Spaces:
Running
Running
| set -e | |
| # 1. Hugging Face Space runtime environment configuration | |
| export DATA_DB="${DATA_DB:-postgresql}" | |
| export VECTOR_DB="${VECTOR_DB:-postgresql}" | |
| export GRAPH_DB="${GRAPH_DB:-networkx}" | |
| export CELERY_BACKEND="${CELERY_BACKEND:-redis}" | |
| export PIPELINE_MODE="${PIPELINE_MODE:-lightweight}" | |
| export MODELS_MODE="${MODELS_MODE:-local}" | |
| export LLM_SMALL_PROVIDER="${LLM_SMALL_PROVIDER:-ollama}" | |
| export LLM_LARGE_PROVIDER="${LLM_LARGE_PROVIDER:-ollama}" | |
| export EMBEDDINGS_PROVIDER="${EMBEDDINGS_PROVIDER:-ollama}" | |
| export OLLAMA_HOST="${OLLAMA_HOST:-127.0.0.1}" | |
| export OLLAMA_PORT="${OLLAMA_PORT:-11434}" | |
| export OLLAMA_MODELS="${OLLAMA_MODELS:-/opt/ollama-models}" | |
| export OLLAMA_NO_CLOUD="${OLLAMA_NO_CLOUD:-true}" | |
| export OLLAMA_EMBEDDING_MODEL="${OLLAMA_EMBEDDING_MODEL:-embeddinggemma-2:270m}" | |
| export OLLAMA_NUM_PARALLEL="${OLLAMA_NUM_PARALLEL:-1}" | |
| export OLLAMA_MAX_LOADED_MODELS="${OLLAMA_MAX_LOADED_MODELS:-1}" | |
| export OLLAMA_NUM_THREADS="${OLLAMA_NUM_THREADS:-2}" | |
| export OLLAMA_EMBEDDING_KEEP_ALIVE="${OLLAMA_EMBEDDING_KEEP_ALIVE:-10m}" | |
| # The qualified text-only Gemma profile is native 768 -> MRL 512 -> L2. | |
| export EMBEDDING_PROFILE="${EMBEDDING_PROFILE:-embeddinggemma2-text-v1}" | |
| export EMBEDDING_NATIVE_DIMENSION="${EMBEDDING_NATIVE_DIMENSION:-768}" | |
| export EMBEDDING_MRL_DIMENSION="${EMBEDDING_MRL_DIMENSION:-512}" | |
| export SEARCH_ENABLED="${SEARCH_ENABLED:-true}" | |
| export CONTEXT_PASSAGE_MODE="${CONTEXT_PASSAGE_MODE:-hybrid}" | |
| for dimension in NODES TRIPLETS OBSERVATIONS DATA RELATIONSHIPS; do | |
| variable="EMBEDDING_${dimension}_DIMENSION" | |
| export "$variable=${!variable:-512}" | |
| done | |
| export POSTGRES_HOST="${POSTGRES_HOST:-127.0.0.1}" | |
| export POSTGRES_PORT="${POSTGRES_PORT:-5432}" | |
| export POSTGRES_USERNAME="${POSTGRES_USERNAME:-brainapi}" | |
| export POSTGRES_SYSTEM_DATABASE="${POSTGRES_SYSTEM_DATABASE:-brainapi}" | |
| export POSTGRES_MAINTENANCE_DATABASE="${POSTGRES_MAINTENANCE_DATABASE:-postgres}" | |
| export REDIS_HOST="${REDIS_HOST:-127.0.0.1}" | |
| export REDIS_PORT="${REDIS_PORT:-6379}" | |
| export DEFAULT_BRAIN_FALLBACK="${DEFAULT_BRAIN_FALLBACK:-false}" | |
| export MCP_PORT="${MCP_PORT:-8001}" | |
| # Resolve the one administrator credential before starting any services. | |
| /app/.venv/bin/python -c 'from src.services.auth_config import resolve_system_pat; resolve_system_pat()' | |
| export BRAIN_BACKUP_ENABLED="${BRAIN_BACKUP_ENABLED:-true}" | |
| export BRAIN_BACKUP_INTERVAL_SECONDS="${BRAIN_BACKUP_INTERVAL_SECONDS:-300}" | |
| export BRAIN_BACKUP_MAX_RPO_SECONDS="${BRAIN_BACKUP_MAX_RPO_SECONDS:-$BRAIN_BACKUP_INTERVAL_SECONDS}" | |
| export ALLOW_CHECKPOINTED_PRODUCTION="${ALLOW_CHECKPOINTED_PRODUCTION:-false}" | |
| export BRAIN_BACKUP_STATE_DIR="${BRAIN_BACKUP_STATE_DIR:-/tmp/brainapi-backup-state}" | |
| export BRAIN_BACKUP_STARTUP_ID="$(/app/.venv/bin/python -c 'import uuid; print(uuid.uuid4())')" | |
| mkdir -p "$BRAIN_BACKUP_STATE_DIR" | |
| chown root:appuser "$BRAIN_BACKUP_STATE_DIR" | |
| chmod 2770 "$BRAIN_BACKUP_STATE_DIR" | |
| touch "$BRAIN_BACKUP_STATE_DIR/dirty" | |
| chown root:appuser "$BRAIN_BACKUP_STATE_DIR/dirty" | |
| chmod 0660 "$BRAIN_BACKUP_STATE_DIR/dirty" | |
| export TRACE_MODE="${TRACE_MODE:-log}" | |
| export BRAINAPI_DURABLE_ROOT="${BRAINAPI_DURABLE_ROOT:-/data}" | |
| export PERSISTENT_ROOT="$(/app/.venv/bin/python -c 'from src.services.persistence import enforce_persistence; print(enforce_persistence()["root"])')" | |
| export PERSISTENCE_MODE="$(/app/.venv/bin/python -c 'from src.services.persistence import persistence_state; print(persistence_state()["mode"])')" | |
| if [ "$PERSISTENCE_MODE" = "ephemeral" ]; then | |
| echo "WARNING: local storage is ephemeral; checkpoint recovery, RPO and production readiness are reported by /health." | |
| fi | |
| mkdir -p "$PERSISTENT_ROOT/postgres" "$PERSISTENT_ROOT/redis" /var/lib/postgresql | |
| chmod 0750 "$PERSISTENT_ROOT" "$PERSISTENT_ROOT/redis" | |
| chown root:postgres "$PERSISTENT_ROOT" | |
| chmod 0700 "$PERSISTENT_ROOT/postgres" | |
| chown -R postgres "$PERSISTENT_ROOT/postgres" /var/lib/postgresql | |
| SECRETS_FILE="$PERSISTENT_ROOT/internal-secrets.env" | |
| if [ ! -f "$SECRETS_FILE" ]; then | |
| PG_PASS="$(/app/.venv/bin/python -c "import secrets; print(secrets.token_hex(32))")" | |
| RED_PASS="$(/app/.venv/bin/python -c "import secrets; print(secrets.token_hex(32))")" | |
| cat <<EOF > "$SECRETS_FILE" | |
| POSTGRES_PASSWORD=$PG_PASS | |
| REDIS_PASSWORD=$RED_PASS | |
| EOF | |
| chmod 0600 "$SECRETS_FILE" | |
| fi | |
| source "$SECRETS_FILE" | |
| export POSTGRES_PASSWORD | |
| export REDIS_PASSWORD | |
| export CELERY_BROKER_URL="redis://:${REDIS_PASSWORD}@127.0.0.1:6379/0" | |
| export CELERY_RESULT_BACKEND="redis://:${REDIS_PASSWORD}@127.0.0.1:6379/0" | |
| # docker exec starts with the image environment, not this script's exports. | |
| # Load the same runtime defaults/credentials for qualification without restarting | |
| # or reinitializing the already-running application services. | |
| case "${1:-}" in | |
| --qualify) exec /app/.venv/bin/python /app/scripts/qualify_hf_embeddings.py ;; | |
| --qualify-auth) exec /app/.venv/bin/python /app/scripts/qualify_auth.py ;; | |
| --qualify-registry) exec /app/.venv/bin/python /app/scripts/qualify_brain_registry.py ;; | |
| --qualify-backup) exec /app/.venv/bin/python /app/scripts/qualify_content_backup.py ;; | |
| --qualify-maintenance) shift; exec /app/.venv/bin/python /app/scripts/qualify_maintenance.py "$@" ;; | |
| esac | |
| # Print non-secret startup diagnostics | |
| echo "==================================================" | |
| echo "Starting BrainAPI Hugging Face Space Runtime" | |
| echo "DATA_DB=$DATA_DB" | |
| echo "VECTOR_DB=$VECTOR_DB" | |
| echo "GRAPH_DB=$GRAPH_DB" | |
| echo "POSTGRES_HOST=$POSTGRES_HOST" | |
| echo "REDIS_HOST=$REDIS_HOST" | |
| echo "persistent_root=$PERSISTENT_ROOT" | |
| echo "==================================================" | |
| # 2. PostgreSQL Setup | |
| PGDATA="$PERSISTENT_ROOT/postgres" | |
| export PGDATA | |
| chown -R postgres "$PGDATA" /var/lib/postgresql 2>/dev/null || true | |
| if [ ! -s "$PGDATA/PG_VERSION" ]; then | |
| su - postgres -c "/usr/lib/postgresql/15/bin/initdb -D '$PGDATA' --encoding=UTF8 --locale=C.UTF-8 --auth-local=peer --auth-host=scram-sha-256" | |
| echo "listen_addresses = '127.0.0.1'" >> "$PGDATA/postgresql.conf" | |
| fi | |
| # 3. Redis Setup | |
| cat <<EOF > /etc/redis/redis.conf | |
| bind 127.0.0.1 | |
| port $REDIS_PORT | |
| requirepass $REDIS_PASSWORD | |
| dir $PERSISTENT_ROOT/redis | |
| appendonly yes | |
| appendfilename "appendonly.aof" | |
| protected-mode no | |
| EOF | |
| chmod 0750 "$PERSISTENT_ROOT/redis" | |
| # Ensure legacy background instances are stopped before clean startup | |
| su - postgres -c "/usr/lib/postgresql/15/bin/pg_ctl -D '$PGDATA' -m immediate stop" 2>/dev/null || true | |
| pkill -9 redis-server 2>/dev/null || true | |
| pkill -9 -f supervisord 2>/dev/null || true | |
| sleep 1 | |
| # Start background services directly for temporary initialization | |
| su - postgres -c "/usr/lib/postgresql/15/bin/pg_ctl -D '$PGDATA' -o '-k /tmp' -w start" | |
| /usr/bin/redis-server /etc/redis/redis.conf --daemonize yes | |
| echo "[entrypoint] Waiting for Postgres readiness check..." | |
| until su - postgres -c "pg_isready -h 127.0.0.1 -p $POSTGRES_PORT"; do | |
| sleep 1 | |
| done | |
| echo "[entrypoint] Ensuring Postgres database and extension..." | |
| su - postgres -c "psql -h /tmp -d template1 -c 'CREATE EXTENSION IF NOT EXISTS vector;' 2>/dev/null || true" | |
| # This child drops to postgres for peer auth; no passwords enter shell arguments | |
| # or failed CREATE ROLE statements on repeated container starts. | |
| /app/.venv/bin/python /app/scripts/provision_postgres.py | |
| echo "[entrypoint] Waiting for Redis readiness check..." | |
| until REDISCLI_AUTH="$REDIS_PASSWORD" redis-cli -h 127.0.0.1 -p $REDIS_PORT ping | grep -q PONG; do | |
| sleep 1 | |
| done | |
| echo "[entrypoint] Validating content backup before workspace bootstrap..." | |
| /app/.venv/bin/python -m src.services.brain_backup restore | |
| echo "[entrypoint] Verifying BrainAPI workspace bootstrap..." | |
| /app/.venv/bin/python -c " | |
| from src.services.data.main import data_adapter | |
| from src.services.workspaces import WorkspaceService | |
| WorkspaceService(data_adapter).bootstrap() | |
| print('[entrypoint] Workspace bootstrap successful.') | |
| " | |
| /app/.venv/bin/python -m src.services.brain_backup verify-startup | |
| # Stop temporary initialization daemons so Supervisord manages exactly one instance of each | |
| echo "[entrypoint] Stopping temporary initialization daemons before handing control to Supervisord..." | |
| su - postgres -c "/usr/lib/postgresql/15/bin/pg_ctl -D '$PGDATA' -m fast stop" 2>/dev/null || true | |
| REDISCLI_AUTH="$REDIS_PASSWORD" redis-cli -h 127.0.0.1 -p $REDIS_PORT shutdown 2>/dev/null || true | |
| sleep 1 | |
| # 4. Nginx Setup | |
| if [ -f /app/deploy/nginx.conf ]; then | |
| cp /app/deploy/nginx.conf /etc/nginx/conf.d/default.conf | |
| rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true | |
| fi | |
| # 5. Plugin setup | |
| plugin_failure_policy="${PLUGIN_FAILURE_POLICY:-}" | |
| if [ -z "$plugin_failure_policy" ]; then | |
| if [ "${ENV:-production}" = "development" ]; then | |
| plugin_failure_policy="warn" | |
| else | |
| plugin_failure_policy="fail" | |
| fi | |
| fi | |
| mkdir -p /app/plugins | |
| if [ -n "$BRAINAPI_PLUGINS" ]; then | |
| IFS=',' read -ra PLUGINS <<< "$BRAINAPI_PLUGINS" | |
| for plugin_spec in "${PLUGINS[@]}"; do | |
| plugin_spec="$(echo "$plugin_spec" | xargs)" | |
| name="${plugin_spec%%:*}" | |
| version="${plugin_spec##*:}" | |
| [ "$name" = "$version" ] && version="latest" | |
| echo "[brainapi] Installing plugin: $name v$version" | |
| if ! /app/.venv/bin/python -m src.core.plugins.cli plugins install "$name" --version "$version"; then | |
| if [ "$plugin_failure_policy" = "fail" ]; then | |
| echo "[brainapi] Failed to install required plugin '$name'" >&2 | |
| exit 1 | |
| fi | |
| echo "[brainapi] WARNING: Failed to install plugin '$name'" >&2 | |
| fi | |
| done | |
| fi | |
| # Copy supervisor config from deploy template | |
| cp /app/deploy/supervisord.conf /etc/supervisor/supervisord.conf | |
| echo "[entrypoint] Handing over execution to Supervisord (PID 1, nodaemon)..." | |
| exec /usr/bin/supervisord -n -c /etc/supervisor/supervisord.conf | |