[BUG] Dev Experience forces token flow

[jamietdavidson]

Describe the issue
I am trying to setup Hatchet without having to install a binary on my machine locally. I have to scale this across a ton of employees and don't want to deal with the headache of getting binaries working on everyones machine. In order to work around this I am using Docker.

In order to setup Hatchet at all requires a token flow - which is proving to be a huge pain in the ass when I want to use docker-compose. Can you guys make this simpler for local development?

[grutt]

Hi @jamietdavidson, thanks for your feedback here. We are simplifying local dev and recently shipped a cli which is the first step of improving this local story dramatically... more to come soon

[jamietdavidson]

@grutt thank you for replying. My main issue is that I do not want to install any external dependencies, CLIs, or anything else. I just simply want to use docker. Can you guys provide a self contained docker container for local dev? I want to be able to restart the container (or wipe it and restart), and not have to have every other container that interacts with it to need the latest hatchet token.

[jamietdavidson]

Or alternatively, an ENV variable for hatchet-lite called DISABLE_AUTHENTICATION=true

[indrif]

It would be nice to be able to auto seed a hard coded token or something for dev environment in docker. I've had the same experience when running locally. It's possible and not hard to run a script that creates a token but still needs some setup ofc and having a hardcoded value would definitely be easier.

Basically this is what we do:

# replace pbcopy with something else depending on your needs
docker compose -f .docker/compose/docker-compose.yml exec hatchet-lite /hatchet-admin token create --config /config --tenant-id 707d0855-80ab-4e1f-a156-f1c4546cbf52 | xargs | pbcopy 

[StefanBRas]

I somewhat similarly had issues, where the python sdk requires the hatchet token to be present on client instantiation.

Just for context here is a discussion I had on the discord.

Couldn't find a nice way to copy a whole thread but below is my opening message, then you can determine if it sounds exciting enough for you to go read the rest:

Hi! I'm testing out Hatchet, for now using the python SDK.
The docs recommends to instantiate a shared Hatchet client (https://docs.hatchet.run/home/setup) - This is causing me problems as it requires a a valid JWT to import the client (or anything from any module importing it) and will error at import time if it's not present. I wanted to hear the rationale for this.
It's seems counter intuitive to me that I need the JWT present for for example defining a workflow, which doesn't actually used the client until I start a worker or call it.
Even when I need the client to connect it complicates things - I want to start a worker, but I need the token before starting it. In my current setup it fetches a token, but it's pretty cumbersome because I have to make sure I don't accidently import anything that will trigger an import of the client because I have fetched the token.

It would feel more natural to me that you instantiate the client when you need it - either when starting the worker, or in some lifecycle if you use it to call workflows - and not doing it at import time.

Thanks!

[princed]

I have exactly the same requirements as @jamietdavidson, so thanks to the excellent pointer by @indrif, the following is what I was able to come up with.

Then the env var is read from .env.local by the worker code.

  # ...
  hatchet-lite:
    image: 'ghcr.io/hatchet-dev/hatchet/hatchet-lite:latest'
    ports:
      - '8888:8888'
      - '7077:7077'
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      DATABASE_URL: 'postgresql://hatchet:hatchet@db:5432/hatchet?sslmode=disable'
      # ...
    volumes:
      - 'hatchet_lite_config:/config'
    healthcheck:
      test: ['CMD-SHELL', 'curl -fs http://localhost:8733/ready']
      interval: 5s
      timeout: 5s
      retries: 20
      # Offset to account for Postgres initialisation
      start_period: 20s

  hatchet-token:
    image: 'ghcr.io/hatchet-dev/hatchet/hatchet-lite:latest'
    depends_on:
      hatchet-lite:
        condition: service_healthy
    environment:
      DATABASE_URL: 'postgresql://hatchet:hatchet@db:5432/hatchet?sslmode=disable'
    entrypoint: /bin/sh
    command:
      - -c
      - |
        set -e
        TOKEN=$$(/hatchet-admin token create --config /config --tenant-id 707d0855-80ab-4e1f-a156-f1c4546cbf52 --expiresIn 8760h)
        if [ -z "$$TOKEN" ]; then
          echo "Failed to create Hatchet token" >&2
          exit 1
        fi
        FILE=/workspace/.env.local
        KEY=HATCHET_CLIENT_TOKEN
        touch "$$FILE"
        if grep -q "^$${KEY}=" "$$FILE"; then
          sed -i "s|^$${KEY}=.*|$${KEY}=$$TOKEN|" "$$FILE"
        else
          echo "$${KEY}=$$TOKEN" >> "$$FILE"
        fi
        echo "Updated $$FILE with $${KEY}"
    volumes:
      - 'hatchet_lite_config:/config'
      - '.:/workspace'