[P0-30] Fix Docker, Compose, launcher, configuration, and secret-handling failures #38

New issue

Open

opened 2026-07-22 00:16:04 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-07-22 00:16:04 +00:00

(Migrated from github.com)

Confirmed defects

Docker image

The Nix package wraps star-server, moving the real executable to a sibling wrapper target. The Docker build copies only result/bin/star-server into a Debian runtime image. That wrapper references Nix-store paths and the hidden wrapped executable/closure, which are not copied. The runtime image is therefore not self-contained.

Compose

Server defaults point to localhost inside its container; Compose does not set CouchDB/Rabbit service hosts.
Default admin/password and guest/guest credentials are hardcoded.
CouchDB, RabbitMQ, management UI, and HTTP API are all published to the host.
No Valkey service/health checks or dependency readiness model.

Launcher/config

launch.sh runs start ./init.lisp instead of start -i ./init.lisp.
Many settings ignore environment variables: ports, Rabbit credentials, CouchDB scheme, HTTP port/TLS, thread budget, and limits.
HTTP base path, scheme, cert, and key settings are not applied by the server.

Required changes

Build a self-contained runtime image by copying the full closure or using a Nix-produced OCI image/runtime layer.
Run as a non-root user with read-only filesystem where possible.
Use service DNS names, health checks, and dependency readiness.
Require externally supplied secrets; provide separate explicit development defaults.
Do not publish database/broker ports in production Compose.
Add Valkey and authenticated internal networking.
Replace executable Lisp init as the default configuration mechanism with a validated data config; retain explicit trusted extension hooks separately.

Acceptance tests

Clean image starts without a Nix store mounted.
Compose reaches CouchDB, RabbitMQ, and Valkey by service name.
Production config refuses default credentials.
TLS/base-path/config settings change observed behavior.
Launcher passes the selected init/config path correctly.

## Confirmed defects ### Docker image The Nix package wraps `star-server`, moving the real executable to a sibling wrapper target. The Docker build copies only `result/bin/star-server` into a Debian runtime image. That wrapper references Nix-store paths and the hidden wrapped executable/closure, which are not copied. The runtime image is therefore not self-contained. ### Compose - Server defaults point to localhost inside its container; Compose does not set CouchDB/Rabbit service hosts. - Default admin/password and guest/guest credentials are hardcoded. - CouchDB, RabbitMQ, management UI, and HTTP API are all published to the host. - No Valkey service/health checks or dependency readiness model. ### Launcher/config - `launch.sh` runs `start ./init.lisp` instead of `start -i ./init.lisp`. - Many settings ignore environment variables: ports, Rabbit credentials, CouchDB scheme, HTTP port/TLS, thread budget, and limits. - HTTP base path, scheme, cert, and key settings are not applied by the server. ## Required changes - Build a self-contained runtime image by copying the full closure or using a Nix-produced OCI image/runtime layer. - Run as a non-root user with read-only filesystem where possible. - Use service DNS names, health checks, and dependency readiness. - Require externally supplied secrets; provide separate explicit development defaults. - Do not publish database/broker ports in production Compose. - Add Valkey and authenticated internal networking. - Replace executable Lisp init as the default configuration mechanism with a validated data config; retain explicit trusted extension hooks separately. ## Acceptance tests - Clean image starts without a Nix store mounted. - Compose reaches CouchDB, RabbitMQ, and Valkey by service name. - Production config refuses default credentials. - TLS/base-path/config settings change observed behavior. - Launcher passes the selected init/config path correctly.