Repository navigation
docs(deployment): adiciona guia de deploy docker, headroom e acesso remoto - #22
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 47b078d0c5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| > 1. `REQUIRE_LOGIN=true` (with a strong custom password) | ||
| > 2. `REQUIRE_API_KEY=true` (for coding tool authentication) |
There was a problem hiding this comment.
In the documented Compose flow, changing these values in .env does not enable either protection: docker-compose.example.yml hardcodes REQUIRE_LOGIN=false and REQUIRE_API_KEY=false instead of interpolating the corresponding .env entries. A user who follows this warning and then starts the tunel profile still exposes the gateway's admin and inference endpoints without authentication, so the Compose service must consume these variables or the guide must explicitly require editing the Compose file.
Useful? React with 👍 / 👎.
| ### Step 2: Launch Stack | ||
|
|
||
| ```bash | ||
| docker compose -f docker-compose.example.yml up -d |
There was a problem hiding this comment.
On a fresh host, this launch command fails before creating any containers because docker-compose.example.yml attaches 9rtk-router to rtk-inference-net, which is declared external: true. Docker requires external networks to exist before docker compose up, as stated in the official Compose networking documentation; the repository's make setup already creates it, so the production steps should use that target or run docker network create rtk-inference-net first.
Useful? React with 👍 / 👎.
| environment: | ||
| - UPSTREAM_URL=http://9rtk-router:20128 | ||
| - PORT=8787 |
There was a problem hiding this comment.
The published Headroom image defaults HEADROOM_HOST to 127.0.0.1 inside the container, so Docker's port forwarding to the container address cannot reach this listener and http://127.0.0.1:8787/v1 returns connection failures. Headroom's own Compose example explicitly sets HEADROOM_HOST=0.0.0.0 for this reason; add that setting while retaining the host-side loopback publication.
Useful? React with 👍 / 👎.
| ports: | ||
| - "127.0.0.1:8787:8787" | ||
| environment: | ||
| - UPSTREAM_URL=http://9rtk-router:20128 |
There was a problem hiding this comment.
UPSTREAM_URL is not Headroom's setting for an OpenAI-compatible backend, so this service does not route requests to 9Router as the guide claims. Headroom documents OPENAI_TARGET_API_URL and ANTHROPIC_TARGET_API_URL for custom targets in its proxy configuration; without the appropriate target, OpenAI-compatible traffic uses the public provider default and a 9Router credential is rejected rather than reaching the gateway.
Useful? React with 👍 / 👎.
| --name 9rtk-sync \ | ||
| --restart unless-stopped \ | ||
| -p 127.0.0.1:9091:9090 \ | ||
| -v 9router_data:/app/data \ |
There was a problem hiding this comment.
When the existing gateway does not already use a Docker volume named exactly 9router_data—including the repository's standard Compose deployment, whose project-scoped volume has a different engine name—this option silently creates a new empty volume. Because synchronization reads /app/data/db/data.sqlite directly and ROUTER_URL is only used for diagnostics, the standalone container then remains DATABASE_NOT_READY; a remote gateway cannot work with this recipe at all unless its database is mounted or otherwise made locally accessible.
Useful? React with 👍 / 👎.
| -v "${HOME}:/root/host:ro" \ | ||
| -v 9rtksync_logs:/app/logs \ | ||
| -e DB_PATH=/app/data/db/data.sqlite \ | ||
| -e ROUTER_URL=http://host.docker.internal:20128 \ |
There was a problem hiding this comment.
On a plain Linux Docker Engine host, host.docker.internal is not automatically installed in the container's hosts file, so this advertised standalone command cannot resolve the host-side 9Router. Docker documents that Docker Desktop supplies the name automatically, while docker run on Engine should add --add-host host.docker.internal=host-gateway (Docker run documentation); alternatively the guide should use a reachable LAN address.
Useful? React with 👍 / 👎.
| ```bash | ||
| docker compose -f docker-compose.example.yml --profile tailnet up -d | ||
| ``` | ||
| 4. Access via MagicDNS at `http://9rtk:20128` or Tailscale IP `100.x.y.z:20128`. |
There was a problem hiding this comment.
Starting the documented tailnet profile does not make port 20128 reachable: the Compose service sets TS_SERVE_CONFIG=/config/serve.json, but mounts only /var/lib/tailscale, and a repository-wide search finds no serve.json to mount. Tailscale requires that JSON file to define the services being proxied and says it must be mounted into the container (Tailscale Docker parameters); merely joining the sidecar to the Docker network does not expose 9rtk-router, so this access instruction fails until the config and mount are added.
Useful? React with 👍 / 👎.
| docker run -d \ | ||
| --name 9rtk-sync \ | ||
| --restart unless-stopped \ |
There was a problem hiding this comment.
When this standalone command is corrected to mount the gateway's actual shared volume, it still runs the image as root because the Dockerfile declares no USER and the command omits --user. The synchronizer performs SQLite writes and creates state beside DB_PATH, so SQLite journals or directories can become root-owned and leave the UID-1000 gateway unable to write its own database; the repository's Compose service explicitly uses user: "1000:1000" to prevent this EACCES failure, and the standalone recipe needs the same setting.
Useful? React with 👍 / 👎.
| # Pull latest stable release | ||
| docker pull ghcr.io/pathbit/9rtksync:latest |
There was a problem hiding this comment.
The latest image is not the latest stable release: .github/workflows/release.yml applies the latest tag only when github.ref == 'refs/heads/master', while version-tag builds publish semver tags without advancing latest. Consequently, every qualifying master push can replace this image independently of a release, and users following the comment may deploy unreleased code; either recommend a versioned tag here or change the release workflow to promote releases to latest.
Useful? React with 👍 / 👎.
| networks: | ||
| - 9rtksync-net |
There was a problem hiding this comment.
This attaches a third-party inference proxy to 9rtksync-net, even though the network contract below states that this management network is isolated so only the synchronizer reaches the gateway; the router also defaults to REQUIRE_LOGIN=false, so Headroom gains access to the unprotected administrative surface in addition to /v1. Since 9rtk-router is already attached to the purpose-built rtk-inference-net, Headroom should use that inference network instead of expanding the management trust boundary.
Useful? React with 👍 / 👎.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Adiciona guia completo de deploy com Docker, Headroom, Caveman, Cloudflare Tunnel e Tailscale.