Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

modules/letta/files/config.json

@@ -0,0 +1,3 @@
+{
+  "password": "${secret:server-password}"
+}

modules/letta/files/pgpass

@@ -0,0 +1 @@
+*:*:*:${bound:postgres-database:as}:${secret:postgres-database}

modules/letta/files/server.env

@@ -0,0 +1,6 @@
+LETTA_PG_URI=postgresql://${bound:postgres-database:as}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}
+PGPASSFILE=/run/secrets/pgpass
+LETTA_SERVER_PASSWORD=${secret:server-password}
+OPENAI_API_KEY=${secret:openai-api-key}
+SECURE=true
+TZ=Europe/Brussels

modules/letta/files/start.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+# Generated by the mesh. Do not edit: module letta writes this file and replaces it at every push.
+#
+# letta 0.6.8 prints secrets it is given to its log (novox/hq issue 268):
+#   letta/server/rest_api/app.py prints its server password when it starts in secure mode;
+#   startup.sh, alembic/env.py and letta/server/server.py print LETTA_PG_URI whole.
+# The URI carries no password (libpq reads it from PGPASSFILE), and the one print of the server
+# password is rewritten before the server starts. Either one failing refuses the start: a letta
+# that does not start says why here, and one that leaks says nothing.
+set -e
+app=/app/letta/server/rest_api/app.py
+sed -i 's/Using secure mode with password: {random_password}/Using secure mode (the password is not printed)/' "$app"
+if grep -q 'print(.*random_password' "$app"; then
+  echo "letta: $app still prints the server password; not starting (novox/hq issue 268)" >&2
+  exit 1
+fi
+case "$LETTA_PG_URI" in
+  *://*:*@*)
+    echo "letta: LETTA_PG_URI carries a password, and letta prints that URI; not starting (novox/hq issue 268)" >&2
+    exit 1
+    ;;
+esac
+exec ./letta/server/startup.sh