fix(omniroute): add required WS bridge secret, memory ceiling, shutdown grace period

Cross-checked the deployment against OmniRoute's own docs
(docs/reference/ENVIRONMENT.md, docs/guides/DOCKER_GUIDE.md) and found
three gaps from the original migration:

- OMNIROUTE_WS_BRIDGE_SECRET was entirely missing - ENVIRONMENT.md marks
  it REQUIRED (production), for the internal Codex Responses WebSocket
  bridge. docker compose config validated fine without it (compose
  doesn't know omniroute's own required-var list), so this went
  unnoticed until checking the docs directly.
- No mem_limit/OMNIROUTE_MEMORY_MB - the Docker guide is explicit that
  the 1024MB default heap is dashboard-only sized; coding-agent workloads
  (every client this stack has) need OMNIROUTE_MEMORY_MB=8192 and a
  10+ GiB container ceiling. Set both.
- No stop_grace_period - the guide's --stop-timeout 40 equivalent, so
  SQLite WAL changes checkpoint back into the main DB file on shutdown
  instead of getting killed mid-write.

Redis checked and confirmed correctly absent - OmniRoute uses SQLite
only, no Redis anywhere in its docs.

Still open: whether API_PORT actually isolates /dashboard and /api/*
from the published port, or bridges everything through (see issue #31)
- OmniRoute's own ARCHITECTURE.md doesn't document split-port mode as a
real security boundary, and the live "[API Bridge] ... -> dashboard"
log line is ambiguous. Waiting on a live curl test against
proxy-ai.home before treating that as resolved.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VPZ6TogJiYxG8E4EQBB197

This commit is contained in:

haylan

2026-09-03 20:37:49 +02:00

co-authored by

Claude-Bot

parent 6132e6263e

commit c38375c0f4

3 changed files with 19 additions and 0 deletions

									
										scripts/update.sh
									
		+1
		
												View File
												
				@@ -43,6 +43,7 @@ set_if_blank OMNIROUTE_API_KEY_SECRET "$(openssl rand -hex 32)"

				set_if_blank OMNIROUTE_STORAGE_ENCRYPTION_KEY "$(openssl rand -hex 32)"

				set_if_blank OMNIROUTE_MACHINE_ID_SALT "$(openssl rand -hex 16)"

				set_if_blank OMNIROUTE_CLI_SALT "$(openssl rand -hex 16)"

				set_if_blank OMNIROUTE_WS_BRIDGE_SECRET "$(openssl rand -hex 32)"

				echo "==> resolving SEARXNG_LAN_IP"

				# search.home is a LAN mDNS/local-DNS name — resolvable from this host, just