Persist gateway state when using embedded OCI on NixOS #270

New issue

Closed

opened 2026-05-19 08:14:28 -07:00 by jwilger · 0 comments

jwilger commented

2026-05-19 08:14:28 -07:00

Owner

Problem

The NixOS module can run the gateway automatically, but currently opts into bare mode. The packaged embedded OCI gateway path mounts /var/lib/auto_review as tmpfs, so review history, learnings, vector cache, and webhook dedup state are not truly persistent across restarts.

Desired Outcome

NixOS deployments can use embedded OCI isolation while keeping gateway SQLite state persistent.

Scope

Add NixOS/module support for persistent state with embedded OCI.
Ensure host state is available inside the embedded OCI gateway at /var/lib/auto_review.
Preserve fail-closed OCI behavior unless the operator explicitly opts into bare mode.
Keep secrets out of the Nix store.
Add module/packaging contract tests for persistent OCI state behavior.
Update deployment docs to show the NixOS embedded-OCI path.

Notes

The current embedded OCI bundle uses tmpfs for /var/lib/auto_review, which is appropriate for isolated ephemeral operation but not for a managed NixOS service with durable review history/learnings.

## Problem The NixOS module can run the gateway automatically, but currently opts into bare mode. The packaged embedded OCI gateway path mounts `/var/lib/auto_review` as tmpfs, so review history, learnings, vector cache, and webhook dedup state are not truly persistent across restarts. ## Desired Outcome NixOS deployments can use embedded OCI isolation while keeping gateway SQLite state persistent. ## Scope - Add NixOS/module support for persistent state with embedded OCI. - Ensure host state is available inside the embedded OCI gateway at `/var/lib/auto_review`. - Preserve fail-closed OCI behavior unless the operator explicitly opts into bare mode. - Keep secrets out of the Nix store. - Add module/packaging contract tests for persistent OCI state behavior. - Update deployment docs to show the NixOS embedded-OCI path. ## Notes The current embedded OCI bundle uses tmpfs for `/var/lib/auto_review`, which is appropriate for isolated ephemeral operation but not for a managed NixOS service with durable review history/learnings.

jwilger added this to the 1.1 milestone

2026-05-19 08:14:35 -07:00

jwilger referenced this issue

2026-05-19 08:53:59 -07:00

fix(nixos): harden gateway module for production #271

jwilger referenced this issue from a commit

2026-05-19 11:28:41 -07:00

fix(nixos): harden gateway module for production (#271)

jwilger added the

bug

label

2026-05-19 14:10:01 -07:00