hardened: layered local bring-up + archon/env + monitoring alignment - #624
Conversation
Docker Hardening ValidationHardening Validation ReportValidated: Sun 15 Feb 2026 05:59:33 PM UTCServices CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ef076efb75
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| check-tier-envs: ## Validate all tier environment files exist | ||
| @echo "Checking tier environment files..." | ||
| @missing=""; \ | ||
| for tier in data supabase api llm worker media agent ui; do \ | ||
| if [ ! -f "env.tier-$$tier" ]; then \ | ||
| if [ -f "env.tier-$$tier.example" ]; then \ | ||
| echo "⚠️ WARNING: env.tier-$$tier missing (example exists)"; \ | ||
| echo " Copy from example: cp env.tier-$$tier.example env.tier-$$tier"; \ | ||
| else \ | ||
| echo "❌ ERROR: env.tier-$$tier missing (no example found)"; \ | ||
| missing="$$missing env.tier-$$tier"; \ | ||
| fi; \ | ||
| fi; \ | ||
| done; \ | ||
| if [ -n "$$missing" ]; then \ | ||
| echo ""; \ | ||
| echo "Missing tier files will cause services to fail or use defaults."; \ | ||
| echo "Create missing files from their .example counterparts."; \ | ||
| exit 1; \ | ||
| fi; \ | ||
| echo "✓ All tier env files exist." | ||
| @$(PYTHON) tools/check_tier_envs.py |
There was a problem hiding this comment.
check-tier-envs now runs tools/check_tier_envs.py, but that file is not present in the repository (I checked with rg --files), so make up fails before starting any services because up depends on this target. The previous inline shell validation was removed in this commit, so this is a new hard failure on a clean clone unless an untracked local script happens to exist.
Useful? React with 👍 / 👎.
| # Core stack files for the default project. Optional stacks (n8n/monitoring/external/agents overlays) | ||
| # are layered by their own targets explicitly. | ||
| STACK_FILES ?= \ | ||
| -f docker-compose.yml \ | ||
| -f docker-compose.n8n.yml \ | ||
| $(VOICE_STACK_FILE) \ | ||
| $(N8N_DB_STACK_FILE) \ | ||
| -f docker-compose.comfyui.yml \ | ||
| -f docker-compose.ultimate-tts-studio.yml \ | ||
| -f docker-compose.external.yml \ | ||
| -f docker-compose.archon.submodule.yml \ | ||
| -f docker-compose.archon-ui.submodule.yml \ | ||
| -f monitoring/docker-compose.monitoring.yml | ||
|
|
||
| DC := $(LOAD_ENV_SHARED) docker compose -p $(PROJECT) --project-directory $(CURDIR) $(STACK_FILES) | ||
| -f docker-compose.yml |
There was a problem hiding this comment.
STACK_FILES was reduced to only docker-compose.yml, but several existing targets still call services that are defined only in overlay files (for example archon-ui in docker-compose.archon-ui.submodule.yml and comfyui in docker-compose.comfyui.yml), so those targets now fail with no such service when invoked. This regresses common operational commands like make up-agents-ui and make up-comfyui.
Useful? React with 👍 / 👎.
| SUPABASE_BOOT_USER_PASSWORD=osgtIMMIqerQ0gLcC=7qxilYHZ3w4MD1 | ||
| SUPABASE_BOOT_USER_JWT=eyJhbGciOiJFUzI1NiIsImtpZCI6ImI4MTI2OWYxLTIxZDgtNGYyZS1iNzE5LWMyMjQwYTg0MGQ5MCIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjY1NDIxL2F1dGgvdjEiLCJzdWIiOiI0MmIyZWI0OC1jNjRkLTQ2NTgtYTZiNC1lOGJjNmEwZjc1NTgiLCJhdWQiOiJhdXRoZW50aWNhdGVkIiwiZXhwIjoxNzcxMTAwNjg4LCJpYXQiOjE3NzEwOTcwODgsImVtYWlsIjoib3BlcmF0b3JAcG1vdmVzLmxvY2FsIiwicGhvbmUiOiIiLCJhcHBfbWV0YWRhdGEiOnsicHJvdmlkZXIiOiJlbWFpbCIsInByb3ZpZGVycyI6WyJlbWFpbCJdLCJyb2xlIjoicG1vdmVzLm9wZXJhdG9yIn0sInVzZXJfbWV0YWRhdGEiOnsiZW1haWxfdmVyaWZpZWQiOnRydWV9LCJyb2xlIjoiYXV0aGVudGljYXRlZCIsImFhbCI6ImFhbDEiLCJhbXIiOlt7Im1ldGhvZCI6InBhc3N3b3JkIiwidGltZXN0YW1wIjoxNzcxMDk3MDg4fV0sInNlc3Npb25faWQiOiJhMDMyMDNkNC0wNzUyLTQwMzEtYjZkYS00ZDZiYzY2ZWY5M2UiLCJpc19hbm9ueW1vdXMiOmZhbHNlfQ.Tnhzsq1sjYmd_9PaiWSitLwrCxbFZwRpTswl1cZhY-O3J5JF3fPoC2jX40UX71zDPHLnd56HmWiy10EgDOdBWg |
There was a problem hiding this comment.
This commit adds concrete secrets to the tracked env.shared (including a boot-user password and JWT), which exposes credentials to anyone with repository access and makes accidental reuse across environments likely. These values should be placeholders in VCS and injected via ignored local env files or secret storage, especially since this repo’s guidance explicitly says not to commit secrets.
Useful? React with 👍 / 👎.
Docker Hardening ValidationHardening Validation ReportValidated: Sun Feb 15 19:16:35 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
Docker Hardening ValidationHardening Validation ReportValidated: Sun 15 Feb 2026 07:17:31 PM UTCServices CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
Docker Hardening ValidationHardening Validation ReportValidated: Mon 16 Feb 2026 12:13:06 AM UTCServices CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Docker Hardening ValidationHardening Validation ReportValidated: Mon 16 Feb 2026 12:16:42 AM UTCServices CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
3 participants
Summary\n- add deterministic layered local bring-up target (�ringup-layered) and topology-aware production smoke harness (pmoves/tools/smoke_prod.py)\n- fix Archon runtime wiring for Supabase CLI mode and authenticated NATS defaults across env templates\n- align monitoring network attachments and Prometheus scrape/probe targets with actual PMOVES runtime topology\n\n## Commits\n1. 826fda2 feat(ops): add layered local bring-up and topology-aware prod smoke\n2. 3e5d5dc fix(archon): align cli supabase wiring and authenticated NATS defaults\n3. �f076efb fix(monitoring): wire pmoves networks and correct scrape/probe targets\n\n## Validation\n- SUPABASE_RUNTIME=cli make -C pmoves bringup-layered ✅\n- SUPABASE_RUNTIME=cli make -C pmoves smoke-prod ✅\n- SUPABASE_RUNTIME=cli make -C pmoves monitoring-smoke-prod ✅ (with realtime-dev policy warning in CLI mode)\n\n## Notes\n- In CLI mode, monitoring smoke defaults realtime-dev policy to warn; compose/kong mode remains orbid by default for production gating.\n- This PR is scoped to local-first certification and topology correctness; publish/deploy workflows are intentionally unchanged.