feat: Create authenticated Iroh flavoured bootstrap deployment for Unyt#15
Merged
ThetaSinner merged 4 commits intomainfrom Mar 12, 2026
Merged
feat: Create authenticated Iroh flavoured bootstrap deployment for Unyt#15ThetaSinner merged 4 commits intomainfrom
ThetaSinner merged 4 commits intomainfrom
Conversation
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughReplaces dev-test bootstrap artifacts with a new template-driven hc-auth-iroh-unyt deployment: adds Pulumi config entries for GitHub/OAuth and API tokens, introduces a cloud-init Podman/docker-compose template, updates Pulumi provisioning in main.go to use the template, removes dev-test cloud-init/docker-compose files, updates go.mod, and adds README docs. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan for PR comments
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Collaborator
🍹
|
ThetaSinner
force-pushed
the
create-auth-iroh-unyt-deploy
branch
from
427b02d to
42ce99c
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
main.go (1)
116-125: Extract SSH fingerprint lookup into a shared helper.This block duplicates logic already present in other deploy functions and repeats the same API call pattern.
♻️ Suggested refactor shape
+func getSshFingerprints(ctx *pulumi.Context) ([]string, error) { + getSshKeysResult, err := digitalocean.GetSshKeys(ctx, &digitalocean.GetSshKeysArgs{}, nil) + if err != nil { + return nil, err + } + sshFingerprints := make([]string, 0, len(getSshKeysResult.SshKeys)) + for _, key := range getSshKeysResult.SshKeys { + sshFingerprints = append(sshFingerprints, key.Fingerprint) + } + return sshFingerprints, nil +} + func configureHcAuthIrohUnyt(ctx *pulumi.Context, cloudInitTmpl *template.Template) error { - getSshKeysResult, err := digitalocean.GetSshKeys(ctx, &digitalocean.GetSshKeysArgs{}, nil) - if err != nil { - return err - } - - var sshFingerprints []string - for _, key := range getSshKeysResult.SshKeys { - sshFingerprints = append(sshFingerprints, key.Fingerprint) - } + sshFingerprints, err := getSshFingerprints(ctx) + if err != nil { + return err + }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@main.go` around lines 116 - 125, The SSH fingerprint collection logic in configureHcAuthIrohUnyt duplicates a pattern (digitalocean.GetSshKeys -> iterate getSshKeysResult.SshKeys -> collect key.Fingerprint) used elsewhere; refactor by extracting this into a shared helper (e.g., GetAllSshFingerprints or fetchSshFingerprints) that accepts the Pulumi context and returns ([]string, error), replace the inline block in configureHcAuthIrohUnyt and other deploy functions with calls to that helper, and ensure callers handle the returned error instead of repeating digitalocean.GetSshKeys/getSshKeysResult/sshFingerprints logic.hc-auth-iroh-unyt/cloud-init.yaml.tmpl (1)
14-14: Pin container images by digest for reproducible, safer deploys.Using mutable tags allows unexpected image drift across deployments.
Also applies to: 32-32, 43-43, 56-56
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@hc-auth-iroh-unyt/cloud-init.yaml.tmpl` at line 14, Replace mutable image tags with immutable digests to pin container images; locate each occurrence of the image reference "ghcr.io/holochain/kitsune2_bootstrap_srv:v0.4.0-dev.3" (and the two other occurrences noted) in the cloud-init template and change them to the corresponding SHA256 digest form (e.g. ghcr.io/holochain/kitsune2_bootstrap_srv@sha256:...) by pulling the correct digest from the registry and updating the template, then run the deployment/image pull verification requested to confirm the digest resolves correctly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@hc-auth-iroh-unyt/cloud-init.yaml.tmpl`:
- Around line 37-38: The template currently publishes internal service ports
(e.g., the ports mapping "- \"3000:3000\"" for the auth service and similar for
db:6379), which exposes internal services to the host; change these to not be
host-published by removing the host:container "ports" mappings and instead use
internal-only publication (e.g., replace the ports entries for the auth and db
services with "expose: - '3000'" and "expose: - '6379'" or remove the mappings
entirely), or bind them to localhost only if host access is required
(127.0.0.1:3000), so that the auth (service name "auth"/ports mapping) and db
(service name "db"/ports mapping) are only reachable via the internal
network/reverse proxy.
In `@README.md`:
- Around line 191-203: Fix the README command formatting and typo: wrap the
pulumi config examples and the two shell pipelines in fenced shell blocks,
correct "set is as a secret" to "set it as a secret", and ensure the three
referenced config keys (hc-auth-iroh-unyt:github-client-id,
hc-auth-iroh-unyt:github-client-secret, hc-auth-iroh-unyt:session-secret) and
the api-tokens pipeline (uuidgen | tee api-token.txt | pulumi config set
--secret hc-auth-iroh-unyt:api-tokens) are shown inside ```sh ... ``` blocks for
copy-paste reliability.
---
Nitpick comments:
In `@hc-auth-iroh-unyt/cloud-init.yaml.tmpl`:
- Line 14: Replace mutable image tags with immutable digests to pin container
images; locate each occurrence of the image reference
"ghcr.io/holochain/kitsune2_bootstrap_srv:v0.4.0-dev.3" (and the two other
occurrences noted) in the cloud-init template and change them to the
corresponding SHA256 digest form (e.g.
ghcr.io/holochain/kitsune2_bootstrap_srv@sha256:...) by pulling the correct
digest from the registry and updating the template, then run the
deployment/image pull verification requested to confirm the digest resolves
correctly.
In `@main.go`:
- Around line 116-125: The SSH fingerprint collection logic in
configureHcAuthIrohUnyt duplicates a pattern (digitalocean.GetSshKeys -> iterate
getSshKeysResult.SshKeys -> collect key.Fingerprint) used elsewhere; refactor by
extracting this into a shared helper (e.g., GetAllSshFingerprints or
fetchSshFingerprints) that accepts the Pulumi context and returns ([]string,
error), replace the inline block in configureHcAuthIrohUnyt and other deploy
functions with calls to that helper, and ensure callers handle the returned
error instead of repeating
digitalocean.GetSshKeys/getSshKeysResult/sshFingerprints logic.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
flake.lockis excluded by!**/*.lockgo.sumis excluded by!**/*.sum
📒 Files selected for processing (5)
Pulumi.network-services.yamlREADME.mdgo.modhc-auth-iroh-unyt/cloud-init.yaml.tmplmain.go
There was a problem hiding this comment.
🧹 Nitpick comments (1)
main.go (1)
24-27: Consider addingmissingkey=erroroption for defensive template handling.The template currently renders without errors because all required placeholders (
GithubClientId,GithubClientSecret,SessionSecret,ApiTokens) are provided in the data map. However, addingOption("missingkey=error")would cause template execution to fail fast if a placeholder is added to the template without corresponding data, preventing silently-rendered empty values in cloud-init configuration.Suggested improvement
-hcAuthIrohUnytCloudInitTmpl, err := template.New("hc-auth-iroh-unyt-cloud-init").Parse(string(hcAuthIrohUnytCloudInitBytes)) +hcAuthIrohUnytCloudInitTmpl, err := template.New("hc-auth-iroh-unyt-cloud-init"). + Option("missingkey=error"). + Parse(string(hcAuthIrohUnytCloudInitBytes))🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@main.go` around lines 24 - 27, The parsed template hcAuthIrohUnytCloudInitTmpl should be created with the missingkey=error option to fail fast on missing placeholders; update the template creation call that currently uses template.New("hc-auth-iroh-unyt-cloud-init").Parse(...) so it calls template.New("hc-auth-iroh-unyt-cloud-init").Option("missingkey=error").Parse(...) (referencing hcAuthIrohUnytCloudInitTmpl and the template.New/...Parse chain) to ensure execution errors if any template key is missing.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@main.go`:
- Around line 24-27: The parsed template hcAuthIrohUnytCloudInitTmpl should be
created with the missingkey=error option to fail fast on missing placeholders;
update the template creation call that currently uses
template.New("hc-auth-iroh-unyt-cloud-init").Parse(...) so it calls
template.New("hc-auth-iroh-unyt-cloud-init").Option("missingkey=error").Parse(...)
(referencing hcAuthIrohUnytCloudInitTmpl and the template.New/...Parse chain) to
ensure execution errors if any template key is missing.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
flake.lockis excluded by!**/*.lockgo.sumis excluded by!**/*.sum
📒 Files selected for processing (9)
Pulumi.network-services.yamlREADME.mddev-test-auth/cloud-init.yamldev-test-auth/docker-compose.yamldev-test-iroh-relay/cloud-init.yamldev-test-iroh-relay/docker-compose.yamlgo.modhc-auth-iroh-unyt/cloud-init.yaml.tmplmain.go
💤 Files with no reviewable changes (4)
- dev-test-auth/docker-compose.yaml
- dev-test-auth/cloud-init.yaml
- dev-test-iroh-relay/docker-compose.yaml
- dev-test-iroh-relay/cloud-init.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
- go.mod
- README.md
- hc-auth-iroh-unyt/cloud-init.yaml.tmpl
There was a problem hiding this comment.
🧹 Nitpick comments (1)
README.md (1)
186-186: Use imperative wording for setup instructions.Line 186 reads like a completed action. For operator docs, use imperative voice for clarity.
✏️ Suggested docs tweak
-Configured an OAuth application as directed by the [hc-auth-iroh-unyt README](https://github.com/holochain/hc-auth-server). +Configure an OAuth application as directed by the [hc-auth-iroh-unyt README](https://github.com/holochain/hc-auth-server).🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` at line 186, Change the sentence "Configured an OAuth application as directed by the [hc-auth-iroh-unyt README](https://github.com/holochain/hc-auth-server)." to an imperative instruction, e.g., "Configure an OAuth application as directed by the [hc-auth-iroh-unyt README](https://github.com/holochain/hc-auth-server)." so the setup step uses imperative voice for operators.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@README.md`:
- Line 186: Change the sentence "Configured an OAuth application as directed by
the [hc-auth-iroh-unyt README](https://github.com/holochain/hc-auth-server)." to
an imperative instruction, e.g., "Configure an OAuth application as directed by
the [hc-auth-iroh-unyt README](https://github.com/holochain/hc-auth-server)." so
the setup step uses imperative voice for operators.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 6c0e028c-f12f-4f1e-9d03-8e8c5c05ec2f
📒 Files selected for processing (3)
Pulumi.network-services.yamlREADME.mdhc-auth-iroh-unyt/cloud-init.yaml.tmpl
🚧 Files skipped from review as they are similar to previous changes (2)
- hc-auth-iroh-unyt/cloud-init.yaml.tmpl
- Pulumi.network-services.yaml
ThetaSinner
force-pushed
the
create-auth-iroh-unyt-deploy
branch
2 times, most recently
from
474a587 to
72a70a1
Compare
jost-s
previously approved these changes
Mar 6, 2026
Contributor
jost-s
left a comment
jost-s
left a comment
There was a problem hiding this comment.
Maybe we can deploy our test relay as well some day, with or without auth.
mattyg
previously approved these changes
Mar 10, 2026
ThetaSinner
force-pushed
the
create-auth-iroh-unyt-deploy
branch
from
51a6211 to
a46f60a
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
main.go (1)
24-24: Fail fast on missing template variables.
text/templatedoes not error on a missing map key by default; it keeps rendering and will emit<no value>. For deployment user-data, that turns a key mismatch betweenhc-auth-iroh-unyt/cloud-init.yaml.tmplanddatainto a broken droplet config instead of a failed preview/apply. Parsing withOption("missingkey=error")would make this safer. (pkg.go.dev)Suggested change
-hcAuthIrohUnytCloudInitTmpl, err := template.New("hc-auth-iroh-unyt-cloud-init").Parse(string(hcAuthIrohUnytCloudInitBytes)) +hcAuthIrohUnytCloudInitTmpl, err := template.New("hc-auth-iroh-unyt-cloud-init"). + Option("missingkey=error"). + Parse(string(hcAuthIrohUnytCloudInitBytes))Also applies to: 87-100
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@main.go` at line 24, The template creation for hcAuthIrohUnytCloudInitTmpl currently parses without failing on missing map keys; change the creation to enable strict missing-key handling by calling template.New("hc-auth-iroh-unyt-cloud-init").Option("missingkey=error") before Parse so template.New(...).Option("missingkey=error").Parse(...) is used; apply the same change to the other template.New(...).Parse(...) calls in this file (the other cloud-init/template variables around the same area) so any missing template variables cause immediate errors rather than rendering "<no value>".
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/deploy.yaml:
- Around line 13-14: Replace the mutable tags for the GitHub Actions with
immutable commit SHAs: change uses: actions/checkout@v6 to the corresponding
full commit SHA (e.g., actions/checkout@<commit-sha>) and uses:
actions/setup-go@v6 to its full commit SHA (e.g.,
actions/setup-go@<commit-sha>), and add an explicit job-level permissions block
with contents: read to limit access to repository contents; update the two uses
entries (actions/checkout and actions/setup-go) and add permissions: contents:
read in the workflow job definition.
In @.github/workflows/preview.yaml:
- Line 11: Replace the mutable action tags with full commit SHAs for every
third-party action usage noted (actions/checkout, actions/setup-go,
pulumi/actions, re-actors/alls-green) so the workflow uses immutable references;
locate the occurrences where the workflow currently uses short tags like
actions/checkout@v6, actions/setup-go@v4 (and the pulumi/actions and
re-actors/alls-green references) and update each to the corresponding
full-length commit SHA for the exact release you intend to pin, keeping the rest
of the step configuration unchanged.
---
Nitpick comments:
In `@main.go`:
- Line 24: The template creation for hcAuthIrohUnytCloudInitTmpl currently
parses without failing on missing map keys; change the creation to enable strict
missing-key handling by calling
template.New("hc-auth-iroh-unyt-cloud-init").Option("missingkey=error") before
Parse so template.New(...).Option("missingkey=error").Parse(...) is used; apply
the same change to the other template.New(...).Parse(...) calls in this file
(the other cloud-init/template variables around the same area) so any missing
template variables cause immediate errors rather than rendering "<no value>".
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 275b4f35-d437-4c12-9da0-a522016ce1bd
⛔ Files ignored due to path filters (2)
flake.lockis excluded by!**/*.lockgo.sumis excluded by!**/*.sum
📒 Files selected for processing (11)
.github/workflows/deploy.yaml.github/workflows/preview.yamlPulumi.network-services.yamlREADME.mddev-test-auth/cloud-init.yamldev-test-auth/docker-compose.yamldev-test-iroh-relay/cloud-init.yamldev-test-iroh-relay/docker-compose.yamlgo.modhc-auth-iroh-unyt/cloud-init.yaml.tmplmain.go
💤 Files with no reviewable changes (4)
- dev-test-iroh-relay/cloud-init.yaml
- dev-test-iroh-relay/docker-compose.yaml
- dev-test-auth/docker-compose.yaml
- dev-test-auth/cloud-init.yaml
🚧 Files skipped from review as they are similar to previous changes (2)
- README.md
- hc-auth-iroh-unyt/cloud-init.yaml.tmpl
jost-s
previously approved these changes
Mar 12, 2026
|
✔️ 1cdc0e2...74f313f - Conventional commits check succeeded. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deployed at https://hc-auth-iroh-unyt.holochain.org/
Closes #14
Summary by CodeRabbit
New Features
Documentation
Chores
Maintenance