Files
boardroom-map/startos/file-models/secrets.ts
T
Jonathan KirkwoodandClaude Fable 5 91212322c1 Ship v0.1.1–v0.1.5: first-live-run fixes and dashboard viewer
- v0.1.1: config persistence — FileHelper paths made absolute
  (/media/startos/volumes/main/...); relative paths resolved into the JS
  runtime's ephemeral cwd so action saves never reached /data
- v0.1.2: preJobStopContainers (Configure Grading) — docker-stop resident
  vLLM containers on the head Spark at job start, no auto-restart
- v0.1.3: preflight auth (LiteLLM master_key gates /models),
  poll-until-loaded, crash fast-fail (restarting counts as dead)
- v0.1.4: HF_HUB_OFFLINE/TRANSFORMERS_OFFLINE in airgapped serving
  (--internal network has no DNS); grader _post timeout 600→1800s for
  ~3.6 tok/s GB10 generation
- v0.1.5: dashboard viewer survives the periodic background refresh;
  download buttons for deck reports, deck JSON, and SCORECARD.md
- .gitignore: .startos/ build workspace, start-technologies/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-30 09:14:24 -05:00

29 lines
1.2 KiB
TypeScript

import { FileHelper } from '@start9labs/start-sdk'
/**
* SSH private key used to reach the Sparks, stored as a standalone file in the
* `main` volume. Kept out of config.json so it is never returned in plaintext
* config reads. The container copies it to a 600 path at runtime.
*
* Volume path (absolute — a relative path would resolve against the JS
* runtime's ephemeral cwd, not the volume) -> /data/ssh/id_spark inside the
* orchestrator container.
*/
export const sshKeyFile = FileHelper.string(
'/media/startos/volumes/main/ssh/id_spark',
)
/**
* Optional Hugging Face token (for gated/private model pulls on the Sparks).
* Passed to the vLLM serving container as HF_TOKEN at launch. In `airgapped`
* network mode models are served from a pre-pulled cache, so this is only used
* the first time you warm a model (or in local_services mode).
*
* Volume path (absolute, see above) -> /data/secrets/hf_token.
*
* NOTE: Boardroom Map has NO frontier/cloud key. There is deliberately no Anthropic
* key and no Gitea token — the whole point is that confidential documents and
* their reviews never leave your hardware.
*/
export const hfTokenFile = FileHelper.string('./secrets/hf_token')