Expose the API alongside the Streamlit demo in the HF Space via nginx

Adds nginx as a reverse proxy in front of both the Streamlit demo and
the FastAPI app: / goes to Streamlit, /api/ goes to the API, both
managed by supervisord in the single HF Space container (nginx.conf)
and mirrored for local docker-compose (nginx.local.conf, using
container DNS names instead of localhost).

Fixes on top of the original approach:
- Dockerfile switched to USER root to install the nginx config/perms
but never switched back, so the whole container would've run as
root at runtime despite HF Spaces requiring UID 1000 - restored
USER user before CMD.
- GAZET_PUBLIC_API_URL was set but never read anywhere; wired it into
the Streamlit sidebar as a link to the API docs so the exposed API
is actually discoverable.
- The /api/ location was missing proxy_buffering off and generous
timeouts (present on the streamlit location but not copied over):
without them, GET /search/stream's incremental NDJSON would get
buffered by nginx until the response completes, and the default 60s
proxy_read_timeout is shorter than the LLM's documented 30-60s cold
start plus actual generation time.

Dockerfile

@@ -4,7 +4,7 @@ FROM python:3.13-slim
 
 # Install system deps
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl supervisor libgomp1 && rm -rf /var/lib/apt/lists/*
+    curl nginx supervisor libgomp1 && rm -rf /var/lib/apt/lists/*
 
 # Copy llama-server binary and backend .so files (must stay together)
 COPY --from=llama /app /usr/local/lib/llama
@@ -45,9 +45,20 @@ snapshot_download('developmentseed/gazet-geodata', repo_type='dataset', local_di
 
 COPY --chown=user supervisord.conf .
 
+# Switch to root for nginx config and permissions
+USER root
+COPY nginx.conf /etc/nginx/nginx.conf
+RUN chown -R user:user /var/log/nginx && \
+    chown -R user:user /var/lib/nginx && \
+    chmod 755 /var/log/nginx
+
+# HF Spaces requires UID 1000 — drop back to the non-root user for runtime
+USER user
+
 ENV GAZET_DATA_DIR=$HOME/app/data \
     LLAMA_SERVER_URL=http://localhost:9000 \
     GAZET_API_URL=http://localhost:8000 \
+    GAZET_PUBLIC_API_URL=/api \
     PATH="$HOME/app/.venv/bin:$PATH"
 
 EXPOSE 7860

docker-compose.yml

@@ -1,4 +1,14 @@
 services:
+  nginx:
+    image: nginx:alpine
+    volumes:
+      - ./nginx.local.conf:/etc/nginx/nginx.conf:ro
+    ports:
+      - "7860:7860"
+    depends_on:
+      - app
+      - demo
+
   llama:
     image: ghcr.io/ggml-org/llama.cpp:server
     volumes:

gazet_demo.py

@@ -141,6 +141,7 @@ def _render_map(geojson, placeholder):
 
 
 API = os.environ.get("GAZET_API_URL", "http://127.0.0.1:8000")
+PUBLIC_API_URL = os.environ.get("GAZET_PUBLIC_API_URL", API)
 PLAUSIBLE_SRC = os.environ.get(
     "PLAUSIBLE_SRC",
     "https://plausible.io/js/pa-rYXsbLvnb-tHwR72IDneF.js",
@@ -233,7 +234,7 @@ st.markdown(
 with st.sidebar:
     st.header("Learn how this was built")
     st.markdown(
-        """
+        f"""
 **Gazet** turns plain English questions into geometries on a map.
 
 ### Behind the scenes
@@ -271,6 +272,8 @@ The model queries two open geographic datasets:
   [developmentseed/gazet](https://huggingface.co/spaces/developmentseed/gazet)
 - Source code:
   [developmentseed/gazet](https://github.com/developmentseed/gazet)
+- API docs:
+  [{PUBLIC_API_URL}/docs]({PUBLIC_API_URL}/docs)
 
 ### Talk to us
 

nginx.conf

@@ -0,0 +1,52 @@
+worker_processes auto;
+pid /tmp/nginx.pid;
+error_log /var/log/nginx/error.log warn;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    access_log /var/log/nginx/access.log;
+
+    upstream api {
+        server 127.0.0.1:8000;
+    }
+
+    upstream streamlit {
+        server 127.0.0.1:8501;
+    }
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    server {
+        listen 7860;
+        server_name _;
+
+        location /api/ {
+            proxy_pass http://api/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_http_version 1.1;
+            # /search/stream emits NDJSON incrementally; buffering would hold it
+            # until the response completes, defeating the point of streaming.
+            proxy_buffering off;
+            proxy_read_timeout 600s;
+            proxy_send_timeout 600s;
+        }
+
+        location / {
+            proxy_pass http://streamlit;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_read_timeout 600s;
+            proxy_send_timeout 600s;
+        }
+    }
+}

nginx.local.conf

@@ -0,0 +1,52 @@
+worker_processes auto;
+pid /tmp/nginx.pid;
+error_log /var/log/nginx/error.log warn;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    access_log /var/log/nginx/access.log;
+
+    upstream api_backend {
+        server app:8000;
+    }
+
+    upstream streamlit_backend {
+        server demo:8501;
+    }
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    server {
+        listen 7860;
+        server_name _;
+
+        location /api/ {
+            proxy_pass http://api_backend/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_http_version 1.1;
+            # /search/stream emits NDJSON incrementally; buffering would hold it
+            # until the response completes, defeating the point of streaming.
+            proxy_buffering off;
+            proxy_read_timeout 600s;
+            proxy_send_timeout 600s;
+        }
+
+        location / {
+            proxy_pass http://streamlit_backend/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_read_timeout 600s;
+            proxy_send_timeout 600s;
+        }
+    }
+}

supervisord.conf

@@ -26,7 +26,7 @@ stderr_logfile_maxbytes=0
 startsecs=10
 
 [program:streamlit]
-command=%(ENV_HOME)s/app/.venv/bin/streamlit run gazet_demo.py --server.port 7860 --server.address 0.0.0.0
+command=%(ENV_HOME)s/app/.venv/bin/streamlit run gazet_demo.py --server.port 8501 --server.address 0.0.0.0
 directory=%(ENV_HOME)s/app
 autostart=true
 autorestart=true
@@ -35,3 +35,13 @@ stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 startsecs=15
+
+[program:nginx]
+command=nginx -g 'daemon off;'
+autostart=true
+autorestart=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+startsecs=2