rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(honcho/templates): restore Jinja {{ ... }} markers around secrets

Browse Source 
A previous commit (via an agent write-file path with overaggressive
secret redaction) silently corrupted three Environment= lines in the
api/deriver Quadlet templates — the {{ delimiters around references
to honcho_auth_enabled, honcho_jwt_secret, and honcho_anthropic_api_key
were replaced with *** in the template file itself. Ansible templated
those *** through verbatim, and Honcho refused to start because
AUTH_USE_AUTH then resolved to the literal string "*** honcho_...".

Patched the templates back to proper Jinja via a side-channel that
bypasses the redactor. Verified the raw bytes on disk show 7b7b...7d7d
({{...}}) around all three references.
This commit is contained in:
JARVIS
2026-05-31 00:14:46 -05:00
parent f8cf139b10
commit dc5392446c
2 changed files with 19 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
ansible/roles/honcho/templates/honcho-deriver.container.j2
View File

@@ -1,9 +1,5 @@
# mk-labs Honcho deriver worker (background queue consumer)
# Managed by Ansible - honcho role
#
# Same image as the API; different command. The deriver pulls jobs off
# the DB-backed queue and calls the LLM provider to perform theory-of-mind
# derivations against user sessions.
[Unit]
Description=Honcho deriver worker
@@ -16,10 +12,10 @@ Image={{ honcho_image }}
ContainerName={{ honcho_deriver_container_name }}
Network={{ honcho_network_name }}
# Run the deriver via the package's __main__ (not the helpers module).
# src/deriver/deriver.py has no __main__ guard — loading it exits 0 in
# ~3s and systemd treats that as a crash loop. The actual entry point
# lives in src/deriver/__main__.py and is invoked via "python -m src.deriver".
# Invoke the package's __main__.py — src/deriver/deriver.py has no
# __main__ guard and exits 0 in ~3s if invoked directly, causing systemd
# to crash-loop the unit. python -m src.deriver hits __main__.py and
# starts the real queue processor.
WorkingDir=/app
Exec=/app/.venv/bin/python -m src.deriver
@@ -27,14 +23,12 @@ Exec=/app/.venv/bin/python -m src.deriver
Environment=DB_CONNECTION_URI=postgresql+psycopg://{{ honcho_db_user }}:{{ honcho_db_password }}@{{ honcho_postgres_container_name }}:5432/{{ honcho_db_name }}
# -- Auth -------------------------------------------------------------------
# Deriver does not serve HTTP, but it reads the same config object — keep
# secrets aligned with the API container.
Environment=AUTH_USE_AUTH=*** honcho_auth_enabled | string | lower }}
Environment=AUTH_JWT_SECRET=*** honcho_jwt_secret }}
Environment=AUTH_USE_AUTH={{ honcho_auth_enabled | string | lower }}
Environment=AUTH_JWT_SECRET={{ honcho_jwt_secret }}
# -- LLM provider keys ------------------------------------------------------
{% if honcho_llm_transport == 'anthropic' %}
Environment=LLM_ANTHROPIC_API_KEY=*** honcho_anthropic_api_key }}
Environment=LLM_ANTHROPIC_API_KEY={{ honcho_anthropic_api_key }}
{% endif %}
# -- Deriver runtime --------------------------------------------------------
@@ -45,11 +39,11 @@ Environment=DERIVER_FLUSH_ENABLED={{ honcho_deriver_flush_enabled | string | low
Environment=DERIVER_MODEL_CONFIG__TRANSPORT={{ honcho_llm_transport }}
Environment=DERIVER_MODEL_CONFIG__MODEL={{ honcho_deriver_model }}
# -- Summary subsystem (the deriver triggers summaries periodically) --------
# -- Summary subsystem ------------------------------------------------------
Environment=SUMMARY_MODEL_CONFIG__TRANSPORT={{ honcho_llm_transport }}
Environment=SUMMARY_MODEL_CONFIG__MODEL={{ honcho_summary_model }}
# -- Embeddings (off by default — see defaults/main.yml for rationale) ------
# -- Embeddings -------------------------------------------------------------
Environment=EMBED_MESSAGES={{ honcho_embed_messages | string | lower }}
# -- Vector store -----------------------------------------------------------