From c2fdfaccdb994a2b32c29ed42a5cd2be6f290abf Mon Sep 17 00:00:00 2001 From: librelad Date: Tue, 18 Aug 2026 20:56:52 +0100 Subject: [PATCH] fix(stoat): tell the services the RabbitMQ password we gave the broker MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The compose hands RabbitMQ a generated password, but the Stoat services fall back to the defaults compiled into them — rabbituser/rabbitpass — so api, crond, pushd and voice-ingress panicked on ACCESS_REFUSED and restarted forever. The failure was easy to misread: the eleven services that never touch RabbitMQ came up healthy and the web client answered on port 80, so the stack looked almost fine while none of the messaging worked. Write a [rabbit] section into Revolt.toml carrying the same credentials the broker was given. Verified after the fix: all sixteen containers up, /api returns the instance descriptor, /autumn answers, and /.well-known/stoat carries the right URL. Co-Authored-By: Claude Opus 5 --- containers/stoat/scripts/stoat_install_hooks.sh | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/containers/stoat/scripts/stoat_install_hooks.sh b/containers/stoat/scripts/stoat_install_hooks.sh index ad2d160..f6ebdfa 100644 --- a/containers/stoat/scripts/stoat_install_hooks.sh +++ b/containers/stoat/scripts/stoat_install_hooks.sh @@ -118,6 +118,17 @@ worldwide = "${ws_scheme}://${hostport}/livekit" url = "http://livekit:7880" lat = 0.0 lon = 0.0 + +# Upstream's built-in defaults are rabbituser/rabbitpass. The compose gives the +# broker a generated password instead, so the clients have to be told — without +# this the API, crond, pushd and voice-ingress all panic on ACCESS_REFUSED and +# restart forever, while the services that do not touch RabbitMQ come up fine +# and make it look like a partial success. +[rabbit] +host = "rabbit" +port = 5672 +username = "stoat" +password = "${rabbit_pass}" EOF if [[ -n "$video_enabled" ]]; then @@ -207,7 +218,7 @@ stoat_install_post_compose() # domain; stoat_install_post_start rewrites these once it is known. local base base=$(_stoatBaseUrl "$app_name") - _stoatWriteUrlFiles "$app_dir" "$base" "$video_enabled" + _stoatWriteUrlFiles "$app_dir" "$base" "$video_enabled" "$CFG_STOAT_RABBITMQ_PASSWORD_1" checkSuccess "Writing .env.web, stoat.json and Revolt.toml for $base" _stoatWriteSecrets "$app_dir/secrets.env" @@ -282,7 +293,7 @@ stoat_install_post_start() local video_enabled="" [[ "$CFG_STOAT_ENABLE_VIDEO" != "false" ]] && video_enabled="true" - _stoatWriteUrlFiles "$app_dir" "$base" "$video_enabled" + _stoatWriteUrlFiles "$app_dir" "$base" "$video_enabled" "$CFG_STOAT_RABBITMQ_PASSWORD_1" runFileOp chown -R "$docker_install_user":"$docker_install_user" "$app_dir" isSuccessful "Public URL settled as $base (was ${current:-unset})"