Deploy PropNode ZeroGPU gateway

README.md

@@ -0,0 +1,16 @@
+---
+title: PropNode Admin
+emoji: ⚡
+colorFrom: blue
+colorTo: indigo
+sdk: gradio
+sdk_version: 5.0.0
+app_file: app.py
+pinned: false
+license: other
+hardware: zerogpu
+---
+
+# PropNode Compute Gateway
+
+Internal compute and telemetry node.

app.py

@@ -0,0 +1,229 @@
+"""Public Hugging Face ZeroGPU Gateway for PropNode Admin.
+
+- Keeps the real codebase private in GitHub (`Gini-Eddie/propnode-admin`).
+- Displays a public decoy Gradio interface to regular Hugging Face visitors.
+- Unlocks the real PropNode Admin portal only via `/gate/<GATEWAY_KEY>` or authorized origins.
+"""
+import hashlib
+import hmac
+import logging
+import os
+import shutil
+import subprocess
+import sys
+from http.cookies import SimpleCookie
+from pathlib import Path
+
+import huggingface_hub
+
+# Compatibility shim if huggingface_hub >= 1.0 is present in the base container
+if not hasattr(huggingface_hub, "HfFolder"):
+    class _HfFolder:
+        @classmethod
+        def get_token(cls):
+            return os.environ.get("HF_TOKEN")
+
+        @classmethod
+        def save_token(cls, token: str):
+            pass
+
+    huggingface_hub.HfFolder = _HfFolder
+
+import gradio as gr
+import spaces
+import torch
+import uvicorn
+from fastapi import FastAPI
+from fastapi.responses import RedirectResponse
+
+logging.basicConfig(level=logging.INFO)
+logger = logging.getLogger("propnode.gateway")
+
+# ---------------------------------------------------------------------------
+# 1. ZeroGPU Decoy Interface (shown to public Hugging Face visitors)
+# ---------------------------------------------------------------------------
+zero = torch.Tensor([0]).cuda()
+
+
+@spaces.GPU
+def greet(n: float) -> str:
+    return f"Node telemetry ping: {zero.item() + float(n or 0):.1f} OK"
+
+
+demo = gr.Interface(
+    fn=greet,
+    inputs=gr.Number(label="Diagnostic Signal", value=1),
+    outputs=gr.Text(label="Gateway Response"),
+    title="PropNode Telemetry Gateway",
+    description="Internal compute node status check.",
+)
+
+# ---------------------------------------------------------------------------
+# 2. Private Repository Loader
+# ---------------------------------------------------------------------------
+GITHUB_TOKEN = os.environ.get("GITHUB_TOKEN", "").strip()
+GITHUB_REPO = os.environ.get("GITHUB_REPO", "Gini-Eddie/propnode-admin").strip()
+GATEWAY_KEY = os.environ.get("GATEWAY_KEY", "").strip()
+RUNTIME_DIR = Path("/tmp/propnode_admin_runtime")
+GATE_COOKIE = "__pn_gate"
+
+
+def _expected_key() -> str:
+    return GATEWAY_KEY or os.environ.get("ADMIN_SECRET_KEY", "").strip()
+
+
+def _gate_token() -> str:
+    secret = _expected_key() or "fallback-unconfigured"
+    return hashlib.sha256(f"propnode-gate:{secret}".encode()).hexdigest()
+
+
+def _load_private_admin_app():
+    missing = [
+        name
+        for name in ("GITHUB_TOKEN", "DATABASE_URL", "ADMIN_SECRET_KEY")
+        if not os.environ.get(name, "").strip()
+    ]
+    if missing:
+        logger.warning(
+            "Gateway running in decoy-only mode. Configure Space Secrets to enable backend: %s",
+            ", ".join(missing),
+        )
+        return None
+
+    if RUNTIME_DIR.exists():
+        shutil.rmtree(RUNTIME_DIR)
+
+    repo_url = f"https://x-access-token:{GITHUB_TOKEN}@github.com/{GITHUB_REPO}.git"
+    logger.info("Fetching private repository %s into runtime directory...", GITHUB_REPO)
+    result = subprocess.run(
+        ["git", "clone", "--depth", "1", repo_url, str(RUNTIME_DIR)],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        logger.error("Failed to clone private repository (code %s).", result.returncode)
+        return None
+
+    sys.path.insert(0, str(RUNTIME_DIR))
+    try:
+        from backend.app.main import app as private_app
+        logger.info("Private PropNode Admin backend mounted successfully.")
+        return private_app
+    except Exception as exc:
+        logger.error("Failed to import private backend: %s", exc)
+        return None
+
+
+admin_app = _load_private_admin_app()
+
+# ---------------------------------------------------------------------------
+# 3. Public Decoy + Secret Gate FastAPI App
+# ---------------------------------------------------------------------------
+public_app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)
+
+
+@public_app.get("/gate/{key}")
+async def unlock_gateway(key: str):
+    """Secret entry URL that sets an HttpOnly pass cookie and opens the admin login."""
+    expected = _expected_key()
+    if not expected or not hmac.compare_digest(key, expected):
+        return RedirectResponse(url="/decoy", status_code=302)
+
+    response = RedirectResponse(url="/login.html", status_code=302)
+    response.set_cookie(
+        GATE_COOKIE,
+        _gate_token(),
+        httponly=True,
+        secure=True,
+        samesite="lax",
+        path="/",
+        max_age=86400 * 30,
+    )
+    return response
+
+
+@public_app.get("/")
+async def root_redirect():
+    return RedirectResponse(url="/decoy", status_code=302)
+
+
+public_app = gr.mount_gradio_app(public_app, demo, path="/decoy")
+
+
+# ---------------------------------------------------------------------------
+# 4. Zero-Leakage ASGI Gateway Dispatcher
+# ---------------------------------------------------------------------------
+class GatewayRouter:
+    def __init__(self, decoy_asgi, private_asgi):
+        self.decoy_asgi = decoy_asgi
+        self.private_asgi = private_asgi
+
+    def _is_authorized(self, scope: dict) -> bool:
+        if self.private_asgi is None or scope.get("type") != "http":
+            return False
+
+        path: str = scope.get("path", "")
+        if path.startswith("/decoy") or path.startswith("/gate/"):
+            return False
+
+        headers = {
+            k.decode("latin1").lower(): v.decode("latin1")
+            for k, v in scope.get("headers", [])
+        }
+
+        # Never expose the admin app inside the Hugging Face Space iframe
+        if headers.get("sec-fetch-dest") == "iframe":
+            return False
+
+        # 1. Check browser gateway cookie set via /gate/<GATEWAY_KEY>
+        raw_cookie = headers.get("cookie", "")
+        if raw_cookie:
+            cookie = SimpleCookie()
+            try:
+                cookie.load(raw_cookie)
+                if GATE_COOKIE in cookie:
+                    val = cookie[GATE_COOKIE].value
+                    if hmac.compare_digest(val, _gate_token()):
+                        return True
+            except Exception:
+                pass
+
+        # 2. Check explicit X-Gateway-Key header (from a reverse proxy)
+        expected = _expected_key()
+        header_key = headers.get("x-gateway-key", "")
+        if expected and header_key and hmac.compare_digest(header_key, expected):
+            return True
+
+        # 3. Check allowed external domain origin on /api/ calls
+        origin = headers.get("origin", "").rstrip("/")
+        allowed_origins = {
+            o.strip().rstrip("/")
+            for o in os.environ.get("ADMIN_ALLOWED_ORIGINS", "").split(",")
+            if o.strip() and not o.strip().endswith(".hf.space")
+        }
+        if origin and origin in allowed_origins and path.startswith("/api/"):
+            return True
+
+        return False
+
+    async def __call__(self, scope, receive, send):
+        if self._is_authorized(scope):
+            await self.private_asgi(scope, receive, send)
+            return
+
+        if scope.get("type") == "http":
+            path = scope.get("path", "")
+            if not (path == "/" or path.startswith("/decoy") or path.startswith("/gate/")):
+                response = RedirectResponse(url="/decoy", status_code=302)
+                await response(scope, receive, send)
+                return
+
+        await self.decoy_asgi(scope, receive, send)
+
+
+app = GatewayRouter(public_app, admin_app)
+
+if __name__ == "__main__":
+    port = int(os.environ.get("PORT", 7860))
+    uvicorn.run(app, host="0.0.0.0", port=port)

requirements.txt

@@ -0,0 +1,11 @@
+huggingface-hub>=0.30.0,<1.0.0
+fastapi>=0.115.0,<0.129.0
+starlette>=0.40.0,<1.0.0
+uvicorn[standard]>=0.30,<1.0
+SQLAlchemy>=2.0,<2.1
+psycopg[binary]>=3.2,<4.0
+pydantic-settings>=2.6,<3.0
+python-jose[cryptography]>=3.3,<4.0
+bcrypt>=4.2,<6.0
+httpx>=0.27,<1.0
+python-multipart>=0.0.18,<1.0