infra_wiki

Sign Rowbutt in to ChatGPT

Sign mate in to the owner's ChatGPT subscription from chat, check the sign-in, and sign it out.

This runbook signs Rowbutt in to the owner's ChatGPT subscription with OpenAI's device code. mate, the process behind Rowbutt, keeps the token in the mate_credentials table of mate-db, the session store. While MATE_MODEL is a ChatGPT model, it refreshes a token with fewer than two days left at boot and every six hours. Turns use ChatGPT first, and MATE_FALLBACK_MODEL when ChatGPT cannot answer. Use this runbook to sign in, when MateChatGPTSignedOut or MateChatGPTTokenNotRefreshing fires, or to cut mate off. Operate the Rowbutt model fallback pauses ChatGPT and handles MateModelPrimaryFailing.

warning

This runbook changes live state by hand. It is an exception to the GitOps rule because OpenAI issues the token to mate, and git cannot hold it. The sandbox is cluster-admin, so the agent can read the token in mate-db and use the owner's ChatGPT account. The owner accepts this. The kill switch is Sign out.

Before you start#

  • Be the user in MATE_ALLOWED_USER_IDS on Discord, or in MATE_SLACK_ALLOWED_USER_IDS on Slack.
  • Mention Rowbutt with each command. After a restart, mate ignores a reply without the mention in a thread that holds only commands.
  • On Discord, allow direct messages from members of the homelab server.
  • Sign in to your own ChatGPT account in a browser.
  • For the log check, get kubectl access to offsite (Get cluster admin access).

Sign in#

  1. In an allowed channel or a Rowbutt thread, mention Rowbutt with chatgpt login.

    Result: mate says in the thread that it sent you a code, which works for 15 minutes.

  2. Open the code: a direct message on Discord, or a message only you see at the bottom of the Slack channel.

warning

The first person to enter the code connects their ChatGPT account to mate. Do not put the code in a thread.

  1. Open the link in the message while you are signed in to your own ChatGPT account.

  2. Enter the code.

    Result: mate says ✅ mate is signed in to ChatGPT, with the time of one test request.

  3. If mate says that the test request failed, find its reason in If something goes wrong.

Check the sign-in#

  1. Mention Rowbutt with chatgpt status.

    Result: mate says ℹī¸ ChatGPT: signed in, token good until, with a date, and Now: primary.

  2. Read the ChatGPT lines of the mate log.

    kubectl --context offsite -n mate logs deploy/mate | grep -i chatgpt | tail -5

    Result: The log shows the ChatGPT token is refreshed about every eight days, and no refused line.

Sign out#

  1. Mention Rowbutt with chatgpt logout.

    Result: mate says 🔓 mate signed out of ChatGPT, and deletes the token from mate-db.

caution

Step 2 also signs out every other app and device on the account, and any mate sign-in made before it.

  1. In ChatGPT's security settings, sign out of all sessions.

    Result: OpenAI ends the account's sessions. No test has shown that this also ends an access token mate already holds, which works for up to 10 days.

If something goes wrong#

caution

Do not run a second mate against mate-db, such as a local run with its DATABASE_URL. Two holders of one refresh token can spend it twice, and OpenAI then refuses both.

SymptomCauseAction
Couldn't send you the code by DMDiscord refuses direct messages from the server.Allow them, then say chatgpt login again.
OpenAI refused to start a device sign-in (HTTP 404)Device code sign-in is off for the ChatGPT account.Turn it on in ChatGPT's security settings.
The sign-in code expired unusedNobody entered the code in 15 minutes.Say chatgpt login again.
mate restarted before the sign-in finishedmate stopped while it waited for the code.Say chatgpt login again.
mate can't reach its memory right now after chatgpt loginmate-db is down.Do Operate Postgres.
auth.openai.com could not be reached or chatgpt.com could not be reachedmate's egress policy or DNS blocks the host.Make sure that both hosts are in clusters/offsite/apps/mate/network-policy.yaml on port 443.
The test request failed with HTTP 401 or HTTP 403.The plan does not include Codex, or OpenAI refuses the client.Check the plan in ChatGPT's settings.
MateChatGPTSignedOut fires, or chatgpt status says OpenAI refused the token refresh.The refresh token is revoked or spent.Do Sign in.
chatgpt status says chatgpt.com refused a fresh token too.chatgpt.com refuses the account or mate's client, not only the token.Do Sign in. If its test request fails with HTTP 401 or HTTP 403, check the plan.
MateChatGPTTokenNotRefreshing fires.A day of refreshes, or an hour of rotations since chatgpt.com refused the token, failed on egress, DNS or mate-db.Read the mate log. If MateStoreFailing fires, do Operate Postgres.
After a restore of mate-db, chatgpt status says not signed in.The nightly dump leaves out mate_credentials.Do Sign in.

Edit on GitHub

Linked from 4
  • RowbuttA chat bot, code name mate, that answers the owner in Discord and Slack threads with a coding agent whose tools run in a sandbox on the offsite cluster.
  • How Rowbutt worksHow mate runs Rowbutt's agent loop, leases a sandbox on the offsite cluster for its tools and keeps its sessions, and the credentials and network policy of each part.
  • RunbooksStep-by-step procedures for the hosts, clusters, network, secrets and apps, grouped by area.
  • Operate the Rowbutt model fallbackCheck which model answers Rowbutt, keep turns off ChatGPT for a while or until a change, and drill the fallback.

↑↓ move â†ĩ open esc close