openvibers/openvibe.chat Commits

Fix Chat runbook to create the service principal with --write-env (#8)

OP OpenVibers committed 3 Oct 2026 · 4d8d5b350d · 2 files, +8 −3

checks run by GitHub CI (test) · CI ✓ 3/3 · review SHIP by DeepSeek harness

https://github.com/OpenVibers/OpenVibe.Chat/pull/8

Changes

ddiff --git a/.env.example b/.env.example
iindex a50f703..f4c5a33 100644
---- a/.env.example
++++ b/.env.example
@@@ -33,8 +33,9 @@ OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000
  # PEM with the Network public key; unset = fetched from ${OV_NETWORK_INTERNAL_URL}/api/.well-known/jwks
  #OV_NETWORK_PUBLIC_KEY=/opt/openvibe.live/data/keys/openvibe-tools-public.pem
  
--# Chat's service principal (client `chat`; create it with Network's
--# server/setup/service-principal.js create chat --env-file /etc/openvibe/chat.env)
++# Chat's service principal (client `chat`; on the Network host, load Network's env before the
++# script and write the secret here: sudo node --env-file=/etc/openvibe/network.env
++# server/setup/service-principal.js create chat --write-env /etc/openvibe/chat.env)
  OV_OAUTH_CLIENT_ID=chat
  OV_OAUTH_CLIENT_SECRET=written-by-service-principal-js
  
ddiff --git a/docs/cutover.md b/docs/cutover.md
iindex 644ee10..bc4a32e 100644
---- a/docs/cutover.md
++++ b/docs/cutover.md
@@@ -61,8 +61,12 @@ Live data maintained by `live-context` (never authority), `events_outbox`, `live
     capabilities as undefined (Live's CI with the patch, Chat's non-blocking contracts job).
  2. **Network.** Create the principal and grants:
     ```bash
--   sudo node server/setup/service-principal.js create chat --env-file /etc/openvibe/chat.env
++   sudo node --env-file=/etc/openvibe/network.env server/setup/service-principal.js create chat --write-env /etc/openvibe/chat.env
     ```
++   Network's env file goes **before** the script name so Node loads it as configuration;
++   `--write-env` names the file the secret is written to (Chat's). Never put `--env-file`
++   after the script name — Node consumes it as environment, which can point the script at
++   Chat's database instead of Network's (`ov_network`).
     `principal_grants` (client, capability, audience): `chat live.chat_context.read openvibe.live`,
     `chat live.chat_effects.write openvibe.live`, `chat live.chat_mirror.write openvibe.live`,
     `live chat.live_bridge.write openvibe.chat`, `live chat.message.send openvibe.chat`,