fix(paperclip): bind to 0.0.0.0 on kyber to fix k3s ingress 502 - #1507
Conversation
…lures - Extract inline writeShellScript in secure-dotenv to external .sh file - Fix nixfmt drift in ollama/default.nix (multi-line args) - Fix shfmt drift in clipboard_copy_spec.sh (here-string spacing) - Switch Docker cache from GHA to registry-based to avoid auth timeout
…r reinfection Postgres container was compromised via public 0.0.0.0:5432 binding with trust auth. Invert the enable condition so docker-postgres only runs on galactica and matic.
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughSummary by CodeRabbit
WalkthroughThis PR updates the Kyber host configuration to use username Changes
Possibly related PRs
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DRSwitch kyber host user from What changed?
Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors the secure-dotenv module by externalizing its logic into a dedicated shell script and adding comprehensive tests. It also updates the default username for the kyber host and modifies the activation logic for the PostgreSQL service. Feedback identifies a potential logic inversion in the PostgreSQL service configuration and suggests improving the robustness of the secure-dotenv script by using null delimiters to handle filenames with special characters.
I am having trouble creating individual review comments. Click here to see my feedback.
home-manager/services/docker-postgres/default.nix (9)
The logic for enabled has been completely inverted from !(isGalactica || isMatic) to isGalactica || isMatic. This change is not mentioned in the PR description and will result in the service being disabled on kyber (and other hosts that are not Galactica or Matic). Please confirm if this was intentional or a regression.
home-manager/modules/secure-dotenv/secure-dotenv.sh (7-10)
To robustly handle filenames that might contain special characters or newlines, it is recommended to use -print0 with find and read -d ''. This is a safer way to parse command output in shell scripts and aligns with the general rule regarding robust parsing.
@find@ "${HOME_DIR}" \
-maxdepth 4 \
\( -name '.env' -o -name '.env.*' -o -name '*.env' \) \
-print0 2>/dev/null | while IFS= read -r -d '' f; do
References
- To robustly parse command output in shell scripts, use a unique delimiter (e.g., tab) in the format string and read with a matching IFS. This is safer than splitting by spaces with cut, especially when data fields might contain spaces.
MemPalace reads `palace_path` from config but the key was `palace`, causing all writes to go to the default ~/.mempalace/palace instead of the wiki repo. Switch to template-based hydration using builtins.replaceStrings to make the path portable across devices.
Paperclip was binding to 127.0.0.1 but the k3s nginx ingress routes via 172.17.0.1 (Docker bridge), causing connection refused errors.
shunkakinoki
changed the title
1 participant
Summary
paperclip.shunkakinoki.combecause it bound to127.0.0.1:3100while the k3s nginx ingress routes via172.17.0.1(Docker bridge)0.0.0.0on kyber in both the config hydration template and the systemd service environment127.0.0.1Test plan
systemctl --user restart paperclippaperclip.shunkakinoki.comreturns 200