selfheal-lab/selfheal-lab-gitops
2
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: ai/harness images 53ff243 (per-run model, usage, Claude provider) and the Anthropic key file

Browse Source 
ai-env·harness 이미지를 53ff243 로 올린다. apply.sh 가 Secret Manager 의
selfheal-anthropic-api-key 를 받아 /run/secrets/anthropic-api-key 로 두고 compose 가
ANTHROPIC_KEY_FILE 로 넘긴다. 값이 없으면 기존처럼 저하 모드로 기동한다.
This commit is contained in:
seon committed 2026-10-14 23:21:50 +09:00
1 parent d390b6a5d4
commit d7ecd59b4c
5 files changed
+8 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

vm/ai-env/apply.sh
+3 -2
View File
@@ -1,7 +1,7 @@
#!/usr/bin/env bash
# AI VM (10.20.0.12), experiment design 6. Idempotent: first boot (startup script) and `make vm-sync` / `make ai-sync`.
# Secrets come from Secret Manager through the VM service account (Terraform design 6.11):
# selfheal-openai-api-key, selfheal-discord-bot-token (registered by the operator), selfheal-k8s-ai-token, selfheal-k8s-ca-cert (make token)
# selfheal-openai-api-key, selfheal-anthropic-api-key, selfheal-discord-bot-token (registered by the operator), selfheal-k8s-ai-token, selfheal-k8s-ca-cert (make token)
# The two operator secrets may not exist yet: the services then start degraded (agent /diagnose 503, hitl without
# gateway) and this script still succeeds, so the VM can be verified before the keys arrive.
# Non-secret settings (Discord IDs, model) are in ai.env (committed); AWS role ARN comes from instance metadata.
@@ -20,12 +20,13 @@ SEC=/opt/selfheal/ai/secrets
mkdir -p "$SEC"; chmod 700 /opt/selfheal/ai "$SEC"
umask 077
secret selfheal-openai-api-key > "$SEC/openai-api-key"
secret selfheal-anthropic-api-key > "$SEC/anthropic-api-key" # Claude Messages API (claude-* model ids); optional until registered
secret selfheal-typesafe-api-key > "$SEC/typesafe-api-key"
secret selfheal-discord-bot-token > "$SEC/discord-bot-token"
secret selfheal-k8s-ai-token > "$SEC/k8s-token"
secret selfheal-k8s-ca-cert > "$SEC/k8s-ca.crt"
unset TOKEN
for f in openai-api-key discord-bot-token typesafe-api-key; do [ -s "$SEC/$f" ] || echo "note: secret $f is empty (not registered yet); service runs degraded" >&2; done
for f in openai-api-key discord-bot-token typesafe-api-key anthropic-api-key; do [ -s "$SEC/$f" ] || echo "note: secret $f is empty (not registered yet); service runs degraded" >&2; done
for f in k8s-token k8s-ca.crt; do [ -s "$SEC/$f" ] || echo "note: $f is empty (run make token on the operator host)" >&2; done
chown -R 10002:10002 "$SEC"; chmod 600 "$SEC"/* # agent/hitl run as uid 10002