Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughAdds two cloud-init files to provision iroh-relay hosts, a CI lint step validating one cloud-init, and Pulumi changes that read both cloud-init files and create DigitalOcean droplets plus Cloudflare A/AAAA records for each. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Collaborator
🍹
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
main.go (1)
189-242: Consider extracting shared droplet+DNS provisioning helpers.
configureIrohRelayUnytandconfigureDevTestBootstrap2Irohduplicate SSH key collection and A/AAAA record creation logic. A small helper would reduce drift risk for future infra changes.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@main.go` around lines 189 - 242, Both configureIrohRelayUnyt and configureDevTestBootstrap2Iroh repeat SSH key collection and A/AAAA record creation; factor that into a shared helper (e.g., provisionDropletWithDns) that calls digitalocean.GetSshKeys, creates the Droplet via digitalocean.NewDroplet, and creates cloudflare.NewRecord A and AAAA records. The helper should accept parameters like name, image, region, size, tags, userData and zoneId (or pulumi.Config), return the created Droplet resource (or its IPs) and surface errors; then replace the duplicated logic in configureIrohRelayUnyt and configureDevTestBootstrap2Iroh with calls to this new function to centralize SshKeys handling and DNS record creation.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@iroh-relay-unyt/cloud-init.yaml`:
- Around line 8-9: The metrics endpoint is currently bound to metrics_bind_addr
= "[::]:9090", which exposes it publicly; change the binding in the cloud-init
config by updating metrics_bind_addr to a loopback address (e.g.,
"127.0.0.1:9090" or "localhost:9090") or otherwise restrict access via host
firewall/allowlist so the Prometheus/monitoring scrape target is not publicly
reachable; update the metrics_bind_addr setting and ensure any
orchestration/consumers use the new local address.
- Around line 53-57: The install block downloads and installs the iroh-relay
tarball as root without integrity verification; update the cloud-init step that
uses curl /tmp/iroh-relay.tar.gz and install -m 0755 /tmp/iroh-relay
/usr/local/bin/iroh-relay to either (A) verify a published SHA256/GPG signature
before extracting (fail the build if verification fails) or (B) if the upstream
release lacks checksums/signatures, replace the binary install with a
reproducible installer (e.g., cargo install iroh-relay) or pin the exact release
URL and add an explicit comment/log entry documenting the lack of
checksum/signature and the accepted supply-chain risk so operators are aware.
---
Nitpick comments:
In `@main.go`:
- Around line 189-242: Both configureIrohRelayUnyt and
configureDevTestBootstrap2Iroh repeat SSH key collection and A/AAAA record
creation; factor that into a shared helper (e.g., provisionDropletWithDns) that
calls digitalocean.GetSshKeys, creates the Droplet via digitalocean.NewDroplet,
and creates cloudflare.NewRecord A and AAAA records. The helper should accept
parameters like name, image, region, size, tags, userData and zoneId (or
pulumi.Config), return the created Droplet resource (or its IPs) and surface
errors; then replace the duplicated logic in configureIrohRelayUnyt and
configureDevTestBootstrap2Iroh with calls to this new function to centralize
SshKeys handling and DNS record creation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 339b60c6-092d-45db-b4c3-bc637eb9ac45
📒 Files selected for processing (3)
.github/workflows/preview.yamliroh-relay-unyt/cloud-init.yamlmain.go
Deploy a standalone Iroh relay server (v0.97.0) for the Unyt project at iroh-relay-unyt.holochain.org on a DigitalOcean NYC1 droplet with Cloudflare DNS. Uses the upstream binary directly with a native systemd service and built-in Let's Encrypt TLS, QUIC address discovery enabled.
ThetaSinner
force-pushed
the
feat/iroh-relay-unyt
branch
from
add274d to
7add66a
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
main.go (1)
193-201: Consider extracting SSH key fetching to a helper function.This SSH key fetching and fingerprint extraction pattern is duplicated across four
configure*functions. Extracting it would reduce repetition and centralize any future changes.♻️ Suggested helper function
func getSshFingerprints(ctx *pulumi.Context) ([]string, error) { getSshKeysResult, err := digitalocean.GetSshKeys(ctx, &digitalocean.GetSshKeysArgs{}, nil) if err != nil { return nil, err } var fingerprints []string for _, key := range getSshKeysResult.SshKeys { fingerprints = append(fingerprints, key.Fingerprint) } return fingerprints, nil }Then in each configure function:
- getSshKeysResult, err := digitalocean.GetSshKeys(ctx, &digitalocean.GetSshKeysArgs{}, nil) - if err != nil { - return err - } - - var sshFingerprints []string - for _, key := range getSshKeysResult.SshKeys { - sshFingerprints = append(sshFingerprints, key.Fingerprint) - } + sshFingerprints, err := getSshFingerprints(ctx) + if err != nil { + return err + }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@main.go` around lines 193 - 201, The SSH key fetch + fingerprint extraction (using digitalocean.GetSshKeys, getSshKeysResult and sshFingerprints) is duplicated across multiple configure* functions; extract it into a single helper (e.g., getSshFingerprints(ctx *pulumi.Context) ([]string, error)) that calls digitalocean.GetSshKeys, handles the error, builds and returns the []string of fingerprints, and then replace the inlined loops in each configure* function with a call to this helper to remove repetition and centralize future changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@main.go`:
- Around line 193-201: The SSH key fetch + fingerprint extraction (using
digitalocean.GetSshKeys, getSshKeysResult and sshFingerprints) is duplicated
across multiple configure* functions; extract it into a single helper (e.g.,
getSshFingerprints(ctx *pulumi.Context) ([]string, error)) that calls
digitalocean.GetSshKeys, handles the error, builds and returns the []string of
fingerprints, and then replace the inlined loops in each configure* function
with a call to this helper to remove repetition and centralize future changes.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ad5ad6a7-216b-4443-9dde-a07995083a2e
📒 Files selected for processing (3)
.github/workflows/preview.yamliroh-relay-unyt/cloud-init.yamlmain.go
✅ Files skipped from review due to trivial changes (1)
- .github/workflows/preview.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- iroh-relay-unyt/cloud-init.yaml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@iroh-relay-unyt/cloud-init.yaml`:
- Around line 52-58: The PR description incorrectly states v0.97.0 while the
cloud-init script clearly downloads and pins iroh-relay v0.95.1 (see the curl
URL ".../v0.95.1/iroh-relay-v0.95.1..." and the SHA "a7dbc3f7..."), so update
the PR description to state that v0.95.1 is being deployed (and note the
intentional downgrade referenced in the commit), and optionally mention the
pinned SHA256 verification used in the script for clarity.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: aa3fdefb-600d-4b63-93c7-1361228b57b9
📒 Files selected for processing (3)
iroh-relay-hc/cloud-init.yamliroh-relay-unyt/cloud-init.yamlmain.go
🚧 Files skipped from review as they are similar to previous changes (1)
- main.go
Comment on lines
+52
to
+58
| # Download and install iroh-relay v0.95.1 | ||
| curl -fsSL https://github.com/n0-computer/iroh/releases/download/v0.95.1/iroh-relay-v0.95.1-x86_64-unknown-linux-musl.tar.gz \ | ||
| -o /tmp/iroh-relay.tar.gz | ||
| echo "a7dbc3f72446c042159da7b10d3947141c88569d6226d9d0a71fb912cd0fe5ba /tmp/iroh-relay.tar.gz" | sha256sum -c - | ||
| tar -xzf /tmp/iroh-relay.tar.gz -C /tmp | ||
| install -m 0755 /tmp/iroh-relay /usr/local/bin/iroh-relay | ||
| rm -f /tmp/iroh-relay.tar.gz /tmp/iroh-relay |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the SHA256 hash matches the actual v0.95.1 release artifact
EXPECTED_HASH="a7dbc3f72446c042159da7b10d3947141c88569d6226d9d0a71fb912cd0fe5ba"
curl -fsSL https://github.com/n0-computer/iroh/releases/download/v0.95.1/iroh-relay-v0.95.1-x86_64-unknown-linux-musl.tar.gz \
-o /tmp/iroh-relay-verify.tar.gz
ACTUAL_HASH=$(sha256sum /tmp/iroh-relay-verify.tar.gz | cut -d' ' -f1)
echo "Expected: ${EXPECTED_HASH}"
echo "Actual: ${ACTUAL_HASH}"
if [ "${EXPECTED_HASH}" = "${ACTUAL_HASH}" ]; then
echo "✓ Hash matches"
else
echo "✗ Hash mismatch!"
exit 1
fi
rm -f /tmp/iroh-relay-verify.tar.gzRepository: holochain/network-services
Length of output: 237
🏁 Script executed:
#!/bin/bash
python3 <<'EOF'
import hashlib
import urllib.request
import sys
EXPECTED_HASH = "a7dbc3f72446c042159da7b10d3947141c88569d6226d9d0a71fb912cd0fe5ba"
URL = "https://github.com/n0-computer/iroh/releases/download/v0.95.1/iroh-relay-v0.95.1-x86_64-unknown-linux-musl.tar.gz"
try:
print("Downloading iroh v0.95.1 release artifact...")
with urllib.request.urlopen(URL) as response:
sha256_hash = hashlib.sha256()
while True:
data = response.read(65536)
if not data:
break
sha256_hash.update(data)
actual_hash = sha256_hash.hexdigest()
print(f"Expected: {EXPECTED_HASH}")
print(f"Actual: {actual_hash}")
if EXPECTED_HASH == actual_hash:
print("✓ Hash matches v0.95.1 release")
sys.exit(0)
else:
print("✗ Hash mismatch!")
sys.exit(1)
except Exception as e:
print(f"Error: {e}")
sys.exit(1)
EOFRepository: holochain/network-services
Length of output: 249
🌐 Web query:
iroh v0.95.1 release SHA256 hash n0-computer/iroh
💡 Result:
No SHA256 hash for iroh v0.95.1 release was found in available sources. The GitHub releases page mentions "chore: Release iroh-base version 0.95.1" on 21 Nov (likely 2025), but no direct link to /releases/tag/v0.95.1 or asset checksums. A SourceForge mirror exists at https://sourceforge.net/projects/iroh.mirror/files/v0.95.1/ with binaries, but no SHA256 checksums listed. GitHub assets for nearby releases (v0.94.0, v0.96.0, v0.97.0) also lack explicit SHA256 hashes in snippets. The project uses BLAKE3 internally, but binaries typically provide SHA256 for verification.
Citations:
- 1: https://sourceforge.net/projects/iroh.mirror/files/v0.95.1/
- 2: https://github.com/n0-computer/iroh/releases
- 3: https://github.com/n0-computer/iroh/milestone/49
- 4: https://github.com/n0-computer/iroh/releases/tag/v0.94.0
- 5: https://github.com/n0-computer/iroh/releases/tag/v0.97.0
- 6: https://sourceforge.net/projects/iroh.mirror/
Update PR description to reflect v0.95.1 deployment.
The code downloads v0.95.1, not v0.97.0 as mentioned in the PR description. The commit message confirms this is an intentional downgrade. Update the PR description to match the actual deployed version.
The SHA256 verification approach is correct: iroh does not publish checksums, so using a self-computed hash pinned in the script is the appropriate verification method.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@iroh-relay-unyt/cloud-init.yaml` around lines 52 - 58, The PR description
incorrectly states v0.97.0 while the cloud-init script clearly downloads and
pins iroh-relay v0.95.1 (see the curl URL ".../v0.95.1/iroh-relay-v0.95.1..."
and the SHA "a7dbc3f7..."), so update the PR description to state that v0.95.1
is being deployed (and note the intentional downgrade referenced in the commit),
and optionally mention the pinned SHA256 verification used in the script for
clarity.
|
✔️ 7add66a...cd41b64 - Conventional commits check succeeded. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
iroh-relay-unyt.holochain.orgiroh-relaymusl binary directly via a native systemd service (no containers)Summary by CodeRabbit