Refactor project structure: remove unused files, add FastAPI app and dependencies, and configure supervisord for process management

.env.example

@@ -1,50 +0,0 @@
-# ============================================================
-# PostgREST + PostgreSQL (Hugging Face Space) — env vars
-# Copy to `.env` and adjust. HF Spaces only allows PORT to be
-# set via the Space settings; everything else can live here.
-# ============================================================
-
-# --- Server ---
-# Port PostgREST listens on. HF Spaces requires 7860.
-PORT=7860
-# Bind address (keep 0.0.0.0 for HF Spaces)
-PGRST_SERVER_HOST=0.0.0.0
-
-# --- Database connection ---
-# Full connection URI. Inside this container Postgres runs on a
-# local unix socket, so the default below is usually fine.
-# For an external DB, use e.g.:
-#   postgresql://authenticator:secret@db.example.com:5432/prod
-PGRST_DB_URI=postgresql://?host=/var/run/postgresql&port=5432&dbname=postgres
-
-# Comma-separated schemas exposed by the API
-PGRST_DB_SCHEMA=api
-
-# Role used for unauthenticated (anonymous) requests
-PGRST_DB_ANON_ROLE=web_anon
-
-# Role used to apply schema changes / own objects
-AUTHENTICATOR_PASSWORD=secret
-
-# --- Auth (optional) ---
-# Secret used to sign/verify JWTs. Generate one with:
-#   echo "secret" | openssl dgst -sha256 -hmac "your-key" -binary | base64
-# Leave empty to disable JWT auth (public API).
-PGRST_JWT_SECRET=
-# Claim that carries the DB role in the JWT.
-# Must be a JSON path — it MUST start with a dot (or be a bracket
-# expression). "role" alone is a parse error and crashes PostgREST.
-PGRST_JWT_ROLE_CLAIM_KEY=.role
-# Audience claim to require, if any
-PGRST_JWT_AUDIENCE=
-
-# --- API behavior (optional) ---
-# Max rows per request (Content-Range limiting)
-PGRST_MAX_ROWS=
-# Allow CORS from any origin (useful for browser clients)
-PGRST_CORS_ALLOWED_ORIGINS=*
-# Path prefix if served behind a proxy (usually empty on HF)
-PGRST_SERVER_PATH_PREFIX=
-
-# --- PostgREST version pinned in the Dockerfile ---
-PGRST_VERSION=16.2

Dockerfile

@@ -1,65 +1,37 @@
-# PostgREST + PostgreSQL in a single container (Hugging Face Space)
-# Serves a fully RESTful API from a Postgres database on port 7860.
+FROM postgres:16
 
-FROM debian:bookworm-slim
+ENV DEBIAN_FRONTEND=noninteractive
 
-ENV DEBIAN_FRONTEND=noninteractive \
-    PGRST_VERSION=16.2 \
-    PORT=7860 \
-    PGRST_DB_SCHEMAS=api \
-    PGRST_DB_ANON_ROLE=web_anon \
-    PGRST_SERVER_HOST=0.0.0.0
-
-# --- System dependencies: PostgreSQL server + tools ---
+# python for the FastAPI app, ssh client for the tunnel, supervisor to run
+# postgres + the tunnel loop + the api as one PID-1-managed process tree.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates \
-        curl \
-        libpq5 \
-        postgresql \
-        postgresql-contrib \
-        postgresql-client \
-        sudo \
-        xz-utils \
-        python3 \
+        python3 python3-pip \
+        openssh-client \
+        supervisor \
     && rm -rf /var/lib/apt/lists/*
 
-# --- PostgREST binary (static build from GitHub releases) ---
-# v16+ assets are named linux-static-x86-64 / linux-static-aarch64
-RUN ARCH="$(dpkg --print-architecture)" \
-    && case "$ARCH" in \
-        amd64) PGRST_ARCH=x86-64 ;; \
-        arm64) PGRST_ARCH=aarch64 ;; \
-        *) echo "unsupported arch: $ARCH" && exit 1 ;; \
-    esac \
-    && curl -fsSL \
-        "https://github.com/PostgREST/postgrest/releases/download/v${PGRST_VERSION}/postgrest-v${PGRST_VERSION}-linux-static-${PGRST_ARCH}.tar.xz" \
-        -o /tmp/postgrest.tar.xz \
-    && tar -xJf /tmp/postgrest.tar.xz -C /usr/local/bin \
-    && chmod +x /usr/local/bin/postgrest \
-    && rm /tmp/postgrest.tar.xz \
-    && postgrest --version
+# Key so pinggy never blocks on an interactive password prompt (there's no
+# TTY in a container). Accepted as an unauthenticated client key by pinggy's
+# free tier -- it's just there to skip the "press enter" prompt.
+RUN mkdir -p /root/.ssh \
+    && ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519 -N "" -q
 
-# --- Swagger UI static files (served at /docs by proxy.py) ---
-RUN curl -fsSL "https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-5.32.15.tgz" \
-        -o /tmp/swagger-ui.tgz \
-    && mkdir -p /opt/swagger-ui \
-    && tar -xzf /tmp/swagger-ui.tgz -C /opt/swagger-ui --strip-components=1 \
-    && rm /tmp/swagger-ui.tgz
+WORKDIR /app
+COPY requirements.txt .
+RUN pip3 install --no-cache-dir --break-system-packages --ignore-installed -r requirements.txt
+COPY app/ ./app/
 
-# --- Non-root user (HF Spaces runs containers as a random UID) ---
-RUN useradd -m -u 10001 appuser \
-    && mkdir -p /var/lib/postgresql/data /var/run/postgresql \
-    && chown -R appuser:appuser /var/lib/postgresql /var/run/postgresql /usr/local/bin/postgrest
+COPY tunnel.sh /usr/local/bin/tunnel.sh
+RUN chmod +x /usr/local/bin/tunnel.sh
 
-USER appuser
-WORKDIR /home/appuser
+COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 
-# --- Sample schema: a tiny "todos" API to demo PostgREST ---
-COPY --chown=appuser:appuser init.sql /docker-entrypoint-init.d/init.sql
-COPY --chown=appuser:appuser start.sh /usr/local/bin/start.sh
-COPY --chown=appuser:appuser proxy.py /usr/local/bin/proxy.py
-RUN chmod +x /usr/local/bin/start.sh /usr/local/bin/proxy.py
+# Override these at `docker run -e ...` (don't ship real creds in the image).
+ENV POSTGRES_PASSWORD=changeme
+ENV POSTGRES_USER=postgres
+ENV POSTGRES_DB=postgres
 
 EXPOSE 7860
 
-CMD ["start.sh"]
+ENTRYPOINT ["/usr/bin/supervisord"]
+CMD ["-n", "-c", "/etc/supervisor/conf.d/supervisord.conf"]

README.md

@@ -1,5 +1,5 @@
 ---
-title: Test
+title: All DB
 emoji: 🔥
 colorFrom: yellow
 colorTo: indigo

app/main.py

@@ -0,0 +1,50 @@
+from pathlib import Path
+from typing import Optional
+
+import os
+
+from fastapi import FastAPI, Header, HTTPException
+
+app = FastAPI(title="pinggy-db-url")
+
+URL_FILE = Path("/tmp/pinggy_url.txt")
+SECRET_KEY = os.environ.get("SECRET_KEY", "")
+
+
+def _check_api_key(api_key: str):
+    if not SECRET_KEY:
+        raise HTTPException(status_code=500, detail="SECRET_KEY is not configured")
+    if api_key != SECRET_KEY:
+        raise HTTPException(status_code=401, detail="invalid api key")
+
+
+def _read_url() -> Optional[str]:
+    if not URL_FILE.exists():
+        return None
+    value = URL_FILE.read_text().strip()
+    return value or None
+
+
+@app.get("/")
+def root(x_api_key: str = Header(default="")):
+    _check_api_key(x_api_key)
+    return {"status": "ok", "hint": "GET /db-url for the current connection info"}
+
+
+@app.get("/db-url")
+def db_url(x_api_key: str = Header(default="")):
+    _check_api_key(x_api_key)
+    url = _read_url()
+    if url is None:
+        raise HTTPException(status_code=503, detail="tunnel not ready yet, try again shortly")
+
+    # url looks like tcp://<host>:<port>
+    host_port = url[len("tcp://"):] if url.startswith("tcp://") else url
+    host, _, port = host_port.partition(":")
+
+    return {
+        "tunnel_url": url,
+        "host": host,
+        "port": int(port) if port.isdigit() else None,
+        "psql_example": f"psql -h {host} -p {port} -U postgres -d postgres",
+    }

init.sql

@@ -1,79 +0,0 @@
--- Schema + roles for PostgREST, executed once at container startup.
--- Model: chat history (conversations -> messages).
--- (Mirrors migrations/0001_chat_history.sql)
-
--- Role PostgREST connects as (anonymous / public access)
-CREATE ROLE web_anon LOGIN NOINHERIT;
-
--- Role used to apply schema changes. Password comes from start.sh
--- via psql variable `auth_pw` (sourced from AUTHENTICATOR_PASSWORD).
-CREATE ROLE authenticator NOINHERIT LOGIN PASSWORD :'auth_pw';
-GRANT web_anon TO authenticator;
-
-CREATE SCHEMA api;
-GRANT USAGE ON SCHEMA api TO web_anon;
--- authenticator owns the tables, so foreign-key checks (which run as the
--- table owner) need USAGE on the schema too. NOINHERIT means it does NOT
--- inherit web_anon's grants.
-GRANT USAGE ON SCHEMA api TO authenticator;
-
--- One conversation (a chat thread)
-CREATE TABLE api.chats (
-    id          bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
-    title       text    NOT NULL,
-    created_at  timestamptz NOT NULL DEFAULT now()
-);
-
--- Messages belonging to a conversation
-CREATE TABLE api.messages (
-    id          bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
-    chat_id     bigint  NOT NULL REFERENCES api.chats (id) ON DELETE CASCADE,
-    role        text    NOT NULL CHECK (role IN ('user', 'assistant', 'system')),
-    content     text    NOT NULL,
-    created_at  timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE INDEX messages_chat_id_idx ON api.messages (chat_id);
-
--- Change ownership BEFORE granting: ALTER TABLE ... OWNER TO drops
--- privileges granted by the previous owner.
-ALTER TABLE api.chats    OWNER TO authenticator;
-ALTER TABLE api.messages OWNER TO authenticator;
-
-GRANT SELECT, INSERT, UPDATE, DELETE ON api.chats    TO web_anon;
-GRANT SELECT, INSERT, UPDATE, DELETE ON api.messages TO web_anon;
-GRANT USAGE, SELECT ON SEQUENCE api.chats_id_seq    TO web_anon;
-GRANT USAGE, SELECT ON SEQUENCE api.messages_id_seq TO web_anon;
-
-INSERT INTO api.chats (title) VALUES
-    ('Getting started'),
-    ('PostgREST questions');
-
-INSERT INTO api.messages (chat_id, role, content) VALUES
-    (1, 'user',      'How do I list all chats?'),
-    (1, 'assistant', 'GET /chats — or GET /chats?select=*,messages(*) to embed messages.'),
-    (2, 'user',      'How do I add a message to chat 1?'),
-    (2, 'assistant', 'POST /messages with {"chat_id": 1, "role": "user", "content": "..."}');
-
--- Row counts for Content-Range headers
-CREATE OR REPLACE FUNCTION api.chats_count()
-RETURNS bigint
-LANGUAGE sql
-AS $$
-    SELECT count(*) FROM api.chats;
-$$;
-
-CREATE OR REPLACE FUNCTION api.messages_count()
-RETURNS bigint
-LANGUAGE sql
-AS $$
-    SELECT count(*) FROM api.messages;
-$$;
-
--- OpenAPI description endpoint
-CREATE OR REPLACE FUNCTION api.openapi_description()
-RETURNS text
-LANGUAGE sql
-AS $$
-    SELECT 'A demo PostgREST chat-history API running on Hugging Face Spaces';
-$$;

migrations/0001_chat_history.sql

@@ -1,74 +0,0 @@
--- Schema + roles for PostgREST, executed once at container startup.
--- Model: chat history (conversations -> messages).
-
--- Role PostgREST connects as (anonymous / public access)
-CREATE ROLE web_anon LOGIN NOINHERIT;
-
--- Role used to apply schema changes. Password comes from start.sh
--- via psql variable `auth_pw` (sourced from AUTHENTICATOR_PASSWORD).
-CREATE ROLE authenticator NOINHERIT LOGIN PASSWORD :'auth_pw';
-GRANT web_anon TO authenticator;
-
-CREATE SCHEMA api;
-GRANT USAGE ON SCHEMA api TO web_anon;
-
--- One conversation (a chat thread)
-CREATE TABLE api.chats (
-    id          bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
-    title       text    NOT NULL,
-    created_at  timestamptz NOT NULL DEFAULT now()
-);
-
--- Messages belonging to a conversation
-CREATE TABLE api.messages (
-    id          bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
-    chat_id     bigint  NOT NULL REFERENCES api.chats (id) ON DELETE CASCADE,
-    role        text    NOT NULL CHECK (role IN ('user', 'assistant', 'system')),
-    content     text    NOT NULL,
-    created_at  timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE INDEX messages_chat_id_idx ON api.messages (chat_id);
-
--- Change ownership BEFORE granting: ALTER TABLE ... OWNER TO drops
--- privileges granted by the previous owner.
-ALTER TABLE api.chats    OWNER TO authenticator;
-ALTER TABLE api.messages OWNER TO authenticator;
-
-GRANT SELECT, INSERT, UPDATE, DELETE ON api.chats    TO web_anon;
-GRANT SELECT, INSERT, UPDATE, DELETE ON api.messages TO web_anon;
-GRANT USAGE, SELECT ON SEQUENCE api.chats_id_seq    TO web_anon;
-GRANT USAGE, SELECT ON SEQUENCE api.messages_id_seq TO web_anon;
-
-INSERT INTO api.chats (title) VALUES
-    ('Getting started'),
-    ('PostgREST questions');
-
-INSERT INTO api.messages (chat_id, role, content) VALUES
-    (1, 'user',      'How do I list all chats?'),
-    (1, 'assistant', 'GET /chats — or GET /chats?select=*,messages(*) to embed messages.'),
-    (2, 'user',      'How do I add a message to chat 1?'),
-    (2, 'assistant', 'POST /messages with {"chat_id": 1, "role": "user", "content": "..."}');
-
--- Row counts for Content-Range headers
-CREATE OR REPLACE FUNCTION api.chats_count()
-RETURNS bigint
-LANGUAGE sql
-AS $$
-    SELECT count(*) FROM api.chats;
-$$;
-
-CREATE OR REPLACE FUNCTION api.messages_count()
-RETURNS bigint
-LANGUAGE sql
-AS $$
-    SELECT count(*) FROM api.messages;
-$$;
-
--- OpenAPI description endpoint
-CREATE OR REPLACE FUNCTION api.openapi_description()
-RETURNS text
-LANGUAGE sql
-AS $$
-    SELECT 'A demo PostgREST chat-history API running on Hugging Face Spaces';
-$$;

proxy.py

@@ -1,123 +0,0 @@
-#!/usr/bin/env python3
-"""
-Tiny reverse proxy in front of PostgREST.
-
-- /docs            -> Swagger UI (static files from /opt/swagger-ui)
-- /docs/openapi.json -> OpenAPI spec fetched from PostgREST
-- everything else  -> proxied verbatim to PostgREST on 127.0.0.1:$PGRST_PORT
-
-Uses only the Python standard library. Runs as the same non-root user.
-"""
-
-import json
-import os
-import urllib.request
-from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
-
-SWAGGER_DIR = "/opt/swagger-ui"
-UPSTREAM = f"http://127.0.0.1:{os.environ.get('PGRST_PORT', '3000')}"
-LISTEN_PORT = int(os.environ.get("PORT", "7860"))
-
-# Swagger UI page that loads /docs/openapi.json
-INDEX_HTML = """<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <title>PostgREST API Docs</title>
-  <link rel="stylesheet" href="/docs/swagger-ui.css">
-</head>
-<body>
-  <div id="swagger-ui"></div>
-  <script src="/docs/swagger-ui-bundle.js" charset="UTF-8"></script>
-  <script>
-    window.onload = () => {
-      SwaggerUIBundle({
-        url: "/docs/openapi.json",
-        dom_id: "#swagger-ui",
-        deepLinking: true,
-      });
-    };
-  </script>
-</body>
-</html>"""
-
-
-class Handler(SimpleHTTPRequestHandler):
-    def __init__(self, *args, **kwargs):
-        # Serve static Swagger UI files from SWAGGER_DIR
-        super().__init__(*args, directory=SWAGGER_DIR, **kwargs)
-
-    # --- /docs routes -----------------------------------------------------
-    def _send(self, code, body, ctype):
-        self.send_response(code)
-        self.send_header("Content-Type", ctype)
-        self.send_header("Content-Length", str(len(body)))
-        self.send_header("Cache-Control", "no-store")
-        self.end_headers()
-        self.wfile.write(body)
-
-    # --- proxying ---------------------------------------------------------
-    def _proxy(self):
-        url = UPSTREAM + self.path
-        req = urllib.request.Request(url, method=self.command)
-        for h in ("Content-Type", "Accept", "Prefer", "Range",
-                  "If-Match", "Authorization"):
-            if v := self.headers.get(h):
-                req.add_header(h, v)
-        length = int(self.headers.get("Content-Length") or 0)
-        body = self.rfile.read(length) if length else None
-
-        try:
-            with urllib.request.urlopen(req, body) as r:
-                resp, code, rheaders = r.read(), r.status, r.headers
-        except urllib.error.HTTPError as e:
-            resp, code, rheaders = e.read(), e.code, e.headers
-        except Exception as e:  # URLError, timeout, upstream down, ...
-            print(f"proxy error: {self.command} {self.path}: {e!r}", flush=True)
-            resp = json.dumps({"message": str(e)}).encode()
-            code, rheaders = 502, {"Content-Type": "application/json"}
-
-        self.send_response(code)
-        for h in ("Content-Type", "Content-Range", "Content-Location",
-                  "Location", "ETag", "Preference-Applied",
-                  "Accept-Profile", "Content-Profile"):
-            if v := rheaders.get(h):
-                self.send_header(h, v)
-        self.send_header("Content-Length", str(len(resp)))
-        self.end_headers()
-        self.wfile.write(resp)
-
-    def do_GET(self):
-        if self.path == "/docs" or self.path.startswith("/docs?"):
-            self._send(200, INDEX_HTML.encode(), "text/html; charset=utf-8")
-        elif self.path == "/docs/openapi.json":
-            # Fetch the spec and rewrite its host so "Try it out" requests
-            # hit the public origin instead of PostgREST's internal port
-            import json
-            spec = json.loads(urllib.request.urlopen(f"{UPSTREAM}/").read())
-            spec["host"] = self.headers.get("Host") or f"localhost:{LISTEN_PORT}"
-            spec["schemes"] = ["https"] if self.headers.get(
-                "X-Forwarded-Proto") == "https" else ["http"]
-            body = json.dumps(spec).encode()
-            self._send(200, body, "application/openapi+json")
-        elif self.path.startswith("/docs/"):
-            # static assets: strip the /docs prefix
-            self.path = self.path[len("/docs"):]
-            super().do_GET()
-        else:
-            self._proxy()
-
-    def do_HEAD(self):
-        self.do_GET()
-
-    def _proxy_with_body(self):
-        self._proxy()
-
-    do_POST = do_PATCH = do_PUT = do_DELETE = do_OPTIONS = _proxy_with_body
-
-    def log_message(self, fmt, *args):
-        print("%s - %s" % (self.address_string(), fmt % args), flush=True)
-
-
-if __name__ == "__main__":
-    ThreadingHTTPServer(("0.0.0.0", LISTEN_PORT), Handler).serve_forever()

requirements.txt

@@ -0,0 +1,2 @@
+fastapi
+uvicorn[standard]

start.sh

@@ -1,59 +0,0 @@
-#!/usr/bin/env bash
-# Start PostgreSQL, apply the schema, then launch PostgREST on $PORT.
-set -euo pipefail
-
-# Load .env if present (local runs; HF Spaces injects vars itself)
-if [ -f .env ]; then
-    set -a
-    . ./.env
-    set +a
-fi
-
-PGDATA=/var/lib/postgresql/data
-SOCKET_DIR=/var/run/postgresql
-INIT_SQL=/docker-entrypoint-init.d/init.sql
-
-# Debian's postgresql package keeps binaries in a versioned dir
-# (e.g. /usr/lib/postgresql/15/bin) that is not on PATH.
-for PGDIR in /usr/lib/postgresql/*/bin; do
-    [ -x "$PGDIR/pg_ctl" ] && export PATH="$PGDIR:$PATH" && break
-done
-
-command -v pg_ctl >/dev/null || { echo "postgres binaries not found" >&2; exit 1; }
-
-# --- Initialize and start PostgreSQL ---
-if [ ! -s "$PGDATA/PG_VERSION" ]; then
-    initdb --username=appuser --pgdata="$PGDATA" --auth-local=trust --auth-host=trust
-fi
-
-pg_ctl -D "$PGDATA" -o "-c listen_addresses=127.0.0.1 -c unix_socket_directories=$SOCKET_DIR -c port=5432" -w start
-
-# Wait until the server accepts connections
-until pg_isready -h "$SOCKET_DIR" -p 5432 -q; do
-    sleep 0.2
-done
-
-# --- Apply schema once ---
-if ! psql -h "$SOCKET_DIR" -p 5432 -d postgres -Atqc "SELECT 1 FROM pg_roles WHERE rolname='web_anon'" | grep -q 1; then
-    psql -v ON_ERROR_STOP=1 --set=auth_pw="${AUTHENTICATOR_PASSWORD:-secret}" \
-        -h "$SOCKET_DIR" -p 5432 -d postgres -f "$INIT_SQL"
-fi
-
-# --- Launch PostgREST ---
-export PGRST_DB_URI="postgresql://authenticator:${AUTHENTICATOR_PASSWORD:-secret}@/postgres?host=$SOCKET_DIR&port=5432"
-export PGRST_DB_SCHEMA="${PGRST_DB_SCHEMA:-api}"
-export PGRST_DB_ANON_ROLE="${PGRST_DB_ANON_ROLE:-web_anon}"
-export PGRST_SERVER_PORT="${PGRST_PORT:-3000}"
-
-# PGRST_JWT_ROLE_CLAIM_KEY must be a JSON path (".role", ".payload.role",
-# '."https://example.com/role"' or "[\"role\"]"). A bare value like "role"
-# is a parse error that crashes PostgREST at startup — normalize it.
-if [ -n "${PGRST_JWT_ROLE_CLAIM_KEY:-}" ] && \
-   [[ ! "$PGRST_JWT_ROLE_CLAIM_KEY" =~ ^(\.|\[|\") ]]; then
-    export PGRST_JWT_ROLE_CLAIM_KEY=".$PGRST_JWT_ROLE_CLAIM_KEY"
-fi
-
-# PostgREST listens on the internal port; the proxy serves it (plus
-# Swagger UI at /docs) on the public $PORT.
-postgrest &
-exec python3 /usr/local/bin/proxy.py

supervisord.conf

@@ -0,0 +1,33 @@
+[supervisord]
+nodaemon=true
+user=root
+logfile=/var/log/supervisord.log
+
+; Runs the postgres image's own entrypoint script with "postgres" as the
+; argument -- this is what triggers its normal first-run init (creating
+; the data dir, user, db) before it execs postgres in the foreground.
+[program:postgres]
+command=docker-entrypoint.sh postgres
+priority=1
+autostart=true
+autorestart=true
+stdout_logfile=/var/log/postgres.log
+stderr_logfile=/var/log/postgres.err.log
+
+[program:tunnel]
+command=/usr/local/bin/tunnel.sh
+priority=10
+autostart=true
+autorestart=true
+startretries=999
+stdout_logfile=/var/log/tunnel.log
+stderr_logfile=/var/log/tunnel.err.log
+
+[program:fastapi]
+command=python3 -m uvicorn app.main:app --host 0.0.0.0 --port 7860
+directory=/app
+priority=20
+autostart=true
+autorestart=true
+stdout_logfile=/var/log/fastapi.log
+stderr_logfile=/var/log/fastapi.err.log

tunnel.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# Keeps a pinggy TCP tunnel to local postgres alive, recycling it before
+# the free-tier ~60 minute cap, and writing the current public host:port
+# to a file that the FastAPI app reads from.
+
+set -u
+
+URL_FILE=/tmp/pinggy_url.txt
+LOG_FILE=/tmp/pinggy_current.log
+TTL_SECONDS=$((50 * 60))   # refresh every 50 min, inside the 60 min free cap
+
+echo "[tunnel] waiting for postgres..."
+until pg_isready -h 127.0.0.1 -p 5432 >/dev/null 2>&1; do
+    sleep 1
+done
+echo "[tunnel] postgres is up"
+
+while true; do
+    SECONDS=0
+    : > "$LOG_FILE"
+    echo "[tunnel] opening new pinggy tunnel..."
+
+    ssh -p 443 -T \
+        -o StrictHostKeyChecking=no \
+        -o UserKnownHostsFile=/dev/null \
+        -o ServerAliveInterval=30 \
+        -o ExitOnForwardFailure=yes \
+        -R0:127.0.0.1:5432 qr+tcp@free.pinggy.io \
+        >> "$LOG_FILE" 2>&1 &
+    SSH_PID=$!
+
+    # poll the log for the public "tcp://host:port" pinggy prints on connect
+    URL=""
+    for i in $(seq 1 30); do
+        URL=$(grep -oE 'tcp://[a-zA-Z0-9.-]+:[0-9]+' "$LOG_FILE" | head -n1)
+        [ -n "$URL" ] && break
+        kill -0 "$SSH_PID" 2>/dev/null || break   # ssh already died
+        sleep 1
+    done
+
+    if [ -n "$URL" ]; then
+        echo "$URL" > "$URL_FILE"
+        echo "[tunnel] live at $URL"
+    else
+        echo "[tunnel] never got a URL from pinggy, see $LOG_FILE" >&2
+    fi
+
+    # hold this tunnel open until TTL expires or ssh dies on its own
+    while [ "$SECONDS" -lt "$TTL_SECONDS" ] && kill -0 "$SSH_PID" 2>/dev/null; do
+        sleep 5
+    done
+
+    echo "[tunnel] recycling..."
+    kill "$SSH_PID" 2>/dev/null
+    wait "$SSH_PID" 2>/dev/null
+done