VersionControl:PRs/maybelle-config/255

maybelle-config#255: hunter: a Mood's own container, on demand (mood-<id>), without a redeploy

State	🔴 closed 2026-11-01 10:01:37
Worked on by	magent, justin
Moods	#emergence
Deploy	redeploy hunter (after maybelle, for magenta#343)
Branch	mood-containers → production, by magent-cryptograss
Opened · last pushed	2026-11-01 06:08:59 · 2026-11-01 06:09:52

The hunter half of on-demand Mood containers (Justin, #emergence, 1 Nov). The magenta half is cryptograss/magenta#343, which must be merged and deployed first.

**The mood-containers role**
- `hunter-mood-containers` runs every minute (systemd timer). It asks magenta `GET /api/containers/` with `/etc/magenta/access-key`, the key the SSH router already reports with, so there's no new secret. For each Mood:
  - **wanted:** makes `/opt/magenta/mood-<id>/` (home, workspace, `.claude` with magent's instructions and settings, git identity, `.ssh/authorized_keys` with every person's key), writes its compose file, and runs `docker compose up -d` every time. Compose recreates only if the file changed, as with a renamed Mood or a new image. It writes `/etc/caddy/moods.d/mood-<id>.caddy` and reloads Caddy only when that file changed.
  - **no longer wanted:** `docker compose down`, and its Caddy file is removed. **Its files stay on disk.**
  - It reports `running`, `starting`, `failed` (with docker's error) or `stopped`, but only when the state changes.
- **Ports come from the Mood's id**, so nothing has to remember them: ssh `2300+id` (ufw opens `2300:2999`), code-server `19000+id` and previews `20000+id*10..+9`, both on 127.0.0.1 behind Caddy.
- **Hostnames follow the slug:** `<slug>0-9.hunter.cryptograss.live` and `code.<slug>.hunter…`. Old slugs `redir` to the new ones. A host the deploy's own Caddyfile already serves is left to it. The wildcard DNS already resolves them all.
- **No docker.sock** and no person's keys inside. The secrets every Mood container shares (magent's GitHub token, runner key, subscription, bot passwords) come from the vault into `mood.env` (0600), the same set a Mood's container gets in `docker-compose.yml.j2`. The template says to keep the two in step.
- The Caddyfile imports `/etc/caddy/moods.d/*.caddy`, and the playbook makes that directory before Caddy starts.

**The pollers** (`container_startup.py`)
- `MOOD_CONTAINER=mood-<id>`: `--container mood-<id> --only-poller yes`. It answers its Mood and the Mood's threads, starting their sessions there, over from the record if their last session lived elsewhere.
- justin-arthel's magent poller (no Mood): `--leave-containers yes`, so it passes those Moods by.
- The hand-made Mood containers (uploads-and-embeds, docs-tests-qa) keep `--moods <slug>` and are unchanged.

**Checked**
- `hunter/ansible/roles/mood-containers/test_mood_containers.py`, 6 tests with magenta and docker stubbed: up with home, ports, previews and redirects; no docker.sock; reports only on change; let go means down with files kept; a host the deploy serves is left alone; a failed start is reported; strange ids and slugs are passed by.
- `test_container_startup.py`: a new test for which poller answers where. All hunter tests pass (51), and the YAML parses.
- **Not yet run on hunter.** The first real container is the test. Expect the first ask to take up to a minute, then the time to start the container.

**Order:** magenta#343 merged and maybelle redeployed (migration 0043), then this merged and hunter redeployed.

Deploy: redeploy hunter (after maybelle, for magenta#343)
Worked on by: magent, Justin, in #emergence