* docs(rocketchat): add a local verification recipe
Closes verify issue #5152 — no bug found. Adds the missing local
quick-start (Docker stack, PAT generation, real verify + tool output,
teardown) and documents two real gotchas hit live: the required
--platform linux/amd64 + mongo:7.0 pairing, and global 2FA blocking
PAT generation unless disabled and the container restarted.
* docs(rocketchat): pin the image version per Greptile
rocket.chat:latest is a moving target whose bootstrap vars and 2FA
defaults this recipe depends on; pinned to 8.5.1, the version the
recipe was actually verified against. Re-ran the full recipe
(including the 2FA workaround) against the pinned tag to confirm it
still reproduces. Also notes RocketChatSendMessageTool is an internal
class shown for illustration, not a public API.
* docs(rocketchat): fix real issues raised by muddlebee
- Bind the Rocket.Chat port to loopback (127.0.0.1:3201:3000); the
disposable admin account was otherwise reachable on every host
interface.
- Replace the fixed 'sleep 8' before rs.initiate() with a real
mongosh ping readiness loop -- 8s isn't reliable under amd64
emulation on Apple Silicon and could race Mongo startup.
- Replace the direct RocketChatSendMessageTool() instantiation with
'opensre watchdog --provider rocketchat', the actual supported
delivery path. Verified live: a real alarm message landed in
#general within seconds, going through real threshold detection,
cooldown, and provider routing instead of bypassing the tool
approval flow for a mutating side effect.
* docs(rocketchat): proactively bound both readiness waits per the same Greptile pattern
The mongo readiness loop had no retry bound, and the Rocket.Chat
service readiness was prose only ('Wait for curl ... to return 200')
with no actual command -- the same defects Greptile found on the
temporal, opensearch, and mysql PRs. Added real bounded loops (30 and
40 retries respectively) with clear failure messages. Verified live
end to end.
* docs(rocketchat): fix off-by-one loops and reduce credential exposure per muddlebee
Restructured both readiness loops so the retry-exhaustion check only
fires on genuine failure, never after a successful exit.
Login and PAT generation now pipe the password/token payload via
stdin (printf | curl --data-binary @-) instead of embedding them in
curl's own -d argument, keeping them out of process-inspection
visibility; the auth token and PAT are captured into variables and
unset after use instead of being printed raw to the terminal.
Tried muddlebee's suggested alternative to the raw MongoDB 2FA
write -- disabling it through Rocket.Chat's own settings REST API
first -- and confirmed live that it also requires TOTP (the block
applies uniformly to sensitive admin actions, not just PAT creation),
so there's no way to lift it through the API alone. The direct
database write remains the only working fix for a disposable local
instance; strengthened the warning to say so explicitly and point to
the admin UI as the real-workspace alternative.
Verified the complete flow live end to end, including confirming a
real watchdog alarm still delivers through the credential-safe path.
* docs(rocketchat): note why watchdog, not investigate, demonstrates the tool
A reviewer asked whether watchdog vs investigate was intentional here
given every other recipe in this batch uses investigate. It is:
Rocket.Chat's one registered tool is a delivery action, not a
read/investigation tool, so there's nothing for investigate to read;
watchdog is the deterministic path that actually triggers delivery
without needing interactive approval mid-run.
* docs(rocketchat): disable 2FA via boot-time OVERWRITE_SETTING per muddlebee
Replaced the raw MongoDB settings mutation + container restart +
double-login dance with OVERWRITE_SETTING_Accounts_TwoFactorAuthentication_Enabled=false,
Rocket.Chat's own supported boot-time settings-override mechanism
(same pattern already used for Show_Setup_Wizard). Verified live:
login and PAT generation now succeed on the first attempt, and a real
watchdog alarm still delivers correctly through the simplified flow.
No database write needed at all.
* docs(rocketchat): clean up local demo
- remove implementation history from the setup guidance\n- redact the sample hostname\n- unset demo credentials during teardown
---------
Co-authored-by: muddlebee <anweshknayak@gmail.com>
ap9
ecd3cc6e2c