Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

modules/letta/files/config.json

@@ -0,0 +1,3 @@
+{
+  "password": "${secret:server-password}"
+}

modules/letta/files/pgpass

@@ -0,0 +1 @@
+*:*:*:${bound:postgres-database:as}:${secret:postgres-database}

modules/letta/files/server.env

@@ -0,0 +1,6 @@
+LETTA_PG_URI=postgresql://${bound:postgres-database:as}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}
+PGPASSFILE=/run/secrets/pgpass
+LETTA_SERVER_PASSWORD=${secret:server-password}
+OPENAI_API_KEY=${secret:openai-api-key}
+SECURE=true
+TZ=Europe/Brussels

modules/letta/files/start.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+# Generated by the mesh. Do not edit: module letta writes this file and replaces it at every push.
+#
+# letta 0.6.8 prints secrets it is given to its log (novox/hq issue 268):
+#   letta/server/rest_api/app.py prints its server password when it starts in secure mode;
+#   startup.sh, alembic/env.py and letta/server/server.py print LETTA_PG_URI whole.
+# The URI carries no password (libpq reads it from PGPASSFILE), and the one print of the server
+# password is rewritten before the server starts. Either one failing refuses the start: a letta
+# that does not start says why here, and one that leaks says nothing.
+set -e
+app=/app/letta/server/rest_api/app.py
+sed -i 's/Using secure mode with password: {random_password}/Using secure mode (the password is not printed)/' "$app"
+if grep -q 'print(.*random_password' "$app"; then
+  echo "letta: $app still prints the server password; not starting (novox/hq issue 268)" >&2
+  exit 1
+fi
+case "$LETTA_PG_URI" in
+  *://*:*@*)
+    echo "letta: LETTA_PG_URI carries a password, and letta prints that URI; not starting (novox/hq issue 268)" >&2
+    exit 1
+    ;;
+esac
+exec ./letta/server/startup.sh

modules/letta/module.json

@@ -47,6 +47,14 @@
       "why": "the Letta agent server REST API and web UI, password-protected (--secure); a public name is the route's"
     }
   ],
+  "config": {
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach Letta at, as a URL; unset, the code falls back to its environment, else this machine's Letta on port 8283.",
+      "trusted": true,
+      "default": ""
+    }
+  },
   "resources": [
     {
       "id": "mesh-state",
@@ -65,21 +73,21 @@
       "type": "file",
       "path": "${dir:state}/server.env",
       "mode": "0600",
-      "content": "LETTA_PG_URI=postgresql://${bound:postgres-database:as}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nPGPASSFILE=/run/secrets/pgpass\nLETTA_SERVER_PASSWORD=${secret:server-password}\nOPENAI_API_KEY=${secret:openai-api-key}\nSECURE=true\nTZ=Europe/Brussels\n"
+      "template": "files/server.env"
     },
     {
       "id": "pgpass",
       "type": "file",
       "path": "${dir:state}/pgpass",
       "mode": "0600",
-      "content": "*:*:*:${bound:postgres-database:as}:${secret:postgres-database}\n"
+      "template": "files/pgpass"
     },
     {
       "id": "start",
       "type": "file",
       "path": "${dir:state}/start.sh",
       "mode": "0644",
-      "content": "#!/bin/sh\n# Generated by the mesh. Do not edit: module letta writes this file and replaces it at every push.\n#\n# letta 0.6.8 prints secrets it is given to its log (novox/hq issue 268):\n#   letta/server/rest_api/app.py prints its server password when it starts in secure mode;\n#   startup.sh, alembic/env.py and letta/server/server.py print LETTA_PG_URI whole.\n# The URI carries no password (libpq reads it from PGPASSFILE), and the one print of the server\n# password is rewritten before the server starts. Either one failing refuses the start: a letta\n# that does not start says why here, and one that leaks says nothing.\nset -e\napp=/app/letta/server/rest_api/app.py\nsed -i 's/Using secure mode with password: {random_password}/Using secure mode (the password is not printed)/' \"$app\"\nif grep -q 'print(.*random_password' \"$app\"; then\n  echo \"letta: $app still prints the server password; not starting (novox/hq issue 268)\" >&2\n  exit 1\nfi\ncase \"$LETTA_PG_URI\" in\n  *://*:*@*)\n    echo \"letta: LETTA_PG_URI carries a password, and letta prints that URI; not starting (novox/hq issue 268)\" >&2\n    exit 1\n    ;;\nesac\nexec ./letta/server/startup.sh\n"
+      "template": "files/start.sh"
     },
     {
       "id": "net",
@@ -113,8 +121,9 @@
       "type": "file",
       "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
-      "content": "{\n  \"password\": \"${secret:server-password}\"\n}\n",
+      "template": "files/config.json",
       "merge": "json",
+      "takes-config": ["url"],
       "protected": ["password"]
     }
   ],
@@ -134,6 +143,11 @@
           "MESH_LETTA_URL": "http://127.0.0.1:${port:8283}",
           "MESH_LETTA_CONFIG_FILE": "${dir:mesh-state}/config.json"
         }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
       }
     ]
   }