Feature/ai code reviewer

docker-compose.nas.yml

@@ -80,6 +80,11 @@ services:
       timeout: 10s
       retries: 3
       start_period: 20s
+    deploy:
+      resources:
+        limits:
+          memory: 2G
+          cpus: "2.0"
 
   # ── SSH Git server ─────────────────────────────────────────
   ssh-git:
@@ -90,6 +95,11 @@ services:
       PROCESS_TYPE: ssh
     ports:
       - "${SSH_PORT:-2222}:2222"
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+          cpus: "1.0"
 
   # ── Background worker ──────────────────────────────────────
   worker:
@@ -107,6 +117,11 @@ services:
       timeout: 10s
       retries: 3
       start_period: 20s
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+          cpus: "1.0"
 
   # ── PostgreSQL ─────────────────────────────────────────────
   postgres:
@@ -126,6 +141,11 @@ services:
       interval: 10s
       timeout: 5s
       retries: 5
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+          cpus: "1.0"
 
   # ── Redis ──────────────────────────────────────────────────
   redis:
@@ -151,6 +171,11 @@ services:
       interval: 10s
       timeout: 5s
       retries: 5
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+          cpus: "0.5"
 
   # ── Cloudflare Tunnel (optional) ───────────────────────────
   cloudflared:

docker-compose.production.yml

@@ -57,7 +57,7 @@ services:
       - DATABASE_SSL=false
       - REDIS_URL=redis://:${REDIS_PASSWORD:?Set REDIS_PASSWORD in .env}@redis:6379
       - JWT_SECRET=${JWT_SECRET:?Set JWT_SECRET in .env}
-      - SESSION_SECRET=${SESSION_SECRET:-${JWT_SECRET}}
+      - SESSION_SECRET=${SESSION_SECRET:?Set SESSION_SECRET in .env (must differ from JWT_SECRET)}
       - INTERNAL_HOOK_SECRET=${INTERNAL_HOOK_SECRET:?Set INTERNAL_HOOK_SECRET in .env}
       - CRON_SECRET=${CRON_SECRET:?Set CRON_SECRET in .env}
       - AI_CONFIG_ENCRYPTION_KEY=${AI_CONFIG_ENCRYPTION_KEY:?Set AI_CONFIG_ENCRYPTION_KEY in .env}

docker-compose.yml

@@ -68,13 +68,19 @@ services:
       redis:
         condition: service_healthy
     networks:
-      - och
+      - opencodehub-internal
+      - opencodehub-external
     healthcheck:
       test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:4321/api/health"]
       interval: 30s
       timeout: 10s
       retries: 3
       start_period: 20s
+    deploy:
+      resources:
+        limits:
+          memory: 2G
+          cpus: "2.0"
 
   # ── SSH Git server ─────────────────────────────────────────
   ssh-git:
@@ -108,7 +114,19 @@ services:
       redis:
         condition: service_healthy
     networks:
-      - och
+      - opencodehub-internal
+      - opencodehub-external
+    healthcheck:
+      test: ["CMD-SHELL", "nc -z localhost 2222 || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+          cpus: "1.0"
 
   # ── Background worker (merge queue, webhooks, mirrors, digests) ──
   worker:
@@ -143,13 +161,18 @@ services:
       redis:
         condition: service_healthy
     networks:
-      - och
+      - opencodehub-internal
     healthcheck:
       test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9090/healthz"]
       interval: 30s
       timeout: 10s
       retries: 3
       start_period: 20s
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+          cpus: "1.0"
 
   # ── PostgreSQL ─────────────────────────────────────────────
   postgres:
@@ -163,12 +186,17 @@ services:
     volumes:
       - postgres-data:/var/lib/postgresql/data
     networks:
-      - och
+      - opencodehub-internal
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-opencodehub} -d ${POSTGRES_DB:-opencodehub}"]
       interval: 10s
       timeout: 5s
       retries: 5
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+          cpus: "1.0"
 
   # ── Redis (sessions, caching, distributed locking, queues) ──
   redis:
@@ -188,12 +216,17 @@ services:
     volumes:
       - redis-data:/data
     networks:
-      - och
+      - opencodehub-internal
     healthcheck:
       test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
       interval: 10s
       timeout: 5s
       retries: 5
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+          cpus: "0.5"
 
   # ── CI/CD Runner (Docker-in-Docker, optional) ──────────────
   runner:
@@ -216,7 +249,18 @@ services:
     depends_on:
       - app
     networks:
-      - och
+      - opencodehub-external
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9090/healthz"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+    deploy:
+      resources:
+        limits:
+          memory: 2G
+          cpus: "2.0"
     profiles:
       - with-runner
 
@@ -234,7 +278,7 @@ services:
     volumes:
       - minio-data:/data
     networks:
-      - och
+      - opencodehub-external
     healthcheck:
       test: ["CMD", "mc", "ready", "local"]
       interval: 30s
@@ -264,5 +308,7 @@ volumes:
     driver: local
 
 networks:
-  och:
+  opencodehub-internal:
+    driver: bridge
+  opencodehub-external:
     driver: bridge

scripts/worker.ts

@@ -250,9 +250,11 @@ function setupGracefulShutdown(healthServer: ReturnType<typeof createServer>) {
   process.on("SIGTERM", () => shutdown("SIGTERM"));
   process.on("uncaughtException", (err) => {
     logger.error({ err }, "Uncaught exception in worker");
+    process.exit(1);
   });
   process.on("unhandledRejection", (reason) => {
     logger.error({ reason }, "Unhandled rejection in worker");
+    process.exit(1);
   });
 }
 

src/db/index.ts

@@ -30,6 +30,7 @@ let db:
   | LibSQLDatabase<typeof schema>
   | NodePgDatabase<typeof schema>
   | null = null;
+let pgPool: pg.Pool | null = null;
 
 /**
  * Infer database driver from connection URL when no explicit driver is set.
@@ -113,6 +114,10 @@ export function getDatabase():
       ssl: sslEnabled ? { rejectUnauthorized } : undefined,
       max: parseInt(process.env.DATABASE_POOL_SIZE || "10", 10),
     });
+    pool.on('error', (err) => {
+      logger.error({ err }, 'Unexpected database pool error');
+    });
+    pgPool = pool;
     db = drizzlePg(pool, { schema });
     logger.info(
       {
@@ -179,9 +184,11 @@ export async function closeDatabase(): Promise<void> {
       // @ts-ignore
       db.close();
     }
-    // For PG pool, we might need to close the pool if we had access to it,
-    // but Drizzle doesn't expose it directly on the db instance easily without type casting.
-    // In serverless/long-running app, closing might not be strictly necessary unless ensuring graceful shutdown.
+    // Close PostgreSQL pool if available
+    if (pgPool) {
+      await pgPool.end();
+      pgPool = null;
+    }
 
     logger.info("Database connection closed");
     db = null;

src/db/schema/ai-reviews.ts

@@ -5,6 +5,7 @@
 
 import { relations } from "drizzle-orm";
 import { boolean, integer, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { index } from "drizzle-orm/pg-core";
 import { pullRequests } from "./pull-requests";
 import { users } from "./users";
 
@@ -48,7 +49,9 @@ export const aiReviews = pgTable("ai_reviews", {
 
     // Error
     errorMessage: text("error_message"),
-});
+}, (table) => [
+    index("ai_reviews_pull_request_id_idx").on(table.pullRequestId),
+]);
 
 // AI Review Suggestions - individual findings
 export const aiReviewSuggestions = pgTable("ai_review_suggestions", {

src/db/schema/automations.ts

@@ -5,6 +5,7 @@
 
 import { relations } from "drizzle-orm";
 import { boolean, integer, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { index } from "drizzle-orm/pg-core";
 import { repositories } from "./repositories";
 import { users } from "./users";
 
@@ -31,7 +32,9 @@ export const automationRules = pgTable("automation_rules", {
     lastRunAt: timestamp("last_run_at"),
     createdAt: timestamp("created_at").notNull().defaultNow(),
     updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});
+}, (table) => [
+    index("automation_rules_repository_id_idx").on(table.repositoryId),
+]);
 
 /**
  * Trigger types:

src/db/schema/branch-protection.ts

@@ -5,6 +5,7 @@
 
 import { relations } from "drizzle-orm";
 import { boolean, integer, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { index } from "drizzle-orm/pg-core";
 import { repositories } from "./repositories";
 import { users } from "./users";
 
@@ -29,7 +30,9 @@ export const branchProtection = pgTable("branch_protection", {
     createdAt: timestamp("created_at").notNull().defaultNow(),
     updatedAt: timestamp("updated_at").notNull().defaultNow(),
     createdById: text("created_by_id").references(() => users.id),
-});
+}, (table) => [
+    index("branch_protection_repository_id_idx").on(table.repositoryId),
+]);
 
 export const branchProtectionRelations = relations(branchProtection, ({ one }) => ({
     repository: one(repositories, {

src/db/schema/deploy-keys.ts

@@ -5,6 +5,7 @@
 
 import { relations } from "drizzle-orm";
 import { boolean, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { index } from "drizzle-orm/pg-core";
 import { repositories } from "./repositories";
 
 export const deployKeys = pgTable("deploy_keys", {
@@ -18,7 +19,9 @@ export const deployKeys = pgTable("deploy_keys", {
     readOnly: boolean("read_only").default(true).notNull(),
     createdAt: timestamp("created_at").notNull().defaultNow(),
     lastUsedAt: timestamp("last_used_at"),
-});
+}, (table) => [
+    index("deploy_keys_repository_id_idx").on(table.repositoryId),
+]);
 
 export const deployKeysRelations = relations(
     deployKeys,

src/db/schema/merge-queue.ts

@@ -1,5 +1,5 @@
 import { relations } from "drizzle-orm";
-import { boolean, integer, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { boolean, index, integer, pgTable, text, timestamp } from "drizzle-orm/pg-core";
 import { pullRequests } from "./pull-requests";
 import { repositories } from "./repositories";
 import { users } from "./users";
@@ -38,7 +38,13 @@ export const mergeQueue = pgTable("merge_queue", {
     startedAt: timestamp("started_at"),
     completedAt: timestamp("completed_at"),
     failureReason: text("failure_reason"),
-});
+  },
+  (t) => ({
+    repoIdx: index("merge_queue_repo_idx").on(t.repositoryId),
+    statusIdx: index("merge_queue_status_idx").on(t.status),
+    prIdx: index("merge_queue_pr_idx").on(t.pullRequestId),
+  }),
+);
 
 // Alias for backwards compatibility
 export const mergeQueueItems = mergeQueue;

src/db/schema/pull-requests.ts

@@ -196,7 +196,9 @@ export const pullRequestReviewers = pgTable("pull_request_reviewers", {
     .references(() => users.id, { onDelete: "cascade" }),
   isRequired: boolean("is_required").default(false),
   requestedAt: timestamp("requested_at").notNull().defaultNow(),
-});
+}, (t) => ({
+  prIdx: index("pr_reviewers_pr_idx").on(t.pullRequestId),
+}));
 
 export const pullRequestChecks = pgTable(
   "pull_request_checks",

src/db/schema/stacked-prs.ts

@@ -4,7 +4,7 @@
  */
 
 import { relations } from "drizzle-orm";
-import { integer, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { index, integer, pgTable, text, timestamp } from "drizzle-orm/pg-core";
 import { pullRequests } from "./pull-requests";
 import { repositories } from "./repositories";
 import { users } from "./users";
@@ -23,7 +23,11 @@ export const prStacks = pgTable("pr_stacks", {
         .references(() => users.id),
     createdAt: timestamp("created_at").notNull().defaultNow(),
     updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});
+  },
+  (t) => ({
+    repoIdx: index("pr_stacks_repo_idx").on(t.repositoryId),
+  }),
+);
 
 // Stack entries - individual PRs in a stack with ordering
 export const prStackEntries = pgTable("pr_stack_entries", {
@@ -37,7 +41,13 @@ export const prStackEntries = pgTable("pr_stack_entries", {
     stackOrder: integer("stack_order").notNull(), // Position in stack (1 = base)
     parentPrId: text("parent_pr_id").references(() => pullRequests.id),
     createdAt: timestamp("created_at").notNull().defaultNow(),
-});
+  },
+  (t) => ({
+    stackIdx: index("pr_stack_entries_stack_idx").on(t.stackId),
+    prIdx: index("pr_stack_entries_pr_idx").on(t.pullRequestId),
+    parentPrIdx: index("pr_stack_entries_parent_pr_idx").on(t.parentPrId),
+  }),
+);
 
 // Relations
 export const prStacksRelations = relations(prStacks, ({ one, many }) => ({