VersionControl:PRs/maybelle-config/265 - Revision history

DrivingThatTrain: cryptograss/maybelle-config#265, as GitHub has it

2026-11-09T17:06:27Z

cryptograss/maybelle-config#265, as GitHub has it

← Older revision		Revision as of 17:06, 9 November 2026
Line 16:		Line 16:
	\|deploy=redeploy hunter		\|deploy=redeploy hunter
	}}		}}
			<pre class="pr-body">Justin, #emergence, 16:39–19:23Z: no container should hold secrets it doesn't use.

			Before (from `docker inspect`, names only): every container was given the same shared set, `POSTGRES_PASSWORD`, `GH_TOKEN`, `PICKIPEDIA_BOT_PASSWORD`, the Blue Railroad bot, `DELIVERY_KID_API_KEY`, `DJANGO_SECRET_KEY`, the Sentry DSN, `CODE_SERVER_PASSWORD`, and the memory-lane preview role. That was true whether or not anything in the container read them.

			After:

			\| secret \| emergent-magent \| workbench \| emergent-re / emergent-blu \| why \|
			\|---\|---\|---\|---\|---\|
			\| `POSTGRES_PASSWORD` (the magent DB role) \| — \| — \| — \| memory-lane previews use the `memory_lane_preview` role; this was only their fallback \|
			\| `MEMORY_LANE_PREVIEW_DB_PASSWORD` \| ✓ \| ✓ \| — \| where the magent user runs memory-lane previews \|
			\| `GH_TOKEN` (magent-cryptograss) \| ✓ \| ✓ \| — \| re and blu run as their own users; their pollers never saw it \|
			\| `PICKIPEDIA_BOT_PASSWORD` (Magent) \| ✓ \| ✓ \| — \| re and blu use their own `AGENT_<NAME>_PICKIPEDIA_BOT_PASSWORD` \|
			\| `CODE_SERVER_PASSWORD` \| — \| ✓ \| — \| code-server runs only in workbench \|
			\| Blue Railroad bot \| — \| — \| — \| read on maybelle and delivery-kid, not on hunter \|
			\| `DELIVERY_KID_API_KEY`, Sentry DSN \| — \| — \| — \| only a PickiPedia preview read them, and none starts: emergent-* are agents, and workbench is a Mood's kind \|
			\| `DJANGO_SECRET_KEY` \| — \| — \| — \| never set (empty everywhere) \|

			The emergents' own keys are unchanged: each one's runner key, wiki bot password and model keys, plus my Claude token and OpenRouter key, which only my poller gets.

			What earlier deploys left behind is cleaned up too. Taking a secret out of the environment doesn't take it out of the files that were written from it. At startup, `container_startup.py` now:
			- removes `export NAME=` lines from `/home/magent/.bashrc` for managed variables the container no longer has (`prune_exports`, with 3 tests). My `.bashrc` still exports `POSTGRES_PASSWORD`, so this matters.
			- removes gh's `hosts.yml` and the credential helper when there's no `GH_TOKEN`.
			- removes the wiki MCP's `config.json` (Magent's password) and the MCP entry when there's no `PICKIPEDIA_BOT_PASSWORD`.

			Not in this PR: step 2 (files under `/run/secrets` instead of environment variables), and the dead PickiPedia-preview code in `container_startup.py`, which can go in its own cleanup.

			Checked: hunter's 67 tests pass (3 new). CI's render-diff shows each container's environment.

			Deploy: redeploy hunter
			Worked on by: magent, Justin, re, in #emergence</pre>

DrivingThatTrain: cryptograss/maybelle-config#265, as GitHub has it

2026-11-02T03:29:41Z

cryptograss/maybelle-config#265, as GitHub has it

← Older revision		Revision as of 03:29, 2 November 2026
Line 5:		Line 5:
	\|url=https://github.com/cryptograss/maybelle-config/pull/265		\|url=https://github.com/cryptograss/maybelle-config/pull/265
	\|author=magent-cryptograss		\|author=magent-cryptograss
	\|state=~~open~~		\|state=merged
	\|base=production		\|base=production
	\|branch=least-privilege-1		\|branch=least-privilege-1
	\|opened=2026-11-01 19:25:54		\|opened=2026-11-01 19:25:54
	\|pushed=2026-11-01 19:38:12		\|pushed=2026-11-01 19:38:12
	\|merged=		\|merged=2026-11-02 03:05:18
	\|closed=		\|closed=
	\|worked_on_by=magent, justin, re		\|worked_on_by=magent, justin, re

DrivingThatTrain: cryptograss/maybelle-config#265, as GitHub has it

2026-11-01T19:39:14Z

cryptograss/maybelle-config#265, as GitHub has it

← Older revision		Revision as of 19:39, 1 November 2026
Line 9:		Line 9:
	\|branch=least-privilege-1		\|branch=least-privilege-1
	\|opened=2026-11-01 19:25:54		\|opened=2026-11-01 19:25:54
	\|pushed=2026-11-01 19:25:37		\|pushed=2026-11-01 19:38:12
	\|merged=		\|merged=
	\|closed=		\|closed=

DrivingThatTrain: cryptograss/maybelle-config#265, as GitHub has it

2026-11-01T19:25:58Z

cryptograss/maybelle-config#265, as GitHub has it

New page

{{PR
|repo=maybelle-config
|number=265
|title=hunter: ship each container only the secrets it reads (least privilege, step 1)
|url=https://github.com/cryptograss/maybelle-config/pull/265
|author=magent-cryptograss
|state=open
|base=production
|branch=least-privilege-1
|opened=2026-11-01 19:25:54
|pushed=2026-11-01 19:25:37
|merged=
|closed=
|worked_on_by=magent, justin, re
|moods=emergence
|deploy=redeploy hunter
}}