From a9caf5b216b4771d19984a49ad3da79422cf8455 Mon Sep 17 00:00:00 2001 From: Abiba Date: Thu, 16 Jul 2026 18:19:27 +0000 Subject: [PATCH] vault: fix koby platform connectivity + document migration lessons MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Koby was broken after migration — Zulip credentials lost (only in process memory), Telegram token overwritten (only existed in old .env.bak-20260603). Fix: Koby shares Tanko's Zulip bot (tanko-bot@, TANKO_ZULIP_API_KEY in vault). Telegram token recovered from .env.bak-20260603. Both platforms now connected. Added Koby migration lessons to contract (back up .env before migration, inject ALL platform env vars, cat /proc/pid/environ before killing old gateway). Added KOBY_ZULIP_API_KEY to vault (shares Tanko's key). --- litellm-api-keys.prose.md | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/litellm-api-keys.prose.md b/litellm-api-keys.prose.md index df6cf48..15b2064 100644 --- a/litellm-api-keys.prose.md +++ b/litellm-api-keys.prose.md @@ -119,7 +119,7 @@ runs as user `jerome`, not systemd root, needs user-scope adaptation). |-------|------|---------|-----------|--------| | abiba | .24 | `infisical run` (pi agent wrapper, service token) | ABIBA_LITELLM_API_KEY | ✅ vault-backed | | mumuni | .123 | infisical-gateway.sh + user-login machine identity | MUMUNI_LITELLM_API_KEY | ✅ vault-backed | -| koby | .129 | infisical-gateway.sh + service token (migrated 2026-07-16) | KOBY_LITELLM_API_KEY | ✅ vault-backed | +| koby | .129 | infisical-gateway.sh + service token (migrated 2026-07-16) | KOBY_LITELLM_API_KEY | ✅ vault-backed, Zulip (tanko-bot@) + Telegram | | koonimo | .114 | infisical-gateway.sh + service token (migrated 2026-07-16) | KOONIMO_LITELLM_API_KEY | ✅ vault-backed | | tanko | .122 | **hardcoded in config.yaml** (runs as user jerome, not systemd) | TANKO_LITELLM_API_KEY | ⚠️ TODO: migrate to user-scope wrapper | @@ -131,6 +131,27 @@ Migration: create a user-scope systemd service (`~/.config/systemd/user/hermes-g with `infisical-gateway.sh` wrapper in jerome's home, token at `~/.infisical-token`, lingering enabled (`loginctl enable-linger jerome`) so the user service runs without a login session. +### Koby migration lessons (2026-07-16) + +Migrated Koby from hardcoded systemd drop-in → `infisical-gateway.sh` wrapper. +**Two mistakes I made that broke the agent:** +1. **Overwrote `/root/.hermes/.env`** without backing it up. The Zulip API key only existed + in the running process memory — the old .env was minimal (just LiteLLM key). Zulip creds were + inherited from the pre-migration gateway env, not stored in any file. Lost on restart. +2. **Only injected `LITELLM_API_KEY`** in the wrapper — forgot Zulip + Telegram credentials. + Agents need ALL their platform env vars. Missing vars cause silent adapter failures. + +**How Koby actually connects (2026-07-16):** +- Zulip: shares **Tanko's bot** (`tanko-bot@chat.sysloggh.net`, `TANKO_ZULIP_API_KEY=5PeD6f3zo…`). + Koby doesn't have its own Zulip bot (koby-bot@ doesn't exist in the swarm config). +- Telegram: token `828640…` recovered from `.env.bak-20260603` (18KB backup from June 2026). + Allowed users: 6679773481. Home channel: 6679773481. +- Both platforms now connect through the wrapper's env injection. + +**Golden rule for gateway restarts:** always `cat /proc//environ` before killing the old +process — captures the live env set. Especially important when migrating gateways between +injection mechanisms. + ### Key rotation procedure (one vault operation with this standard) 1. Generate new key: `POST /key/generate` (master key, admin).