mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 17:45:53 +01:00
Harold KimandPaperclip
98df214917
When reusing a Codex sandbox, the workspace-restore step now performs an auth-merge check before adopting the sandbox's auth.json. The merge fails closed when: - host or sandbox Codex auth is unusable (missing token or account) - the subscription payload shapes differ between host and sandbox - subscription account identities do not match Additional hardening: node absence on PATH during the embedded decision script now exits non-zero instead of silently falling through. Co-change comments link parseAuth (the embedded script) to hasUsableAuthPayload (codex-home.ts) so a future auth-format change cannot silently diverge between the two implementations. Co-Authored-By: Paperclip <noreply@paperclip.ing>
91 lines
3.0 KiB
JSON
91 lines
3.0 KiB
JSON
{
|
|
"family": "paperclip-server",
|
|
"networkMode": "awsvpc",
|
|
"requiresCompatibilities": ["FARGATE"],
|
|
"cpu": "2048",
|
|
"memory": "4096",
|
|
"executionRoleArn": "arn:aws:iam::<ACCOUNT_ID>:role/paperclip-ecs-execution",
|
|
"taskRoleArn": "arn:aws:iam::<ACCOUNT_ID>:role/paperclip-ecs-task",
|
|
"containerDefinitions": [
|
|
{
|
|
"name": "paperclip-server",
|
|
"image": "<ACCOUNT_ID>.dkr.ecr.<REGION>.amazonaws.com/paperclip-server:latest",
|
|
"essential": true,
|
|
"portMappings": [
|
|
{
|
|
"containerPort": 3100,
|
|
"protocol": "tcp"
|
|
}
|
|
],
|
|
"environment": [
|
|
{ "name": "NODE_ENV", "value": "production" },
|
|
{ "name": "HOST", "value": "0.0.0.0" },
|
|
{ "name": "PORT", "value": "3100" },
|
|
{ "name": "SERVE_UI", "value": "true" },
|
|
{ "name": "PAPERCLIP_HOME", "value": "/paperclip" },
|
|
{ "name": "PAPERCLIP_INSTANCE_ID", "value": "default" },
|
|
{ "name": "PAPERCLIP_CONFIG", "value": "/paperclip/instances/default/config.json" },
|
|
{ "name": "PAPERCLIP_DEPLOYMENT_MODE", "value": "authenticated" },
|
|
{ "name": "PAPERCLIP_DEPLOYMENT_EXPOSURE", "value": "public" },
|
|
{ "name": "PAPERCLIP_PUBLIC_URL", "value": "https://<DOMAIN>" },
|
|
{ "name": "PAPERCLIP_MIGRATION_AUTO_APPLY", "value": "true" },
|
|
{ "name": "HEARTBEAT_SCHEDULER_ENABLED", "value": "true" }
|
|
],
|
|
"secrets": [
|
|
{
|
|
"name": "DATABASE_URL",
|
|
"valueFrom": "arn:aws:secretsmanager:<REGION>:<ACCOUNT_ID>:secret:paperclip/database-url"
|
|
},
|
|
{
|
|
"name": "BETTER_AUTH_SECRET",
|
|
"valueFrom": "arn:aws:secretsmanager:<REGION>:<ACCOUNT_ID>:secret:paperclip/better-auth-secret"
|
|
},
|
|
{
|
|
"name": "ANTHROPIC_API_KEY",
|
|
"valueFrom": "arn:aws:secretsmanager:<REGION>:<ACCOUNT_ID>:secret:paperclip/anthropic-api-key"
|
|
},
|
|
{
|
|
"name": "OPENAI_API_KEY",
|
|
"valueFrom": "arn:aws:secretsmanager:<REGION>:<ACCOUNT_ID>:secret:paperclip/openai-api-key"
|
|
},
|
|
{
|
|
"name": "GITHUB_TOKEN",
|
|
"valueFrom": "arn:aws:secretsmanager:<REGION>:<ACCOUNT_ID>:secret:paperclip/github-token"
|
|
}
|
|
],
|
|
"mountPoints": [
|
|
{
|
|
"sourceVolume": "paperclip-data",
|
|
"containerPath": "/paperclip",
|
|
"readOnly": false
|
|
}
|
|
],
|
|
"healthCheck": {
|
|
"command": ["CMD-SHELL", "curl -f http://localhost:3100/api/health || exit 1"],
|
|
"interval": 30,
|
|
"timeout": 5,
|
|
"retries": 3,
|
|
"startPeriod": 60
|
|
},
|
|
"logConfiguration": {
|
|
"logDriver": "awslogs",
|
|
"options": {
|
|
"awslogs-group": "/ecs/paperclip",
|
|
"awslogs-region": "<REGION>",
|
|
"awslogs-stream-prefix": "server"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"volumes": [
|
|
{
|
|
"name": "paperclip-data",
|
|
"efsVolumeConfiguration": {
|
|
"fileSystemId": "<EFS_ID>",
|
|
"rootDirectory": "/",
|
|
"transitEncryption": "ENABLED"
|
|
}
|
|
}
|
|
]
|
|
}
|