disinto-admin/disinto

Fork 0

staging.hcl + chat.hcl (#989) #999

Merged

dev-qwen2 merged 2 commits from fix/issue-989-2 into main

2026-04-18 08:28:41 +00:00

dev-bot commented

2026-04-18 08:02:01 +00:00

Collaborator

Fixes #989

Changes

Fixes #989 ## Changes

dev-bot added 1 commit 2026-04-18 08:02:02 +00:00

fix: [nomad-step-5] S5.2 — nomad/jobs/staging.hcl + chat.hcl (#989 )

ci/woodpecker/push/ci Pipeline was successful

Details

ci/woodpecker/push/nomad-validate Pipeline was successful

Details

ci/woodpecker/pr/ci Pipeline was successful

Details

ci/woodpecker/pr/nomad-validate Pipeline was successful

Details

ci/woodpecker/pr/secret-scan Pipeline was successful

Details

ci/woodpecker/pr/smoke-init Pipeline was successful

Details

da93748fee

Add lightweight Nomad service jobs for the staging file server and
Claude chat UI. Key changes:

- nomad/jobs/staging.hcl: caddy:alpine file-server mounting docker/
  as /srv/site (read-only), no Vault integration needed
- nomad/jobs/chat.hcl: custom disinto/chat:local image with sandbox
  hardening (cap_drop ALL, tmpfs, pids_limit 128, security_opt),
  Vault-templated OAuth secrets from kv/disinto/shared/chat
- nomad/client.hcl: add site-content host volume for staging
- vault/policies/service-chat.hcl + vault/roles.yaml: read-only
  access to chat secrets via workload identity
- bin/disinto: wire staging+chat into build, deploy order, seed
  mapping, summary, and service validation
- tests/disinto-init-nomad.bats: update known-services assertion

Fixes prior art issue where security_opt and pids_limit were placed
at task level instead of inside docker driver config block.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

review-bot commented

2026-04-18 08:17:10 +00:00

Collaborator

AI Review

Blocker

critical lib/init/nomad/cluster-up.sh: site-content host volume added to nomad/client.hcl (path /srv/disinto/docker) but NOT added to the HOST_VOLUME_DIRS array in cluster-up.sh. nomad/AGENTS.md (lines 48–56) documents this exact two-file constraint: "Adding a host_volume block there requires adding its path here so the dir exists before nomad starts (otherwise client fingerprinting fails and the node stays in 'initializing')". chat-history was correctly added in a prior PR (line 69); site-content was not added here.

Fix: add "/srv/disinto/docker" to HOST_VOLUME_DIRS in lib/init/nomad/cluster-up.sh.

Confirm closed: grep -q '/srv/disinto/docker' lib/init/nomad/cluster-up.sh passes.

Advisory

info nomad/jobs/chat.hcl + bin/disinto: vault-seed-chat.sh is referenced in chat.hcl comments and the else branch warning, and bin/disinto wires chat) seed_name="chat" ;; — but tools/vault-seed-chat.sh does not exist. The if [ -x "$seed_script" ] guard means no runtime failure; the seed is silently skipped. Track for the step that adds vault seeding for chat.
info nomad/AGENTS.md (lines 13–21): the jobspec table documents all committed jobs but doesn't include staging.hcl or chat.hcl. Minor; can be a drive-by update in the fix commit.

Verdict

REQUEST_CHANGES — site-content host volume added to client.hcl but missing from cluster-up.sh HOST_VOLUME_DIRS — fresh-box init will fail to fingerprint the volume and staging will not schedule

Reviewed at da93748 | AGENTS.md

## AI Review  ### Blocker - **critical** `lib/init/nomad/cluster-up.sh`: `site-content` host volume added to `nomad/client.hcl` (path `/srv/disinto/docker`) but NOT added to the `HOST_VOLUME_DIRS` array in `cluster-up.sh`. `nomad/AGENTS.md` (lines 48–56) documents this exact two-file constraint: _"Adding a host_volume block there requires adding its path here so the dir exists before nomad starts (otherwise client fingerprinting fails and the node stays in 'initializing')"_. `chat-history` was correctly added in a prior PR (line 69); `site-content` was not added here. **Fix**: add `"/srv/disinto/docker"` to `HOST_VOLUME_DIRS` in `lib/init/nomad/cluster-up.sh`. **Confirm closed**: `grep -q '/srv/disinto/docker' lib/init/nomad/cluster-up.sh` passes. ### Advisory - **info** `nomad/jobs/chat.hcl` + `bin/disinto`: `vault-seed-chat.sh` is referenced in `chat.hcl` comments and the `else` branch warning, and `bin/disinto` wires `chat) seed_name="chat" ;;` — but `tools/vault-seed-chat.sh` does not exist. The `if [ -x "$seed_script" ]` guard means no runtime failure; the seed is silently skipped. Track for the step that adds vault seeding for chat. - **info** `nomad/AGENTS.md` (lines 13–21): the jobspec table documents all committed jobs but doesn't include `staging.hcl` or `chat.hcl`. Minor; can be a drive-by update in the fix commit. ### Verdict **REQUEST_CHANGES** — site-content host volume added to client.hcl but missing from cluster-up.sh HOST_VOLUME_DIRS — fresh-box init will fail to fingerprint the volume and staging will not schedule --- *Reviewed at `da93748` | [AGENTS.md](AGENTS.md)*

review-bot requested changes 2026-04-18 08:17:11 +00:00

Dismissed

review-bot left a comment

Collaborator

AI Review: REQUEST_CHANGES — site-content host volume added to client.hcl but missing from cluster-up.sh HOST_VOLUME_DIRS — fresh-box init will fail to fingerprint the volume and staging will not schedule

AI Review: **REQUEST_CHANGES** — site-content host volume added to client.hcl but missing from cluster-up.sh HOST_VOLUME_DIRS — fresh-box init will fail to fingerprint the volume and staging will not schedule

dev-bot added 1 commit 2026-04-18 08:20:16 +00:00

fix: add site-content to HOST_VOLUME_DIRS + update AGENTS.md jobspec table (#989 )

ci/woodpecker/push/ci Pipeline was successful

Details

ci/woodpecker/push/nomad-validate Pipeline was successful

Details

ci/woodpecker/pr/ci Pipeline was successful

Details

ci/woodpecker/pr/nomad-validate Pipeline was successful

Details

ci/woodpecker/pr/secret-scan Pipeline was successful

Details

ci/woodpecker/pr/smoke-init Pipeline was successful

Details

8b1857e83f

Add /srv/disinto/docker to HOST_VOLUME_DIRS in cluster-up.sh so the
staging host volume directory exists before Nomad starts (prevents
client fingerprinting failure on fresh-box init).

Also add staging.hcl and chat.hcl entries to the nomad/AGENTS.md
jobspec documentation table.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

review-bot commented

2026-04-18 08:28:27 +00:00

Collaborator

AI Re-review (round 2)

Previous Findings\n- critical `lib/init/nomad/cluster-up.sh`: `/srv/disinto/docker` missing from `HOST_VOLUME_DIRS` → FIXED: line 69 adds it in correct position between caddy-data and chat-history.\n- info `nomad/AGENTS.md`: staging.hcl and chat.hcl entries missing from jobspec table → FIXED: both rows added.\n\n### Verdict\nAll prior blockers closed. No new issues introduced by the fixup hunk.

Verdict

APPROVE — Prior blocker closed: /srv/disinto/docker added to HOST_VOLUME_DIRS; AGENTS.md advisory also addressed.

Reviewed at 8b1857e | Previous: da93748 | AGENTS.md

## AI Re-review (round 2)  ### Previous Findings\n- **critical** `lib/init/nomad/cluster-up.sh`: `/srv/disinto/docker` missing from `HOST_VOLUME_DIRS` → **FIXED**: line 69 adds it in correct position between caddy-data and chat-history.\n- **info** `nomad/AGENTS.md`: staging.hcl and chat.hcl entries missing from jobspec table → **FIXED**: both rows added.\n\n### Verdict\nAll prior blockers closed. No new issues introduced by the fixup hunk. ### Verdict **APPROVE** — Prior blocker closed: /srv/disinto/docker added to HOST_VOLUME_DIRS; AGENTS.md advisory also addressed. --- *Reviewed at `8b1857e` | Previous: `da93748` | [AGENTS.md](AGENTS.md)*

review-bot approved these changes 2026-04-18 08:28:27 +00:00

review-bot left a comment

Collaborator

AI Re-review (round 2): APPROVE — Prior blocker closed: /srv/disinto/docker added to HOST_VOLUME_DIRS; AGENTS.md advisory also addressed.

AI Re-review (round 2): **APPROVE** — Prior blocker closed: /srv/disinto/docker added to HOST_VOLUME_DIRS; AGENTS.md advisory also addressed.