fix(compose): align comfy-watcher MinIO credential variables - #710
Conversation
MINIO_ACCESS_KEY fallback changed from MINIO_ROOT_USER to MINIO_USER and MINIO_SECRET_KEY fallback from MINIO_ROOT_PASSWORD to MINIO_PASSWORD to match the canonical variable names in env.tier-data. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
📝 WalkthroughWalkthroughDocker Compose updated: the comfy-watcher service now sets MinIO credentials using Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pmoves/docker-compose.yml`:
- Around line 2255-2256: Remove the hardcoded "minioadmin" fallback from the
MINIO_ACCESS_KEY and MINIO_SECRET_KEY environment entries so no implicit default
credentials remain; update the MINIO_ACCESS_KEY and MINIO_SECRET_KEY lines to
not fall back to ${MINIO_USER:-minioadmin} or ${MINIO_PASSWORD:-minioadmin}
(e.g., use ${MINIO_ACCESS_KEY} and ${MINIO_SECRET_KEY} or require explicit
values) and ensure any related references to MINIO_USER or MINIO_PASSWORD are
adjusted accordingly so the service fails fast when credentials are not
provided.
There was a problem hiding this comment.
♻️ Duplicate comments (1)
pmoves/docker-compose.yml (1)
2255-2256:⚠️ Potential issue | 🟠 MajorRestore canonical MinIO fallback to avoid auth breakage in existing env setups.
Line 2255 and Line 2256 now require
MINIO_ACCESS_KEY/MINIO_SECRET_KEYonly, so environments that provide onlyMINIO_USER/MINIO_PASSWORDcan end up with empty creds forcomfy-watcher. Keep no default secret, but add canonical fallback (or require canonical vars explicitly).🔧 Proposed fix
- - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY} - - MINIO_SECRET_KEY=${MINIO_SECRET_KEY} + - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-${MINIO_USER:?MINIO_USER is required}} + - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-${MINIO_PASSWORD:?MINIO_PASSWORD is required}}As per coding guidelines, "Preserve cross-platform bring-up behavior (Windows/WSL/Linux, amd64/arm64)."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docker-compose.yml` around lines 2255 - 2256, Restore the canonical MinIO fallback for the comfy-watcher service by making the environment entries for MINIO_ACCESS_KEY and MINIO_SECRET_KEY use the canonical vars when the canonical names are not provided (i.e., fall back to MINIO_USER and MINIO_PASSWORD), rather than leaving them empty; update the env entries that currently set MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY} and MINIO_SECRET_KEY=${MINIO_SECRET_KEY} to use shell-style variable expansion to prefer MINIO_ACCESS_KEY/MINIO_SECRET_KEY but fall back to MINIO_USER/MINIO_PASSWORD, keeping no hardcoded defaults.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@pmoves/docker-compose.yml`:
- Around line 2255-2256: Restore the canonical MinIO fallback for the
comfy-watcher service by making the environment entries for MINIO_ACCESS_KEY and
MINIO_SECRET_KEY use the canonical vars when the canonical names are not
provided (i.e., fall back to MINIO_USER and MINIO_PASSWORD), rather than leaving
them empty; update the env entries that currently set
MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY} and MINIO_SECRET_KEY=${MINIO_SECRET_KEY} to
use shell-style variable expansion to prefer MINIO_ACCESS_KEY/MINIO_SECRET_KEY
but fall back to MINIO_USER/MINIO_PASSWORD, keeping no hardcoded defaults.
Docker Hardening ValidationHardening Validation ReportValidated: Wed 25 Feb 2026 06:54:16 AM UTCServices CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
2 participants
Summary
MINIO_USER/MINIO_PASSWORDinstead ofMINIO_ROOT_USER/MINIO_ROOT_PASSWORDenv.tier-dataTest plan
docker ps --filter health=unhealthyreturns 0 results🤖 Generated with Claude Code
Summary by CodeRabbit