/supabase/initdb/06_media_analysis.sql | head -80Repository: POWERFULMOVES/PMOVES.AI
Length of output: 3184
Add TO authenticated clauses to geometry table RLS policies to match hardening pattern.
The geometry tables have no anon role grants (confirmed), but the RLS policies are missing TO authenticated clauses. The 06_media_analysis.sql file demonstrates the hardening pattern used elsewhere in the codebase:
CREATE POLICY detections_tenant_isolation ON public.detections FOR ALL
TO authenticated
USING (namespace = current_setting('app.current_tenant', true))Update the geometry table policies in 09_geometry_rls.sql to include TO authenticated on each policy. Also update the comment to explicitly state "access via authenticated JWT only" (similar to 06_media_analysis.sql line 57) rather than only mentioning the 'pmoves' fallback removal.
🤖 Prompt for AI Agents
In @pmoves/supabase/initdb/09_geometry_rls.sql around lines 21 - 46, The RLS
policies created by the EXECUTE statements for read_anchors_tenant,
read_constellations_tenant, read_shape_points_tenant, and
read_shape_index_tenant must include the TO authenticated clause and the top
comment should explicitly state "access via authenticated JWT only"; update each
EXECUTE string so it creates the policy with "FOR SELECT TO authenticated USING
(namespace = current_setting(''app.current_tenant'', true))" and edit the header
comment to mirror the hardening pattern (explicitly mention authenticated
JWT-only access).
Actionable Issues Fixed:
1. env.tier-data: NEO4J_AUTH=neo4j/none for healthcheck compatibility
2. env.tier-data: POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-pmoves_dev} fallback
3. 09_geometry_rls.sql: Added TO authenticated clause to all RLS policies
Nitpicks Fixed:
1. env.tier-data: Updated header from "Copy to..." to "Fill in real values..."
2. env.tier-worker: Replaced MinIO minioadmin defaults with empty + REQUIRED
3. env.tier-media: Replaced MinIO minioadmin defaults with empty + REQUIRED
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
Superseded by PR #479 which was merged. |
1 participant
Summary
This PR replaces #476 and #477 with a clean git history that preserves critical services.
Problem
The previous
PMOVES.AI-Edition-Hardenedbranch lost critical production services during merge conflict resolution:pmoves/services/flute-gateway/- Voice communication gatewaypmoves/services/consciousness-service/- CGP/persona servicepmoves/docs/PMOVESCHIT/- CHIT documentationpmoves/env.tier-*- Tier environment filesSolution
Created fresh branch from commit
43697fe6(PR #474 coordination merge) which had all services intact, then restored missing tier env files from main.Files Restored
pmoves/env.tier-*)Changes
🤖 Generated with Claude Code
Summary by CodeRabbit
Bug Fixes
New Features
Chores
✏️ Tip: You can customize this high-level summary in your review settings.