chore: repo cleanup and updates

deploy/docker-compose/.env.example

@@ -41,11 +41,10 @@ HATCHET_DATABASE_URL="postgres://${HATCHET_POSTGRES_USER}:${HATCHET_POSTGRES_PAS
 # HATCHET_CLIENT_TOKEN is auto-generated to .env.hatchet-generated by bin/generate-hatchet-token.sh
 HATCHET_CLIENT_TLS_STRATEGY='none'
 
-# ==== REDIS (OPTIONAL - NOT STARTED BY DEFAULT) ====
-# Uncomment and configure if you need Redis caching
-# REDIS_HOST='redis'
-# REDIS_PORT='6379'
-# REDIS_PASSWORD=''
+# ==== REDIS ====
+REDIS_HOST='greptile-redis'
+REDIS_PORT='6379'
+REDIS_USE_TLS='false' # services default TLS on for any host but localhost
 
 # Greptile Services
 IP_ADDRESS='127.0.0.1' # TODO change to public IP address of the server where containers are hosted
@@ -70,22 +69,22 @@ GITLAB_WEBHOOK_URL="${GREPTILE_WEBHOOK_URL}"
 # LLM - Configuration
 # When using LLMs provided by Anthropic
 ANTHROPIC_BASE_URL='https://api.anthropic.com' # TODO Change to the base URL of your Anthropic model provider
-ANTHROPIC_KEY='sk-ant-secret_key' # TODO Set your API token
+ANTHROPIC_API_KEY='sk-ant-secret_key' # TODO Set your API token
 # When using LLMs provided by OpenAI
-OPENAI_API_BASE_URL='https://api.openai.com/v1/' # TODO Change to the base URL of your OpenAi model provider
-OPENAI_KEY='sk-openai_key' # TODO Set your API token
+OPENAI_BASE_URL='https://api.openai.com/v1/' # TODO Change to the base URL of your OpenAI model provider
+OPENAI_API_KEY='sk-openai_key' # TODO Set your API token
 # When using LLMs provided on Azure
-AZURE_OPENAI_URL='https://onboardai.openai.azure.com/' # TODO Change to the base URL of your Azure model provider (if not used leave untouched)
-AZURE_OPENAI_KEY='azure_key' # TODO Set your API token (if not used leave untouched)
+AZURE_OPENAI_BASE_URL='https://onboardai.openai.azure.com/' # TODO Change to the base URL of your Azure model provider (if not used leave untouched)
+AZURE_OPENAI_API_KEY='azure_key' # TODO Set your API token (if not used leave untouched)
 AZURE_OPENAI_API_VERSION='2024-07-18' # TODO Change to the API version used in Azure (if not used leave untouched)
-# When using AWS Bedrock models
-AWS_ACCESS_KEY_ID='aws_access_key' # TODO Change to the AWS bedrock AWS_ACCESS_KEY_ID (if not used leave untouched)
-AWS_SECRET_ACCESS_KEY='aws_secret_key' # TODO Set your AWS bedrock AWS_SECRET_ACCESS_KEY (if not used leave untouched)
-AWS_REGION='us-east-1' # TODO Set to your AWS region (if not used leave untouched)
+# When using Amazon Bedrock models
+AWS_ACCESS_KEY_ID='aws_access_key' # TODO Set to your Amazon Bedrock AWS_ACCESS_KEY_ID (if not used leave untouched)
+AWS_SECRET_ACCESS_KEY='aws_secret_key' # TODO Set your Amazon Bedrock AWS_SECRET_ACCESS_KEY (if not used leave untouched)
+AWS_REGION_NAME='us-east-1' # TODO Set to your AWS region (if not used leave untouched)
 
 # GITHUB (Cloud) App Configurations
-GITHUB_ENABLED='false' # set to true if using regular Github Cloud
-GITHUB_ENTERPRISE_ENABLED='true' # Set to true if using self-hosted Github Enterprise
+GITHUB_ENABLED='false' # set to true if using regular GitHub Cloud
+GITHUB_ENTERPRISE_ENABLED='true' # Set to true if using self-hosted GitHub Enterprise
 GITHUB_APP_ID='123'
 GITHUB_CLIENT_ID='Iv1.1234567890'
 GITHUB_CLIENT_SECRET='client_secret'
@@ -138,11 +137,11 @@ JACKSON_PRIVATE_KEY='' # private key for the certificate
 JACKSON_IDP_ENABLED='true'
 JACKSON_DB_SSL='false'
 
-AUTH_GITHUB_ID='' # [OPTIONAL] for Github SSO
-AUTH_GITHUB_SECRET='' # [OPTIONAL] for Github SSO
+AUTH_GITHUB_ID='' # [OPTIONAL] for GitHub SSO
+AUTH_GITHUB_SECRET='' # [OPTIONAL] for GitHub SSO
 
 # GitLab
-GITLAB_ENABLED='true' #default is true
+GITLAB_ENABLED='true' # defaults to true
 
 # Email Configuration
 EMAIL_PROVIDER='SES'

deploy/docker-compose/bin/generate-secrets.sh

@@ -33,13 +33,8 @@ log() {
 
 # Generate random 32-character alphanumeric string
 generate_random_string() {
-  # Generate enough base64 output that filtering non-alphanumerics still leaves 32 chars.
-  if command -v openssl >/dev/null 2>&1; then
-    openssl rand -base64 48 | tr -d '\n' | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c 32
-  # Fallback: use /dev/urandom (may block on low-entropy systems)
-  else
-    LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32
-  fi
+  # Enough base64 that filtering non-alphanumerics still leaves 32 chars.
+  openssl rand -base64 48 | tr -d '\n' | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c 32
 }
 
 # Generate LiteLLM master key (must start with 'sk-' for virtual key compatibility)
@@ -56,21 +51,6 @@ key_has_value_in_file() {
   [[ -f "$file" ]] && grep -qE "^${key}=.+" "$file" 2>/dev/null
 }
 
-# Get value of a key from a file
-get_value_from_file() {
-  local key="$1"
-  local file="$2"
-  if [[ -f "$file" ]]; then
-    grep -E "^${key}=" "$file" 2>/dev/null | head -n1 | cut -d'=' -f2- | tr -d "'\""
-  fi
-}
-
-# Check if secret exists (in .env or .env.greptile-generated)
-secret_exists() {
-  local key="$1"
-  key_has_value_in_file "$key" "$ENV_FILE" || key_has_value_in_file "$key" "$SECRETS_FILE"
-}
-
 # Parse arguments
 while [[ $# -gt 0 ]]; do
   case "$1" in

deploy/docker-compose/docker-compose.yaml

@@ -152,6 +152,18 @@ services:
     profiles:
       - greptile
 
+  greptile-redis:
+    image: valkey/valkey:8.1-alpine
+    container_name: greptile-redis
+    restart: on-failure
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 2s
+      timeout: 5s
+      retries: 10
+    profiles:
+      - greptile
+
   greptile-db-migration:
     image: ${CONTAINER_REGISTRY}/db-migration-job:${GREPTILE_TAG}
     depends_on:
@@ -278,17 +290,16 @@ services:
       - .env.greptile-generated
     environment:
       - PORT=4000
-      # Map common.env variable names to what the config file expects
       - ANTHROPIC_BASE_URL=${ANTHROPIC_BASE_URL}
-      - ANTHROPIC_API_KEY=${ANTHROPIC_KEY}
-      - OPENAI_BASE_URL=${OPENAI_API_BASE_URL}
-      - OPENAI_API_KEY=${OPENAI_KEY}
-      - AZURE_OPENAI_BASE_URL=${AZURE_OPENAI_URL}
-      - AZURE_OPENAI_API_KEY=${AZURE_OPENAI_KEY}
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-${ANTHROPIC_KEY}}
+      - OPENAI_BASE_URL=${OPENAI_BASE_URL:-${OPENAI_API_BASE_URL}}
+      - OPENAI_API_KEY=${OPENAI_API_KEY:-${OPENAI_KEY}}
+      - AZURE_OPENAI_BASE_URL=${AZURE_OPENAI_BASE_URL:-${AZURE_OPENAI_URL}}
+      - AZURE_OPENAI_API_KEY=${AZURE_OPENAI_API_KEY:-${AZURE_OPENAI_KEY}}
       - AZURE_OPENAI_API_VERSION=${AZURE_OPENAI_API_VERSION}
       - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
       - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
-      - AWS_REGION_NAME=${AWS_REGION}
+      - AWS_REGION_NAME=${AWS_REGION_NAME:-${AWS_REGION}}
     ports:
       - "4000:4000"
     profiles:

deploy/kubernetes/charts/greptile/templates/NOTES.txt

@@ -0,0 +1,3 @@
+{{- if not .Values.authV2.enabled }}
+Enable Greptile CLI and MCP for your team by migrating to Auth v2 — see docs/operations.md for details.
+{{- end }}

deploy/kubernetes/charts/greptile/templates/_helpers.tpl

@@ -56,6 +56,18 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- printf "%s-pgbouncer" (include "greptile.fullname" .) -}}
 {{- end -}}
 
+{{- define "greptile.redisName" -}}
+{{- printf "%s-redis" (include "greptile.fullname" .) -}}
+{{- end -}}
+
+{{- define "greptile.redisHost" -}}
+{{- .Values.redis.external.host | default (include "greptile.redisName" .) -}}
+{{- end -}}
+
+{{- define "greptile.redisUrl" -}}
+{{- printf "%s:6379" (include "greptile.redisHost" .) -}}
+{{- end -}}
+
 {{- define "greptile.componentName" -}}
 {{- printf "%s-%s" (include "greptile.fullname" .root) .name -}}
 {{- end -}}
@@ -164,3 +176,11 @@ vector
 {{- define "greptile.vectorDatabaseUrl" -}}
 {{- printf "postgresql://%s:%s@%s:%s/%s" (include "greptile.databaseUser" .) (include "greptile.databasePassword" .) (include "greptile.databaseHost" .) (include "greptile.databasePort" .) (include "greptile.vectorDatabaseName" .) -}}
 {{- end -}}
+
+{{- define "greptile.hydraTokenHookUrl" -}}
+{{- if .Values.authV2.hookUrl -}}
+{{- .Values.authV2.hookUrl -}}
+{{- else -}}
+{{- printf "http://%s:%v/api/hooks/token" (include "greptile.componentName" (dict "root" . "name" "auth-v2")) (index .Values.components "auth-v2").service.port -}}
+{{- end -}}
+{{- end -}}

deploy/kubernetes/charts/greptile/templates/configmap-component-env.yaml

@@ -1,6 +1,8 @@
 {{- range $name, $component := .Values.components }}
 {{- $isJackson := eq $name "jackson" }}
-{{- if and $component.enabled (or (not $isJackson) $.Values.saml.enabled) }}
+{{- $isAuth := eq $name "auth" }}
+{{- $isAuthV2 := eq $name "auth-v2" }}
+{{- if and $component.enabled (or (not $isJackson) $.Values.saml.enabled) (or (not $isAuth) (not $.Values.authV2.enabled)) (or (not $isAuthV2) $.Values.authV2.enabled) }}
 ---
 apiVersion: v1
 kind: ConfigMap

deploy/kubernetes/charts/greptile/templates/configmap-hydra-config.yaml

@@ -0,0 +1,64 @@
+{{- if .Values.authV2.enabled }}
+# Hydra's config, mounted over /etc/hydra/hydra.yml. List-valued keys must live
+# here rather than env; secrets and the DSN stay in env.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "greptile.fullname" . }}-hydra-config
+  labels:
+    {{- include "greptile.labels" . | nindent 4 }}
+    app.kubernetes.io/component: hydra
+data:
+  hydra.yml: |
+    serve:
+      public:
+        cors:
+          enabled: true
+          allowed_origins:
+            - {{ .Values.network.appUrl }}
+        port: {{ .Values.authV2.hydra.publicPort }}
+      admin:
+        host: 0.0.0.0
+        port: {{ .Values.authV2.hydra.adminPort }}
+
+    urls:
+      self:
+        issuer: {{ .Values.network.authUrl }}
+      login: {{ .Values.network.authUrl }}/login
+      consent: {{ .Values.network.authUrl }}/consent
+      logout: {{ .Values.network.authUrl }}/logout
+      error: {{ .Values.network.authUrl }}/auth-error
+
+    oauth2:
+      pkce:
+        enforced: true
+      expose_internal_errors: false
+      grant:
+        refresh_token:
+          rotation_grace_period: 5m0s
+
+    # The guard stays on; the token hook is the sole exception.
+    clients:
+      http:
+        disallow_private_ip_ranges: true
+        private_ip_exception_urls:
+          - {{ include "greptile.hydraTokenHookUrl" . }}
+
+    oidc:
+      dynamic_client_registration:
+        enabled: true
+        default_scope:
+          - read
+          - write
+          - openid
+          - offline_access
+
+    strategies:
+      access_token: jwt
+      scope: wildcard
+
+    ttl:
+      access_token: 30m0s
+      refresh_token: 720h0m0s
+      auth_code: 10m0s
+{{- end }}

deploy/kubernetes/charts/greptile/templates/deployment-components.yaml

@@ -1,6 +1,8 @@
 {{- range $name, $component := .Values.components }}
 {{- $isJackson := eq $name "jackson" }}
-{{- if and $component.enabled (or (not $isJackson) $.Values.saml.enabled) }}
+{{- $isAuth := eq $name "auth" }}
+{{- $isAuthV2 := eq $name "auth-v2" }}
+{{- if and $component.enabled (or (not $isJackson) $.Values.saml.enabled) (or (not $isAuth) (not $.Values.authV2.enabled)) (or (not $isAuthV2) $.Values.authV2.enabled) }}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -81,6 +83,12 @@ spec:
           env:
             - name: COMPONENT_NAME
               value: {{ $name | quote }}
+            - name: REDIS_HOST
+              value: {{ include "greptile.redisHost" $ | quote }}
+            - name: REDIS_PORT
+              value: "6379"
+            - name: REDIS_USE_TLS
+              value: {{ $.Values.redis.external.tls | quote }}
             {{- range $secretKey := $component.secretEnv }}
             - name: {{ $secretKey }}
               valueFrom: