From 4f7d4dabcc922097f02d4e866130e7b8ff93c171 Mon Sep 17 00:00:00 2001 From: Luxit Date: Fri, 25 Sep 2026 13:52:47 +0200 Subject: [PATCH] Sync the self-hosting stack --- CHANGELOG.md | 78 +++++++++++++++++++++++++++++++++++++++ README.md | 56 ++++++++++++++++++++-------- kubernetes/02-config.yaml | 8 +++- 3 files changed, 125 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 57d82d2..d2e3722 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,84 @@ one of them changed. An entry says which artefact and which version, so `web 0.1 Every version published to a channel appears here. Nothing is written from memory afterwards: a build cannot be published without its entry. +## 2026-09-25 — A licensed instance can choose the managed model while it is being installed `api 0.113.0` `web 0.138.0` + +**The install screen now asks for the licence before the model, and offers the managed model +there.** The model step used to come first and knew only your own provider. The managed model can +only be offered to an instance your Jarvis provider has linked to its licence, that link is made by +the instance's licence report, and an instance being installed sent none — so a licensed customer +had to type a key for a provider they did not want, or skip the model and choose the managed one +afterwards under **Settings → Platform → Model**. + +**Adding a paid or trial key on the install screen now sends the licence report straight away**, +rather than once the install is finished — and so does opening the licence step with a key the +instance already holds from `JARVIS_LICENSE_KEY`. That is a new moment of sending, so here is +exactly what it is: the same report with the same fields as every other — the licence id, this +instance's id and public key, its version, contract checksum, counts and public address, the +timestamps and the signature; no names and no conversation content. The +[README](README.md#licence-keys-and-what-your-instance-reports) lists every field. It goes early +because it is what links the instance to its licence. The licence step says so beside the key field, +and shows how the report went — linked, refused by your provider and why, or not sent and why — with +**Report now** to try again. + +**Nothing else reports earlier than before.** Only the licence step sends a report while the +instance is being installed; nothing reports on its own until the install is finished, even when +the key and the address both come from the environment. An instance without a licence still sends +nothing until then, and the licence step sends nothing for a licensed one whose address is not set +yet, is `localhost` or another loopback address, or is an example address such as +`jarvis.example.com`. + +**The model step is now the same choice as the settings screen**: your own provider, with the test +button and "Skip for now" as before, or the managed model, with the same statement of what it sends +and the same box to tick before it is selected. Choosing the managed model there is enough to +continue, so a licensed install can be finished without a model key of your own. Without a licence, +the managed option is shown as unavailable, with the reason and a way back to the licence step. +Reaching the model step on a licensed instance asks your provider whether the managed model is +offered, exactly as opening **Settings → Platform → Model** does: a signed request with no +conversation content. + +**Also in this release.** + +- "Report now", under the managed model's option in the model settings, now says what your provider + answered when a report did not link the instance — a licence it does not know, one already in use + on as many instances as it allows, one it has withdrawn — where it used to say nothing and leave + the option unavailable. +- When your provider refused to link the instance for a reason another report cannot change — the + licence is already in use on as many instances as it allows, or your provider does not know it — + the managed option now says that, on the settings screen and on the install screen, instead of + "available after this instance's next report". The licence step keeps saying it when you come back + to it. +- "Your own provider" is marked **In use** only once an endpoint's model and key are saved. A new + instance used to show it over an empty form. +- An install that has been started can be resumed from a browser that is not signed in: the install + screen asks you to sign in, and the sign-in page now opens instead of sending you back. +- The Kubernetes `02-config.yaml` no longer sets `WEB_ORIGIN` to the placeholder + `https://jarvis.example.com`; it is commented out. Applied unedited, it was stored as the + instance's address until the install screen replaced it. + +**Self-hosters:** api and console. The schema gains one column, the licence server's answer to the +last report, applied automatically when the api starts; it only adds, so the schema guard has +nothing to refuse. No new environment variable. An instance that is already installed reports +exactly as before. On Kubernetes, nothing to do either: the install screen saved your real address +over the placeholder when you installed. + +**Rolling back past this version** drops that column, which the schema guard refuses once a report +has filled it, and the api does not start. To go back anyway, set `SCHEMA_ACCEPT_DATA_LOSS=true` +for that one deploy — in `.env` on compose, on the `jarvis-migrate` Job on Kubernetes — then put +it back. What is lost is only that last answer, which the next report writes again. + +## 2026-09-25 — The model is chosen in one place, and the form you are not using is out of the way `web 0.137.1` + +Under **Settings → Platform → Model**, the choice between your own provider and the managed model is +now made with the selector and nothing else. The separate "Use your own provider" button is gone: +picking that option in the selector does the same thing, and still asks first when your own provider +is not configured, because switching would then leave the assistant with no model. + +Your own provider's form now appears only while the selector is on it. While the managed model is in +use — or has been picked and is waiting for you to confirm — the form is hidden rather than shown with +a note saying it is not in use. Its settings, key included, are kept exactly as they were, and come +back with the form when you switch back. + ## 2026-09-24 — A licensed instance can choose a managed model, and this is exactly what it sends `api 0.112.0` `web 0.137.0` **No conversation content leaves unless somebody chooses it.** The assistant keeps using your own diff --git a/README.md b/README.md index 24c7ab5..dcfa9c9 100644 --- a/README.md +++ b/README.md @@ -195,8 +195,9 @@ to how the containers are scheduled. - A hostname and a TLS terminator in front of it. Jarvis speaks plain HTTP and does not manage certificates. - An API key for an OpenAI-compatible endpoint — or a paid or trial licence that includes the - [managed model](#if-you-choose-the-managed-model), which you choose after installing. The install - screen asks for the key and tests it before saving; you do not need it in hand before you start. + [managed model](#if-you-choose-the-managed-model), which the install screen offers once the licence + is in. The install screen asks for either, and tests a key before saving it; you do not need + either in hand before you start. - **No licence key.** Jarvis runs the [community edition](#the-community-edition) out of the box; a key raises the limits when you outgrow them. - Roughly 2 GB of RAM for the stack and room for Postgres to grow. @@ -212,13 +213,23 @@ That is the whole first deployment. **There is no `.env` step.** First boot gene secrets, syncs the database schema and runs its data backfills before the API listens, so give it about a minute. Then point your reverse proxy at port 8080 and open the address in a browser. -An install screen takes it from there. It welcomes you, creates the first administrator inside a -bounded window, then asks for the address this instance answers on and who may create an account on -it, the model, your first organization, and — every one of them skippable — mail, a licence and -whether this instance reports anything about itself. It finishes by showing you what the deployment -actually looks like from inside, and by making you take a backup of the one value nothing can -reconstruct. Ten screens, about five minutes, and **only the address really needs you**: everything -else has a "later" that costs nothing. +An install screen takes it from there. It welcomes you, creates the first administrator, then asks +for the address this instance answers on and who may create an account on it, a licence, the model, +your first organization and mail — the licence, the model and mail all skippable. It finishes by +showing you what the deployment actually looks like from inside, and by making you take a backup of +the one value nothing can reconstruct. Nine steps, about five minutes, and **only the address really +needs you**: everything else has a "later" that costs nothing. + +**The licence comes before the model, and with a paid or trial key it sends something.** Adding the +key on the install screen's licence step makes this instance send its licence report to your Jarvis +provider straight away, rather than once the install is finished — and so does opening that step +with a key the instance already holds from `JARVIS_LICENSE_KEY`. That report is what links the +instance to its licence, and the [managed model](#if-you-choose-the-managed-model) is only offered +to a linked instance. So the model step can offer it beside your own endpoint, with the same +statement of what it sends as the settings screen, and a licensed install can be finished without a +model key of your own. What the report carries is +[listed field by field below](#licence-keys-and-what-your-instance-reports). Without a key, nothing +leaves until the install is finished. Everything it asks is a setting you can change afterwards from an ordinary screen. Nothing it asks needs a container restart to change. @@ -735,6 +746,18 @@ key; a community one to `checkin.luxit.be`, compiled into the build. The interva to set — every ten minutes on the current arrangement, so that a renewal or a revocation reaches you promptly rather than tomorrow. +**An instance that is still being installed reports nothing — until a licence is adopted and its +address is set, and then only from the install screen's licence step.** A community instance sends +its first report once the install screen is finished. A licensed one sends it from the licence +step, which comes after the step that sets the address: the moment the key is added there, or, for +a key that came from `JARVIS_LICENSE_KEY`, when that step opens. Nothing reports on its own before +the install is finished, so a stack that brings both its key and its address in the environment +still sends nothing until somebody reaches that step. That early report is the same report, with the +same fields — it goes early because it is what links the instance to its licence, which the managed +model needs. An address that is still `localhost` or another loopback address does not count as +set, and neither does an example one such as `jarvis.example.com`: that instance sends nothing from +the licence step. + This is everything the licence report and a licence request send, in full. The managed model, if you choose it, sends conversation content — see [If you choose the managed model](#if-you-choose-the-managed-model). @@ -784,9 +807,11 @@ checked without a network. **Off unless a platform administrator turns it on, and only on a paid or trial licence.** Your Jarvis provider can run a model for licensed instances, so that the assistant works without an endpoint or a key of your own. A platform administrator chooses it under **Settings → Platform → -Model**, on a screen that states everything below and asks them to confirm they have read it. -Nothing else selects it: no environment variable, no licence, no answer from the licence server. A -community instance cannot use it; its assistant runs on your own provider, as it always has. +Model**, or on the model step of the install screen, which shows the same choice once the licence +step before it has linked the instance to its licence. Either way it is chosen on a screen that +states everything below and asks them to confirm they have read it. Nothing else selects it: no +environment variable, no licence, no answer from the licence server. A community instance cannot use +it; its assistant runs on your own provider, as it always has. **While it is chosen, conversation content goes to your Jarvis provider instead of the endpoint you configured.** Every request the assistant then makes to the model carries: @@ -805,9 +830,10 @@ exactly as its licence report is, which carries the product (`jarvis`), the lice id and public key, and the version — nothing else — and it keeps the credential in memory only. **Opening the screen already asks.** On a licensed instance, opening **Settings → Platform → Model** -sends that signed request, so the screen can say whether the managed model is offered to you and -which model it is — whether or not anybody then chooses it. It carries the fields above and no -conversation content, and your Jarvis provider sees that this instance asked. +— or reaching the model step of the install screen — sends that signed request, so the screen can +say whether the managed model is offered to you and which model it is, whether or not anybody then +chooses it. It carries the fields above and no conversation content, and your Jarvis provider sees +that this instance asked. **Where it goes.** Over HTTPS to the host your licence reports to — the address written into your licence key, `checkin.luxit.be` on current licences, which is where its licence report goes too. The diff --git a/kubernetes/02-config.yaml b/kubernetes/02-config.yaml index 842495e..dec2be4 100644 --- a/kubernetes/02-config.yaml +++ b/kubernetes/02-config.yaml @@ -45,8 +45,12 @@ data: TRUST_PROXY_HOPS: "1" # The seed for the address enrolled agents dial back to. Whatever the install screen stores wins - # from then on, so this is a starting value rather than the answer. - WEB_ORIGIN: "https://jarvis.example.com" + # from then on, so this is a starting value rather than the answer — and it is COMMENTED OUT + # because a placeholder is a worse start than none. Seeded as it stood, `jarvis.example.com` was + # stored as this instance's address before anybody had opened the install screen, which asks for + # the address anyway, prefilled with the one your browser used. Uncomment it only with your real + # address. + # WEB_ORIGIN: "https://jarvis.example.com" # Where the agent binaries are, filled per pod by an initContainer. Leaving it unset is # supported: everything works except the agent installer, which answers 503 saying no build is