chore: import upstream snapshot with attribution
This commit is contained in:
wehub-resource-sync
@@ -0,0 +1,35 @@
|
||||
ARG III_VERSION=0.11.2
|
||||
|
||||
FROM iiidev/iii:${III_VERSION} AS iii-image
|
||||
|
||||
FROM node:22-slim
|
||||
|
||||
ARG AGENTMEMORY_VERSION=0.9.27
|
||||
ARG III_VERSION=0.11.2
|
||||
ARG III_SDK_VERSION=0.11.2
|
||||
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends openssl ca-certificates tini gosu curl \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
COPY --from=iii-image /app/iii /usr/local/bin/iii
|
||||
|
||||
# Install agentmemory into a dedicated prefix so the local package.json's
|
||||
# `overrides` field pins iii-sdk down to match the engine (agentmemory's
|
||||
# caret range `^0.11.2` otherwise resolves to 0.11.6, the version that
|
||||
# requires the new sandbox-everything worker model the agentmemory CLI
|
||||
# is not refactored for yet). `npm install -g` ignores overrides, hence
|
||||
# the local prefix.
|
||||
WORKDIR /opt/agentmemory
|
||||
RUN printf '{"name":"agentmemory-deploy","version":"1.0.0","private":true,"overrides":{"iii-sdk":"%s"}}\n' "${III_SDK_VERSION}" > package.json \
|
||||
&& npm install "@agentmemory/agentmemory@${AGENTMEMORY_VERSION}" --omit=optional --no-fund --no-audit \
|
||||
&& ln -s /opt/agentmemory/node_modules/.bin/agentmemory /usr/local/bin/agentmemory
|
||||
|
||||
ENV AGENTMEMORY_III_VERSION=${III_VERSION} \
|
||||
TINI_SUBREAPER=1
|
||||
|
||||
COPY --chmod=0755 entrypoint.sh /usr/local/bin/agentmemory-entrypoint.sh
|
||||
|
||||
EXPOSE 3111
|
||||
|
||||
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/agentmemory-entrypoint.sh"]
|
||||
@@ -0,0 +1,166 @@
|
||||
# Deploy agentmemory on fly.io
|
||||
|
||||
This template runs agentmemory on a single fly.io machine with a 1 GB
|
||||
persistent volume mounted at `/data`. The HMAC secret is generated on
|
||||
first boot and persisted to the volume — you capture it from the deploy
|
||||
logs exactly once.
|
||||
|
||||
## What you get
|
||||
|
||||
- A public HTTPS endpoint serving the agentmemory REST API on port 3111
|
||||
- A 1 GB Fly Volume at `/data` for memories, BM25 index, and stream backlog
|
||||
- `auto_stop_machines = "stop"` and `min_machines_running = 0` — the
|
||||
machine sleeps when idle, so cost floor approaches $0 for low traffic
|
||||
- HTTP healthcheck at `/agentmemory/livez` every 30 s
|
||||
- The HMAC bearer secret is generated on first boot inside the
|
||||
container and persisted to `/data/.hmac` (chmod 600); the operator
|
||||
copies it from the deploy logs once.
|
||||
|
||||
## One-time setup
|
||||
|
||||
Pick a unique Fly app name first — `agentmemory` itself is likely taken.
|
||||
Every command below references `$APP`, so set it once and the rest of the
|
||||
flow stays consistent:
|
||||
|
||||
```bash
|
||||
# 1. Install flyctl: https://fly.io/docs/flyctl/install/
|
||||
# 2. Pick your unique app name (and matching volume name):
|
||||
export APP="agentmemory-$(whoami)" # or any other globally-unique name
|
||||
export VOLUME="${APP//-/_}_data" # Fly volume names can't contain '-'
|
||||
|
||||
# 3. From this directory:
|
||||
fly launch --copy-config --no-deploy --name "$APP"
|
||||
|
||||
# 4. Create the volume in the same region as the app:
|
||||
fly volumes create "$VOLUME" --region iad --size 1
|
||||
|
||||
# 5. Deploy:
|
||||
fly deploy --app "$APP"
|
||||
```
|
||||
|
||||
If `fly launch` reports the name is taken, pick another value for `$APP`,
|
||||
re-export, and re-run.
|
||||
|
||||
## Capture the HMAC secret
|
||||
|
||||
Right after the first deploy succeeds:
|
||||
|
||||
```bash
|
||||
fly logs --app "$APP" | grep -A1 AGENTMEMORY_SECRET=
|
||||
```
|
||||
|
||||
You will see exactly one line of the form `AGENTMEMORY_SECRET=<64 hex chars>`.
|
||||
Copy it into your client environment (`~/.bashrc`, Claude Desktop config,
|
||||
the viewer unlock prompt, etc.). The secret is never printed again on
|
||||
subsequent boots.
|
||||
|
||||
If the first-boot log line is no longer available, read the persisted
|
||||
secret from the mounted volume:
|
||||
|
||||
```bash
|
||||
fly ssh console --app "$APP" -C "sh -lc 'cat /data/.hmac'"
|
||||
```
|
||||
|
||||
## Verify the deployment
|
||||
|
||||
```bash
|
||||
curl "https://$APP.fly.dev/agentmemory/livez"
|
||||
# {"status":"ok"}
|
||||
```
|
||||
|
||||
For an authenticated call, your client must send `Authorization: Bearer <secret>`.
|
||||
|
||||
## Viewer access (port 3113 stays internal)
|
||||
|
||||
The viewer port is intentionally not exposed publicly. Tunnel to it:
|
||||
|
||||
```bash
|
||||
fly proxy 3113:3113 --app "$APP"
|
||||
# then open http://localhost:3113
|
||||
```
|
||||
|
||||
`fly proxy` opens an mTLS WireGuard channel to the machine, so the
|
||||
viewer's bearer token still has to ride a loopback connection on your
|
||||
laptop — the v0.9.12 plaintext-bearer guard stays satisfied.
|
||||
|
||||
The entrypoint sets `AGENTMEMORY_VIEWER_HOST=::` **only when it detects
|
||||
Fly's runtime variables** (`FLY_APP_NAME` / `FLY_ALLOC_ID`). That makes
|
||||
the viewer listen on the machine's `fly-local-6pn` WireGuard interface
|
||||
as well as loopback so `fly proxy` can reach it. The same branch
|
||||
pre-seeds `VIEWER_ALLOWED_HOSTS=localhost:3113,127.0.0.1:3113,[::1]:3113`,
|
||||
which are the Host headers `fly proxy 3113:3113` actually emits on
|
||||
your laptop.
|
||||
|
||||
When `AGENTMEMORY_VIEWER_HOST` is non-loopback the viewer enforces two
|
||||
extra guards: it refuses to start unless `VIEWER_ALLOWED_HOSTS` is
|
||||
explicitly set, and every request to `/agentmemory/*` must present
|
||||
`Authorization: Bearer $AGENTMEMORY_SECRET`. Static HTML and the
|
||||
favicon are still served unauthenticated. If a proxied viewer request
|
||||
gets a 401, the browser UI prompts for `AGENTMEMORY_SECRET` and stores
|
||||
it in session storage so subsequent viewer API calls include the bearer.
|
||||
Use the value printed in the first-boot logs or read `/data/.hmac`
|
||||
inside the machine.
|
||||
|
||||
> **Security warning.** Setting `AGENTMEMORY_VIEWER_HOST=0.0.0.0` or
|
||||
> `::` turns the viewer into a network-reachable proxy that signs every
|
||||
> upstream call with `AGENTMEMORY_SECRET`. Never enable that outside a
|
||||
> network you trust (Fly's WireGuard mesh in this template), and never
|
||||
> set it in a plain `docker run -p 3113:3113 …` on a shared host — the
|
||||
> entrypoint deliberately skips the override when Fly env vars are
|
||||
> absent so a plain Docker pull stays loopback-only.
|
||||
|
||||
## Rotate the HMAC secret
|
||||
|
||||
```bash
|
||||
fly ssh console --app "$APP"
|
||||
rm /data/.hmac
|
||||
exit
|
||||
fly machine restart <machine-id>
|
||||
fly logs --app "$APP" | grep AGENTMEMORY_SECRET=
|
||||
```
|
||||
|
||||
Update every client with the new secret. Old tokens stop working
|
||||
immediately.
|
||||
|
||||
## Back up `/data`
|
||||
|
||||
```bash
|
||||
fly ssh console --app "$APP" -C "tar czf - /data" > "$APP-$(date +%Y%m%d).tar.gz"
|
||||
```
|
||||
|
||||
To restore on a fresh machine:
|
||||
|
||||
```bash
|
||||
cat "$APP-YYYYMMDD.tar.gz" | fly ssh console --app "$APP" -C "tar xzf - -C /"
|
||||
fly machine restart <machine-id>
|
||||
```
|
||||
|
||||
## Cost floor and egress
|
||||
|
||||
- Idle (machine stopped): the volume costs ~$0.15/GB/month. A 1 GB
|
||||
volume is roughly $0.15/month.
|
||||
- Active (machine running on `shared-cpu-1x` with 512 MB): about
|
||||
$1.94/month if it ran 24/7; in practice `auto_stop_machines` keeps
|
||||
that well under $1.
|
||||
- Outbound bandwidth: 100 GB/month free on the Hobby plan, then $0.02/GB
|
||||
in North America / Europe.
|
||||
|
||||
See <https://fly.io/docs/about/pricing/> for the up-to-date rate card.
|
||||
|
||||
## Known caveats
|
||||
|
||||
- The volume lives in one region. To survive a region outage, create a
|
||||
second volume in another region and update `primary_region` after the
|
||||
failover, or take snapshots with `fly volumes snapshots create`.
|
||||
- The Dockerfile builds in the Fly Builder on every deploy — first
|
||||
build is ~30 seconds; cached layers shrink rebuilds to under 10
|
||||
seconds. Image is ~114 MB.
|
||||
- First deploy lands on a **shared IPv4 + dedicated IPv6** by default
|
||||
(free). If you need a dedicated IPv4 for legacy clients without SNI,
|
||||
run `fly ips allocate-v4 --app "$APP"` — costs $2/month.
|
||||
- Cold-start (from machine launch to passing `/agentmemory/livez`) is
|
||||
~9 seconds measured. `grace_period = "30s"` on the health check
|
||||
gives a 3x safety margin.
|
||||
- Bump `AGENTMEMORY_VERSION` or `III_VERSION` in the Dockerfile to
|
||||
upgrade. `fly deploy --build-arg AGENTMEMORY_VERSION=<x>` also works
|
||||
for a one-off without editing the file.
|
||||
Executable
+112
@@ -0,0 +1,112 @@
|
||||
#!/bin/sh
|
||||
# agentmemory first-boot entrypoint.
|
||||
#
|
||||
# Runs as root so it can:
|
||||
# 1. Overwrite the npm-bundled iii-config.yaml (which binds 127.0.0.1
|
||||
# and uses relative ./data paths) with a deploy-tuned version that
|
||||
# binds 0.0.0.0 and uses absolute /data paths.
|
||||
# 2. chown the platform-mounted /data volume to the runtime user
|
||||
# (managed platforms mount volumes root-owned 755 by default).
|
||||
# 3. Generate the HMAC secret on first boot and persist it to
|
||||
# /data/.hmac (chmod 600) so the secret survives restarts.
|
||||
#
|
||||
# Then it execs the agentmemory CLI under gosu as the unprivileged
|
||||
# `node` user.
|
||||
|
||||
set -eu
|
||||
|
||||
DATA_DIR="${AGENTMEMORY_DATA_DIR:-/data}"
|
||||
HMAC_FILE="${AGENTMEMORY_HMAC_FILE:-/data/.hmac}"
|
||||
RUN_AS="node:node"
|
||||
III_CONFIG="/opt/agentmemory/node_modules/@agentmemory/agentmemory/dist/iii-config.yaml"
|
||||
|
||||
mkdir -p "$DATA_DIR"
|
||||
chown -R "$RUN_AS" "$DATA_DIR"
|
||||
|
||||
cat > "$III_CONFIG" <<'EOF'
|
||||
workers:
|
||||
- name: iii-http
|
||||
config:
|
||||
port: 3111
|
||||
host: 0.0.0.0
|
||||
default_timeout: 180000
|
||||
cors:
|
||||
allowed_origins:
|
||||
- "http://localhost:3111"
|
||||
- "http://localhost:3113"
|
||||
- "http://127.0.0.1:3111"
|
||||
- "http://127.0.0.1:3113"
|
||||
allowed_methods: [GET, POST, PUT, DELETE, OPTIONS]
|
||||
- name: iii-state
|
||||
config:
|
||||
adapter:
|
||||
name: kv
|
||||
config:
|
||||
store_method: file_based
|
||||
file_path: /data/state_store.db
|
||||
- name: iii-queue
|
||||
config:
|
||||
adapter:
|
||||
name: builtin
|
||||
- name: iii-pubsub
|
||||
config:
|
||||
adapter:
|
||||
name: local
|
||||
- name: iii-cron
|
||||
config:
|
||||
adapter:
|
||||
name: kv
|
||||
- name: iii-stream
|
||||
config:
|
||||
port: 3112
|
||||
host: 0.0.0.0
|
||||
adapter:
|
||||
name: kv
|
||||
config:
|
||||
store_method: file_based
|
||||
file_path: /data/stream_store
|
||||
- name: iii-observability
|
||||
config:
|
||||
enabled: true
|
||||
service_name: agentmemory
|
||||
exporter: memory
|
||||
sampling_ratio: 1.0
|
||||
metrics_enabled: true
|
||||
logs_enabled: true
|
||||
logs_console_output: true
|
||||
EOF
|
||||
chown "$RUN_AS" "$III_CONFIG"
|
||||
|
||||
if [ ! -s "$HMAC_FILE" ]; then
|
||||
SECRET="$(openssl rand -hex 32)"
|
||||
umask 077
|
||||
printf '%s\n' "$SECRET" > "$HMAC_FILE"
|
||||
chmod 600 "$HMAC_FILE"
|
||||
chown "$RUN_AS" "$HMAC_FILE"
|
||||
echo "================================================================"
|
||||
echo "agentmemory: generated HMAC secret on first boot"
|
||||
echo "AGENTMEMORY_SECRET=$SECRET"
|
||||
echo "Copy this value now. It will not be printed again."
|
||||
echo "Stored at: $HMAC_FILE (chmod 600)"
|
||||
echo "To rotate: delete $HMAC_FILE on the persistent volume and restart."
|
||||
echo "================================================================"
|
||||
fi
|
||||
|
||||
AGENTMEMORY_SECRET="$(cat "$HMAC_FILE")"
|
||||
export AGENTMEMORY_SECRET
|
||||
|
||||
# The viewer's default 127.0.0.1 bind is unreachable through fly proxy,
|
||||
# which enters the machine via fly-local-6pn (IPv6). Opt into a
|
||||
# non-loopback bind ONLY when we're actually inside Fly (detected via
|
||||
# Fly's runtime variables). A plain `docker run` of this image will not
|
||||
# see these variables and will keep the safe-by-default loopback bind,
|
||||
# so it can't silently expose the viewer's bearer-authorized proxy to
|
||||
# the LAN. VIEWER_ALLOWED_HOSTS is preseeded to the Host headers that
|
||||
# `fly proxy 3113:3113` actually produces on the operator's laptop.
|
||||
if [ -n "${FLY_APP_NAME:-}" ] || [ -n "${FLY_ALLOC_ID:-}" ]; then
|
||||
: "${AGENTMEMORY_VIEWER_HOST:=::}"
|
||||
: "${VIEWER_ALLOWED_HOSTS:=localhost:3113,127.0.0.1:3113,[::1]:3113}"
|
||||
export AGENTMEMORY_VIEWER_HOST VIEWER_ALLOWED_HOSTS
|
||||
fi
|
||||
|
||||
exec gosu "$RUN_AS" agentmemory "$@"
|
||||
@@ -0,0 +1,44 @@
|
||||
# fly.io deployment for agentmemory.
|
||||
#
|
||||
# The HMAC secret is generated by entrypoint.sh on first boot and persisted
|
||||
# to the mounted volume at /data/.hmac. Operator copies it once from
|
||||
# `fly logs` then never sees it again. To rotate: `fly ssh console` and
|
||||
# `rm /data/.hmac`, then `fly machine restart`.
|
||||
#
|
||||
# Only port 3111 (REST API) is exposed publicly. Viewer 3113 stays bound
|
||||
# to localhost inside the machine; reach it via `fly proxy 3113:3113`.
|
||||
|
||||
app = "agentmemory"
|
||||
primary_region = "iad"
|
||||
|
||||
[build]
|
||||
dockerfile = "Dockerfile"
|
||||
|
||||
[[mounts]]
|
||||
source = "agentmemory_data"
|
||||
destination = "/data"
|
||||
initial_size = "1gb"
|
||||
|
||||
[http_service]
|
||||
internal_port = 3111
|
||||
force_https = true
|
||||
auto_stop_machines = "stop"
|
||||
auto_start_machines = true
|
||||
min_machines_running = 0
|
||||
processes = ["app"]
|
||||
|
||||
[http_service.concurrency]
|
||||
type = "requests"
|
||||
soft_limit = 200
|
||||
hard_limit = 250
|
||||
|
||||
[[http_service.checks]]
|
||||
interval = "30s"
|
||||
timeout = "5s"
|
||||
grace_period = "30s"
|
||||
method = "GET"
|
||||
path = "/agentmemory/livez"
|
||||
|
||||
[[vm]]
|
||||
size = "shared-cpu-1x"
|
||||
memory = "512mb"
|
||||
Reference in New Issue
Block a user