Bring server/'s docs in line with this fork's mandatory auth - #12
Merged
Conversation
server/.env.example and server/README.md are inherited from upstream and were
never updated when this fork made GRAPHITI_API_KEY mandatory. Neither mentioned
it, so a developer following them got a server that exits at startup with a
pydantic error and no hint of which file was wrong. Both are the first thing
someone reads when they open server/, and the root README they contradict is the
correct one.
server/README.md also told the reader to run `zepai/graphiti:latest`. That is
upstream's published image and does not contain this fork's auth code at all, so
following it produced a service with no key requirement and none of the behaviour
the root README documents. Now it builds from the repo root Dockerfile, which is
what render.yaml and docker-compose.yml already do, and the upstream image is
described as upstream's with that caveat stated.
Two smaller things fixed in the same pass, both in the compose snippet:
- Ports were published on every interface while the snippet shipped a
placeholder key and NEO4J_PASSWORD=password, so copying it exposed
unmediated Bolt write access on a shared network. Bound to 127.0.0.1,
matching docker-compose.yml.
- neo4j:5.22.0 and the obsolete `version: '3.8'` key, replaced with 5.26.2 to
match docker-compose.yml.
Added an auth section stating the rule once, and a pointer to the root README
for the Render path, since that is what most readers of this directory want.
Verified: the compose snippet passes `docker compose config` with its defaults
resolving and all three ports bound to 127.0.0.1; Settings loads from a .env
copied off the new server/.env.example once OPENAI_API_KEY is filled in, with
graphiti_api_key at 22 characters against the 16 minimum; every number quoted in
the prose cross-checked against auth.py and config.py (MAX_FAILED_AUTH 10,
FAILED_AUTH_WINDOW_SECONDS 60, MIN_API_KEY_LENGTH 16); 32 passed, 1 skipped.
Docs only — no code, no config values, no behaviour change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
server/.env.exampleandserver/README.mdare inherited from upstream and never got updated when this fork madeGRAPHITI_API_KEYmandatory. Neither mentioned it, so following them gave you a server that exits at startup with a pydantic error and no hint which file was wrong.server/README.mdalso told you to runzepai/graphiti:latest— upstream's image, which contains none of this fork's auth. It now builds from the rootDockerfile, matchingrender.yamlanddocker-compose.yml.Also in the compose snippet: ports were published on every interface alongside a placeholder key and
NEO4J_PASSWORD=password, so copying it exposed Bolt write access on a shared network — now bound to127.0.0.1. Andneo4j:5.22.0→5.26.2, dropping the obsoleteversion:key.Found running the template quality bar. Docs only — no code, no config values, no behaviour change.
Verified: compose snippet passes
docker compose configwith all ports on127.0.0.1;Settingsloads from the new example onceOPENAI_API_KEYis filled in; the numbers in the prose matchauth.py/config.py; 32 passed, 1 skipped.🤖 Generated with Claude Code