| # Hugging Face Spaces — MiroFish API (Docker) | |
| ## Create the Space | |
| 1. [huggingface.co/spaces](https://huggingface.co/spaces) → **Create new Space** | |
| 2. **SDK**: **Docker** | |
| 3. **Hardware**: CPU (free) — long simulations may OOM or time out; upgrade if needed. | |
| 4. Connect this repo and set the Docker **app directory** to **`backend`** (or copy only `backend/` into a dedicated repo). | |
| ### Visibility must be **Public** (important) | |
| If the Space is **Private**, browsers and your static site get **`401` with body `unauthorized`** (plain text) **before** the request reaches Flask. | |
| Open **Space → Settings → Visibility** and set **Public** so `https://YOUR-SPACE.hf.space/api/...` works without a Hugging Face login cookie. | |
| Build context = folder that contains `Dockerfile`, `requirements.txt`, `app/`, `wsgi.py`. | |
| ## Secrets (Space → Settings → Variables and secrets) | |
| | Variable | Notes | | |
| |----------|--------| | |
| | `SECRET_KEY` | Long random string (Flask). | | |
| | `LLM_API_KEY`, `LLM_BASE_URL`, `LLM_MODEL_NAME` | Your LLM. | | |
| | `ZEP_API_KEY` | Zep. | | |
| | `SUPABASE_URL` | `https://xxx.supabase.co` | | |
| | `SUPABASE_SERVICE_ROLE_KEY` | Service role (never expose to browser). | | |
| | `PIPELINE_CLIENT_SECRET` | **Same** as website `VITE_PIPELINE_CLIENT_SECRET`. | | |
| | `SUPABASE_REPORTS_BUCKET` | Default `reports`. | | |
| | `PIPELINE_MAX_ROUNDS` | Optional integer cap. | | |
| Optional: `SUPABASE_JWT_SECRET` if you use Supabase Auth JWT on the pipeline. | |
| ## Website (`website/.env`) | |
| ```env | |
| VITE_API_BASE_URLS=https://YOUR-SPACE.hf.space | |
| VITE_PIPELINE_CLIENT_SECRET=same-as-PIPELINE_CLIENT_SECRET | |
| VITE_SUPABASE_URL=https://xxx.supabase.co | |
| VITE_SUPABASE_ANON_KEY=your_anon_key | |
| ``` | |
| Login/sign-up use **Supabase** on `public."User"` — run `supabase/grants_public_user.sql` in the SQL editor. | |
| ## Free tier notes | |
| - Space **sleeps** when idle; first request is a cold start. | |
| - Proxies may **time out** on very long HTTP requests; heavy pipelines may need paid hardware or another host. | |
| ## Health check | |
| `GET /health` → `{"status":"ok",...}` | |