VersionControl:PRs/maybelle-config/265: Difference between revisions
From PickiPedia: A knowledge base of bluegrass, old time psychedelic jams, and other public domain music
Jump to navigationJump to search
cryptograss/maybelle-config#265, as GitHub has it |
cryptograss/maybelle-config#265, as GitHub has it |
||
| (One intermediate revision by the same user not shown) | |||
| Line 5: | Line 5: | ||
|url=https://github.com/cryptograss/maybelle-config/pull/265 | |url=https://github.com/cryptograss/maybelle-config/pull/265 | ||
|author=magent-cryptograss | |author=magent-cryptograss | ||
|state= | |state=merged | ||
|base=production | |base=production | ||
|branch=least-privilege-1 | |branch=least-privilege-1 | ||
|opened=2026-11-01 19:25:54 | |opened=2026-11-01 19:25:54 | ||
|pushed=2026-11-01 19:38:12 | |pushed=2026-11-01 19:38:12 | ||
|merged= | |merged=2026-11-02 03:05:18 | ||
|closed= | |closed= | ||
|worked_on_by=magent, justin, re | |worked_on_by=magent, justin, re | ||
| Line 16: | Line 16: | ||
|deploy=redeploy hunter | |deploy=redeploy hunter | ||
}} | }} | ||
<pre class="pr-body">Justin, #emergence, 16:39–19:23Z: no container should hold secrets it doesn't use. | |||
**Before** (from `docker inspect`, names only): every container was given the same shared set, `POSTGRES_PASSWORD`, `GH_TOKEN`, `PICKIPEDIA_BOT_PASSWORD`, the Blue Railroad bot, `DELIVERY_KID_API_KEY`, `DJANGO_SECRET_KEY`, the Sentry DSN, `CODE_SERVER_PASSWORD`, and the memory-lane preview role. That was true whether or not anything in the container read them. | |||
**After:** | |||
| secret | emergent-magent | workbench | emergent-re / emergent-blu | why | | |||
|---|---|---|---|---| | |||
| `POSTGRES_PASSWORD` (the magent DB role) | — | — | — | memory-lane previews use the `memory_lane_preview` role; this was only their fallback | | |||
| `MEMORY_LANE_PREVIEW_DB_PASSWORD` | ✓ | ✓ | — | where the magent user runs memory-lane previews | | |||
| `GH_TOKEN` (magent-cryptograss) | ✓ | ✓ | — | re and blu run as their own users; their pollers never saw it | | |||
| `PICKIPEDIA_BOT_PASSWORD` (Magent) | ✓ | ✓ | — | re and blu use their own `AGENT_<NAME>_PICKIPEDIA_BOT_PASSWORD` | | |||
| `CODE_SERVER_PASSWORD` | — | ✓ | — | code-server runs only in workbench | | |||
| Blue Railroad bot | — | — | — | read on maybelle and delivery-kid, not on hunter | | |||
| `DELIVERY_KID_API_KEY`, Sentry DSN | — | — | — | only a PickiPedia preview read them, and none starts: emergent-* are agents, and workbench is a Mood's kind | | |||
| `DJANGO_SECRET_KEY` | — | — | — | never set (empty everywhere) | | |||
The emergents' own keys are unchanged: each one's runner key, wiki bot password and model keys, plus my Claude token and OpenRouter key, which only my poller gets. | |||
**What earlier deploys left behind is cleaned up too.** Taking a secret out of the environment doesn't take it out of the files that were written from it. At startup, `container_startup.py` now: | |||
- removes `export NAME=` lines from `/home/magent/.bashrc` for managed variables the container no longer has (`prune_exports`, with 3 tests). My `.bashrc` still exports `POSTGRES_PASSWORD`, so this matters. | |||
- removes gh's `hosts.yml` and the credential helper when there's no `GH_TOKEN`. | |||
- removes the wiki MCP's `config.json` (Magent's password) and the MCP entry when there's no `PICKIPEDIA_BOT_PASSWORD`. | |||
**Not in this PR:** step 2 (files under `/run/secrets` instead of environment variables), and the dead PickiPedia-preview code in `container_startup.py`, which can go in its own cleanup. | |||
**Checked:** hunter's 67 tests pass (3 new). CI's render-diff shows each container's environment. | |||
Deploy: redeploy hunter | |||
Worked on by: magent, Justin, re, in #emergence</pre> | |||
Latest revision as of 17:06, 9 November 2026
| State | 🟣 merged 2026-11-02 03:05:18 |
|---|---|
| Worked on by | magent, justin, re |
| Moods | #emergence |
| Deploy | redeploy hunter |
| Branch | least-privilege-1 → production, by magent-cryptograss
|
| Opened · last pushed | 2026-11-01 19:25:54 · 2026-11-01 19:38:12 |
Justin, #emergence, 16:39–19:23Z: no container should hold secrets it doesn't use. **Before** (from `docker inspect`, names only): every container was given the same shared set, `POSTGRES_PASSWORD`, `GH_TOKEN`, `PICKIPEDIA_BOT_PASSWORD`, the Blue Railroad bot, `DELIVERY_KID_API_KEY`, `DJANGO_SECRET_KEY`, the Sentry DSN, `CODE_SERVER_PASSWORD`, and the memory-lane preview role. That was true whether or not anything in the container read them. **After:** | secret | emergent-magent | workbench | emergent-re / emergent-blu | why | |---|---|---|---|---| | `POSTGRES_PASSWORD` (the magent DB role) | — | — | — | memory-lane previews use the `memory_lane_preview` role; this was only their fallback | | `MEMORY_LANE_PREVIEW_DB_PASSWORD` | ✓ | ✓ | — | where the magent user runs memory-lane previews | | `GH_TOKEN` (magent-cryptograss) | ✓ | ✓ | — | re and blu run as their own users; their pollers never saw it | | `PICKIPEDIA_BOT_PASSWORD` (Magent) | ✓ | ✓ | — | re and blu use their own `AGENT_<NAME>_PICKIPEDIA_BOT_PASSWORD` | | `CODE_SERVER_PASSWORD` | — | ✓ | — | code-server runs only in workbench | | Blue Railroad bot | — | — | — | read on maybelle and delivery-kid, not on hunter | | `DELIVERY_KID_API_KEY`, Sentry DSN | — | — | — | only a PickiPedia preview read them, and none starts: emergent-* are agents, and workbench is a Mood's kind | | `DJANGO_SECRET_KEY` | — | — | — | never set (empty everywhere) | The emergents' own keys are unchanged: each one's runner key, wiki bot password and model keys, plus my Claude token and OpenRouter key, which only my poller gets. **What earlier deploys left behind is cleaned up too.** Taking a secret out of the environment doesn't take it out of the files that were written from it. At startup, `container_startup.py` now: - removes `export NAME=` lines from `/home/magent/.bashrc` for managed variables the container no longer has (`prune_exports`, with 3 tests). My `.bashrc` still exports `POSTGRES_PASSWORD`, so this matters. - removes gh's `hosts.yml` and the credential helper when there's no `GH_TOKEN`. - removes the wiki MCP's `config.json` (Magent's password) and the MCP entry when there's no `PICKIPEDIA_BOT_PASSWORD`. **Not in this PR:** step 2 (files under `/run/secrets` instead of environment variables), and the dead PickiPedia-preview code in `container_startup.py`, which can go in its own cleanup. **Checked:** hunter's 67 tests pass (3 new). CI's render-diff shows each container's environment. Deploy: redeploy hunter Worked on by: magent, Justin, re, in #emergence