From fb0b692f83190978ca3eff2419e19d10b9e492d5 Mon Sep 17 00:00:00 2001 From: ginnoir Date: Tue, 25 Aug 2026 15:27:27 -0500 Subject: [PATCH] fix(resume): add ENCRYPTION_SECRET + redis so the AI tab loads The v5 rewrite gates AI features behind two new env vars we never had. Opening the AI Integrations tab calls aiProviders.list, which runs assertCredentialEncryptionConfigured() and throws AI_CREDENTIAL_ENCRYPTION_UNAVAILABLE when ENCRYPTION_SECRET is unset -- so the tab errored on mount instead of rendering. The agent workspace has a second gate: isAgentEnvironmentConfigured() requires ENCRYPTION_SECRET *and* REDIS_URL, so add a dedicated redis to the stack rather than leaving the agent half-broken. Every other redis on the host is on another stack's private network. ENCRYPTION_SECRET encrypts stored provider API keys at rest (schema requires >=32 chars); rotating it makes saved keys undecryptable, so it is pinned like AUTH_SECRET. Co-Authored-By: Claude Opus 5 --- stacks/resume/docker-compose.yml | 19 +++++++++++++++++++ stacks/resume/stack.env | 8 ++++++++ 2 files changed, 27 insertions(+) diff --git a/stacks/resume/docker-compose.yml b/stacks/resume/docker-compose.yml index 00a02d6..40aeb79 100644 --- a/stacks/resume/docker-compose.yml +++ b/stacks/resume/docker-compose.yml @@ -3,6 +3,7 @@ # Volume -> bind-mount conversions (tiered per density policy): # postgres data -> /config/resume/postgres (SSD; DB, low density) # minio data -> /storage1/labdata/resume/minio (ZFS; object store, blobs) +# redis data -> /config/resume/redis (SSD; AI agent stream state) # app uploads -> /storage1/labdata/resume/data (ZFS; blobs, see app below) # The Chrome service is stateless. app + resume-minio join edge (resume.ginnoir.com, # storage.j-costa.com, minio.ginnoir.com); postgres stays private. @@ -69,6 +70,22 @@ services: - EXIT_ON_HEALTH_FAILURE=true - PRE_REQUEST_HEALTH_CHECK=true + redis: + container_name: redis_resume + image: redis:7-alpine + restart: unless-stopped + labels: + - "com.centurylabs.watchtower.enable=false" + networks: [resume] + command: --save 60 1 --loglevel warning + volumes: + - /config/resume/redis:/data + healthcheck: + test: ["CMD", "redis-cli", "ping"] + interval: 10s + timeout: 5s + retries: 5 + app: container_name: resume image: amruthpillai/reactive-resume:latest @@ -88,6 +105,8 @@ services: condition: service_healthy resume-minio: condition: service_healthy + redis: + condition: service_healthy chrome: condition: service_started env_file: diff --git a/stacks/resume/stack.env b/stacks/resume/stack.env index fa9e9d2..ef178ae 100644 --- a/stacks/resume/stack.env +++ b/stacks/resume/stack.env @@ -28,3 +28,11 @@ STORAGE_SECRET_KEY=minioadmin AUTH_SECRET=1b7e96f61f080d04d4bf673d9ea1d9349eb7693cddee5772b6c3f153c88032db5b97efd8570087bc6f340d2cd874aabc1e5c681bc22889921240d6a23738bc7f OAUTH_CLIENT_ID=YpMFNp9q5mGbN8ADM5rUol0ERHmSiTDClJKIVOxK OAUTH_CLIENT_SECRET=mzwjSt0Xtibo156km61T7VYerT48K6ZTa79cEek4mgdky6t1Sjaddlshw2QcJL8727N6qWzddi2ihxNGSpUVMXUBbjNgx4jtkHAy5xtmvqdk9ouIFclyhCgXh9fzjMCA + +# AI features (v5). ENCRYPTION_SECRET encrypts stored AI provider API keys at +# rest (schema requires >=32 chars); without it the AI Integrations tab throws +# AI_CREDENTIAL_ENCRYPTION_UNAVAILABLE. Rotating it makes every saved provider +# key undecryptable, so pin it like AUTH_SECRET. Generate: openssl rand -hex 32 +# REDIS_URL is additionally required by the AI agent workspace (streaming). +ENCRYPTION_SECRET=2310384c2befea91af4bb6cdc5dc0eea2b1e492c0ac61003b64356abecad7a61 +REDIS_URL=redis://redis_resume:6379