feat(cum-tools): deploy rakazo at bot.cumsek.com #24

Merged

marti merged 1 commit from t3/deploy-rakazo-oci-bot into main

2026-10-22 23:50:40 +02:00

marti commented

2026-10-22 23:48:58 +02:00

Owner

Summary

Run Rakazo's app, worker, sandbox supervisor, and web containers on cum-tools via podman. Only web is published (port 5173); it proxies /api and /rpc to the API internally.
Serve it at bot.cumsek.com through cum-services nginx, with a 16m upload limit and unbuffered responses with a 3600s read timeout for streamed agent output.
Provision a rakazo database on cum-services postgres with createrole for the owner, plus a rakazo_app login (row-level security) with its own pg_hba line.
Add a rakazo entry (port, domain, dashboard tile) to cum.nix.
Read all credentials from sops: rakazo/* secrets on cum-tools and postgres/rakazo shared with cum-services. Each container gets only the secrets it uses.
Two deliberate deviations from upstream defaults, for review: SANDBOX_SCREEN_NETWORK=internal (bot computers can reach each other) and SANDBOX_COMPUTER_EGRESS=open (no host iptables egress rules exist here).

Testing

Not run: nix build / nix eval of the cum-tools and cum-services configurations.
Not run: deploy to cum-tools and cum-services.
Before deploying, confirm the sops secrets exist: postgres/rakazo, rakazo/app_db_password, rakazo/better_auth_secret, rakazo/screen_proxy_secret, rakazo/supervisor_token, rakazo/encryption_key.
After deploying, check that bot.cumsek.com loads, that the API migrations apply on first start, and that rakazo_app can connect to the rakazo database.
Check that the first sign-up creates the owner account and that signups are closed afterward.

## Summary - Run Rakazo's app, worker, sandbox supervisor, and web containers on cum-tools via podman. Only `web` is published (port 5173); it proxies `/api` and `/rpc` to the API internally. - Serve it at `bot.cumsek.com` through cum-services nginx, with a 16m upload limit and unbuffered responses with a 3600s read timeout for streamed agent output. - Provision a `rakazo` database on cum-services postgres with `createrole` for the owner, plus a `rakazo_app` login (row-level security) with its own pg_hba line. - Add a `rakazo` entry (port, domain, dashboard tile) to `cum.nix`. - Read all credentials from sops: `rakazo/*` secrets on cum-tools and `postgres/rakazo` shared with cum-services. Each container gets only the secrets it uses. - Two deliberate deviations from upstream defaults, for review: `SANDBOX_SCREEN_NETWORK=internal` (bot computers can reach each other) and `SANDBOX_COMPUTER_EGRESS=open` (no host iptables egress rules exist here). ## Testing - Not run: `nix build` / `nix eval` of the cum-tools and cum-services configurations. - Not run: deploy to cum-tools and cum-services. - Before deploying, confirm the sops secrets exist: `postgres/rakazo`, `rakazo/app_db_password`, `rakazo/better_auth_secret`, `rakazo/screen_proxy_secret`, `rakazo/supervisor_token`, `rakazo/encryption_key`. - After deploying, check that `bot.cumsek.com` loads, that the API migrations apply on first start, and that `rakazo_app` can connect to the `rakazo` database. - Check that the first sign-up creates the owner account and that signups are closed afterward.

marti added 1 commit

2026-10-22 23:48:58 +02:00

feat(cum-tools): deploy rakazo at bot.cumsek.com 73fe8c1f2f

- Run the rakazo api, worker, web and supervisor containers on cum-tools, with bot computers started through the podman socket
- Proxy bot.cumsek.com through cum-services nginx with a 16m upload limit and unbuffered, long-timeout streaming for agent runs
- Provision a rakazo database on cum-services, give its owner CREATEROLE, and allow the rakazo_app login over pg_hba
- Read rakazo secrets from sops and keep the port and dashboard entry in cum.nix

marti merged commit 0cb2339bca into main

2026-10-22 23:50:40 +02:00

marti referenced this pull request from a commit

2026-10-22 23:50:41 +02:00

Merge pull request 'feat(cum-tools): deploy rakazo at bot.cumsek.com' (#24) from t3/deploy-rakazo-oci-bot into main

marti referenced this pull request

2026-10-22 23:51:51 +02:00

feat(secrets): add the rakazo database and app secrets #25