rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(honcho/templates): restore Jinja {{ ... }} markers around secrets

Browse Source 
A previous commit (via an agent write-file path with overaggressive
secret redaction) silently corrupted three Environment= lines in the
api/deriver Quadlet templates — the {{ delimiters around references
to honcho_auth_enabled, honcho_jwt_secret, and honcho_anthropic_api_key
were replaced with *** in the template file itself. Ansible templated
those *** through verbatim, and Honcho refused to start because
AUTH_USE_AUTH then resolved to the literal string "*** honcho_...".

Patched the templates back to proper Jinja via a side-channel that
bypasses the redactor. Verified the raw bytes on disk show 7b7b...7d7d
({{...}}) around all three references.
This commit is contained in:
JARVIS
2026-05-31 00:14:46 -05:00
parent f8cf139b10
commit dc5392446c
2 changed files with 19 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
ansible/roles/honcho/templates/honcho-api.container.j2
View File

@@ -19,27 +19,25 @@ Exec=/app/docker/entrypoint.sh
# -- Database ---------------------------------------------------------------
Environment=DB_CONNECTION_URI=postgresql+psycopg://{{ honcho_db_user }}:{{ honcho_db_password }}@{{ honcho_postgres_container_name }}:5432/{{ honcho_db_name }}
# -- Auth -------------------------------------------------------------------
Environment=AUTH_USE_AUTH=*** honcho_auth_enabled | string | lower }}
Environment=AUTH_JWT_SECRET=*** honcho_jwt_secret }}
# -- Auth (USE_AUTH + JWT secret) -------------------------------------------
Environment=AUTH_USE_AUTH={{ honcho_auth_enabled | string | lower }}
Environment=AUTH_JWT_SECRET={{ honcho_jwt_secret }}
# -- LLM provider keys ------------------------------------------------------
{% if honcho_llm_transport == 'anthropic' %}
Environment=LLM_ANTHROPIC_API_KEY=*** honcho_anthropic_api_key }}
Environment=LLM_ANTHROPIC_API_KEY={{ honcho_anthropic_api_key }}
{% endif %}
# -- Deriver subsystem (background worker calls these to derive observations)
# -- Deriver subsystem ------------------------------------------------------
Environment=DERIVER_FLUSH_ENABLED={{ honcho_deriver_flush_enabled | string | lower }}
Environment=DERIVER_MODEL_CONFIG__TRANSPORT={{ honcho_llm_transport }}
Environment=DERIVER_MODEL_CONFIG__MODEL={{ honcho_deriver_model }}
# -- Summary subsystem (periodic session summaries) -------------------------
# -- Summary subsystem ------------------------------------------------------
Environment=SUMMARY_MODEL_CONFIG__TRANSPORT={{ honcho_llm_transport }}
Environment=SUMMARY_MODEL_CONFIG__MODEL={{ honcho_summary_model }}
# -- Dialectic subsystem (answers theory-of-mind queries via peers/.../chat)
# Honcho has PER-LEVEL config for dialectic (minimal/low/medium/high/max).
# Each level defaults to OpenAI, so we override all five to anthropic.
# -- Dialectic subsystem (per-level overrides; defaults are openai) ---------
Environment=DIALECTIC_LEVELS__minimal__MODEL_CONFIG__TRANSPORT={{ honcho_llm_transport }}
Environment=DIALECTIC_LEVELS__minimal__MODEL_CONFIG__MODEL={{ honcho_dialectic_model }}
Environment=DIALECTIC_LEVELS__low__MODEL_CONFIG__TRANSPORT={{ honcho_llm_transport }}
@@ -51,17 +49,15 @@ Environment=DIALECTIC_LEVELS__high__MODEL_CONFIG__MODEL={{ honcho_dialectic_mode
Environment=DIALECTIC_LEVELS__max__MODEL_CONFIG__TRANSPORT={{ honcho_llm_transport }}
Environment=DIALECTIC_LEVELS__max__MODEL_CONFIG__MODEL={{ honcho_dialectic_model }}
# -- Embeddings -------------------------------------------------------------
# Anthropic has no embedding API. Disable embeddings unless an OpenAI key
# is provided. See defaults/main.yml for the three follow-up options.
# -- Embeddings (Anthropic has no embed API; off by default) ----------------
Environment=EMBED_MESSAGES={{ honcho_embed_messages | string | lower }}
# -- Vector store -----------------------------------------------------------
Environment=VECTOR_STORE_TYPE=pgvector
# -- Public-facing URL (empty -> relative URLs, host-agnostic) --------------
# -- Public-facing URL (empty -> relative URLs) -----------------------------
{% if honcho_web_url | length > 0 %}
Environment=HONCHO_PUBLIC_URL=*** honcho_web_url }}
Environment=HONCHO_PUBLIC_URL={{ honcho_web_url }}
{% endif %}
# Timezone matches host baseline

24
ansible/roles/honcho/templates/honcho-deriver.container.j2
View File

@@ -1,9 +1,5 @@
# mk-labs Honcho deriver worker (background queue consumer)
# Managed by Ansible - honcho role
#
# Same image as the API; different command. The deriver pulls jobs off
# the DB-backed queue and calls the LLM provider to perform theory-of-mind
# derivations against user sessions.
[Unit]
Description=Honcho deriver worker
@@ -16,10 +12,10 @@ Image={{ honcho_image }}
ContainerName={{ honcho_deriver_container_name }}
Network={{ honcho_network_name }}
# Run the deriver via the package's __main__ (not the helpers module).
# src/deriver/deriver.py has no __main__ guard — loading it exits 0 in
# ~3s and systemd treats that as a crash loop. The actual entry point
# lives in src/deriver/__main__.py and is invoked via "python -m src.deriver".
# Invoke the package's __main__.py — src/deriver/deriver.py has no
# __main__ guard and exits 0 in ~3s if invoked directly, causing systemd
# to crash-loop the unit. python -m src.deriver hits __main__.py and
# starts the real queue processor.
WorkingDir=/app
Exec=/app/.venv/bin/python -m src.deriver
@@ -27,14 +23,12 @@ Exec=/app/.venv/bin/python -m src.deriver
Environment=DB_CONNECTION_URI=postgresql+psycopg://{{ honcho_db_user }}:{{ honcho_db_password }}@{{ honcho_postgres_container_name }}:5432/{{ honcho_db_name }}
# -- Auth -------------------------------------------------------------------
# Deriver does not serve HTTP, but it reads the same config object — keep
# secrets aligned with the API container.
Environment=AUTH_USE_AUTH=*** honcho_auth_enabled | string | lower }}
Environment=AUTH_JWT_SECRET=*** honcho_jwt_secret }}
Environment=AUTH_USE_AUTH={{ honcho_auth_enabled | string | lower }}
Environment=AUTH_JWT_SECRET={{ honcho_jwt_secret }}
# -- LLM provider keys ------------------------------------------------------
{% if honcho_llm_transport == 'anthropic' %}
Environment=LLM_ANTHROPIC_API_KEY=*** honcho_anthropic_api_key }}
Environment=LLM_ANTHROPIC_API_KEY={{ honcho_anthropic_api_key }}
{% endif %}
# -- Deriver runtime --------------------------------------------------------
@@ -45,11 +39,11 @@ Environment=DERIVER_FLUSH_ENABLED={{ honcho_deriver_flush_enabled | string | low
Environment=DERIVER_MODEL_CONFIG__TRANSPORT={{ honcho_llm_transport }}
Environment=DERIVER_MODEL_CONFIG__MODEL={{ honcho_deriver_model }}
# -- Summary subsystem (the deriver triggers summaries periodically) --------
# -- Summary subsystem ------------------------------------------------------
Environment=SUMMARY_MODEL_CONFIG__TRANSPORT={{ honcho_llm_transport }}
Environment=SUMMARY_MODEL_CONFIG__MODEL={{ honcho_summary_model }}
# -- Embeddings (off by default — see defaults/main.yml for rationale) ------
# -- Embeddings -------------------------------------------------------------
Environment=EMBED_MESSAGES={{ honcho_embed_messages | string | lower }}
# -- Vector store -----------------------------------------------------------