Skip to content

WeCom Operations Bot

Overview

Always-on WorkBuddy/CodeBuddy WeCom operations bot, deployed on a dedicated EC2 instance outside EKS so it stays available when cluster workloads are unhealthy.

Status: Live · Repo: ovesorg/workbuddy-wecom-bot

Why a separate repo

This is deployable runtime code (Terraform infra, systemd daemon, health timer, CI/CD) - not documentation. agentic-program documents the program; the code lives in its own repo with its own deploy cadence.

Architecture

  • Ubuntu 24.04 on t3.medium EC2, no inbound rules - managed via AWS SSM.
  • Encrypted EBS holds login state, WeCom credentials, skills, conversations.
  • CodeBuddy runs as a user-level systemd daemon with Linux linger enabled.
  • Health timer checks daemon + WeCom channel every minute; 3 failures -> restart.
  • Elastic IP for stable outbound address (EKS allowlisting); nothing listens publicly.

Responsibilities

  • Answers WeCom requests with the OVES dev-cluster diagnostic workflow.
  • Loads the project-level oves-dev-operations skill (read-only, excludes prod).
  • Loads team skills from the CodeBuddy marketplace / plugins.

Deploy

Terraform (infra/) with S3 remote state (native locking). GitHub Actions: ci.yml (validate) and manual deploy.yml (OIDC -> dev environment).

Security

  • EKS access is view-only initially; no secrets in Terraform or Git.
  • Daemon binds 127.0.0.1:8080; no public ingress / load balancer / tunnel.
  • Bot runs in default permission mode; do not switch to bypass without review.