Deploy HF adapter from 81228e7b28a9d511f79b2f59b1c00ef60bcc9374

.env.example

@@ -0,0 +1,17 @@
+# Hugging Face Space runtime example for official Go Grok2API
+#
+# 用法：
+# 1. 写入 HF Storage：/data/config.yaml（推荐）
+# 2. 或用下面环境变量在首次启动时注入密钥
+# 3. 不要把真实密钥提交到 Git
+
+DATA_DIR=/data
+SERVER_PORT=7860
+GROK2API_CONFIG_SOURCE=/data/config.yaml
+
+# 首次 seed 配置时可选注入（之后以 /data/config.yaml 为准）
+# GROK2API_JWT_SECRET=  # openssl rand -hex 32
+# GROK2API_CREDENTIAL_ENCRYPTION_KEY=  # openssl rand -base64 32
+# GROK2API_ADMIN_USERNAME=admin
+# GROK2API_ADMIN_PASSWORD=replace_me
+# GROK2API_SECURE_COOKIES=true

Dockerfile

@@ -0,0 +1,70 @@
+# Hugging Face Space adapter for official chenyme/grok2api (Go + React rewrite).
+# Build always clones upstream; this Space repo only ships the adapter layer.
+
+ARG NODE_VERSION=22
+ARG GO_VERSION=1.26
+ARG ALPINE_VERSION=3.23
+ARG GROK2API_REPO=https://github.com/chenyme/grok2api.git
+ARG GROK2API_REF=main
+
+FROM alpine:${ALPINE_VERSION} AS src
+ARG GROK2API_REPO
+ARG GROK2API_REF
+RUN apk add --no-cache git ca-certificates \
+    && git clone --depth 1 --branch "${GROK2API_REF}" "${GROK2API_REPO}" /src \
+    && test -f /src/backend/go.mod \
+    && test -f /src/frontend/package.json \
+    && test -f /src/config.example.yaml \
+    && test -f /src/docker/entrypoint.sh
+
+FROM --platform=$BUILDPLATFORM node:${NODE_VERSION}-alpine AS frontend-builder
+WORKDIR /src/frontend
+RUN corepack enable
+COPY --from=src /src/frontend/package.json /src/frontend/pnpm-lock.yaml ./
+RUN pnpm config set store-dir /pnpm/store \
+    && pnpm fetch --frozen-lockfile \
+    && pnpm install --offline --frozen-lockfile
+COPY --from=src /src/frontend/index.html /src/frontend/vite.config.ts /src/frontend/tsconfig.json /src/frontend/tsconfig.app.json /src/frontend/tsconfig.node.json ./
+COPY --from=src /src/frontend/public ./public
+COPY --from=src /src/frontend/src ./src
+RUN pnpm build
+
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS backend-builder
+ARG TARGETOS
+ARG TARGETARCH
+WORKDIR /src/backend
+RUN apk add --no-cache ca-certificates git
+COPY --from=src /src/backend/go.mod /src/backend/go.sum ./
+RUN go mod download
+COPY --from=src /src/backend/cmd ./cmd
+COPY --from=src /src/backend/internal ./internal
+COPY --from=src /src/backend/docs/docs.go ./docs/docs.go
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} \
+    go build -buildvcs=false -trimpath -ldflags="-s -w" -o /out/grok2api ./cmd/grok2api
+
+FROM alpine:${ALPINE_VERSION}
+
+ENV TZ=Asia/Shanghai \
+    GROK2API_CONFIG_SOURCE=/data/config.yaml \
+    SERVER_PORT=7860
+
+RUN apk add --no-cache ca-certificates su-exec tzdata wget \
+    && addgroup -S -g 10001 grok2api \
+    && adduser -S -D -H -u 10001 -G grok2api grok2api \
+    && mkdir -p /app/data /app/frontend/dist /data /data/media /run/grok2api \
+    && chown -R grok2api:grok2api /app/data /data /run/grok2api
+
+WORKDIR /app
+
+COPY --from=backend-builder --chmod=0755 /out/grok2api /app/grok2api
+COPY --from=frontend-builder /src/frontend/dist /app/frontend/dist
+COPY --from=src /src/config.example.yaml /app/config.example.yaml
+COPY --chmod=0755 start.sh /usr/local/bin/hf-start.sh
+
+EXPOSE 7860
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+    CMD wget -qO- "http://127.0.0.1:${SERVER_PORT}/healthz" >/dev/null || exit 1
+
+ENTRYPOINT ["/usr/local/bin/hf-start.sh"]
+CMD ["/app/grok2api", "--config", "/app/config.yaml", "--listen", "0.0.0.0:7860"]

README.md

@@ -0,0 +1,59 @@
+---
+title: Grok2Api
+emoji: 🚀
+colorFrom: indigo
+colorTo: blue
+sdk: docker
+app_port: 7860
+pinned: false
+---
+
+# Grok2Api on Hugging Face Spaces
+
+Runs the official [chenyme/grok2api](https://github.com/chenyme/grok2api) **Go + React** gateway.
+
+## Build model
+
+- This Space repository only contains the HF adapter (`Dockerfile`, `start.sh`, this README, `.env.example`)
+- Docker build **clones upstream** `https://github.com/chenyme/grok2api` (`main`) and builds frontend + backend from that source
+- Local Python-era fork code is **not** used
+
+## Persistent storage
+
+Mount HF Storage (e.g. `DanielleNguyen/Grok2Api-storage`) to **`/data`**.
+
+| Path | Purpose |
+| --- | --- |
+| `/data/config.yaml` | Runtime config (seeded from upstream `config.example.yaml` on first boot) |
+| `/data/backend.db` | SQLite database |
+| `/data/media` | Local media files |
+| `/data/.env` | Optional env file loaded at start |
+
+## First boot secrets
+
+Edit `/data/config.yaml` (or set env vars **before** first seed):
+
+| Field / env | Notes |
+| --- | --- |
+| `secrets.jwtSecret` / `GROK2API_JWT_SECRET` | `openssl rand -hex 32` |
+| `secrets.credentialEncryptionKey` / `GROK2API_CREDENTIAL_ENCRYPTION_KEY` | `openssl rand -base64 32` (keep forever) |
+| `bootstrapAdmin.password` / `GROK2API_ADMIN_PASSWORD` | Strong admin password |
+| `auth.secureCookies` / `GROK2API_SECURE_COOKIES` | Prefer `true` on HTTPS Space |
+
+Service refuses insecure defaults if secrets are not replaced.
+
+## Service
+
+- Port: `7860` (Spaces requirement)
+- Health: `/healthz`
+- Admin UI: `/` (same origin as API)
+- API: `/v1/*` with `Authorization: Bearer g2a_...`
+
+## Deploy from GitHub
+
+Workflow `.github/workflows/deploy-hf.yml` syncs only `huggingface/*` to this Space.
+
+GitHub secrets:
+
+- `HF_TOKEN`
+- `HF_SPACE_ID` (e.g. `DanielleNguyen/Grok2Api`)

start.sh

@@ -0,0 +1,101 @@
+#!/bin/sh
+set -eu
+
+umask 077
+
+DATA_DIR="${DATA_DIR:-/data}"
+CONFIG_SOURCE="${GROK2API_CONFIG_SOURCE:-$DATA_DIR/config.yaml}"
+EXAMPLE_CONFIG="/app/config.example.yaml"
+APP_CONFIG="/app/config.yaml"
+LISTEN_ADDR="0.0.0.0:${SERVER_PORT:-7860}"
+
+mkdir -p "$DATA_DIR" "$DATA_DIR/media" /run/grok2api
+
+# Load optional env file first so secrets are available for seed/override.
+if [ -f "$DATA_DIR/.env" ]; then
+  set -a
+  # shellcheck disable=SC1090
+  . "$DATA_DIR/.env"
+  set +a
+fi
+
+apply_secret_overrides() {
+  target="$1"
+  [ -f "$target" ] || return 0
+
+  if [ -n "${GROK2API_JWT_SECRET:-}" ]; then
+    sed -i "s|jwtSecret: \".*\"|jwtSecret: \"${GROK2API_JWT_SECRET}\"|" "$target"
+  fi
+  if [ -n "${GROK2API_CREDENTIAL_ENCRYPTION_KEY:-}" ]; then
+    sed -i "s|credentialEncryptionKey: \".*\"|credentialEncryptionKey: \"${GROK2API_CREDENTIAL_ENCRYPTION_KEY}\"|" "$target"
+  fi
+  if [ -n "${GROK2API_ADMIN_USERNAME:-}" ]; then
+    sed -i "s|username: \".*\"|username: \"${GROK2API_ADMIN_USERNAME}\"|" "$target"
+  fi
+  if [ -n "${GROK2API_ADMIN_PASSWORD:-}" ]; then
+    sed -i "s|password: \".*\"|password: \"${GROK2API_ADMIN_PASSWORD}\"|" "$target"
+  fi
+  if [ -n "${GROK2API_SECURE_COOKIES:-}" ]; then
+    sed -i "s|secureCookies: .*|secureCookies: ${GROK2API_SECURE_COOKIES}|" "$target"
+  fi
+}
+
+seed_config() {
+  cp "$EXAMPLE_CONFIG" "$CONFIG_SOURCE"
+
+  sed -i \
+    -e 's|listen: "127.0.0.1:8000"|listen: "0.0.0.0:7860"|' \
+    -e 's|staticPath: "./frontend/dist"|staticPath: "/app/frontend/dist"|' \
+    -e 's|path: "./data/backend.db"|path: "'"$DATA_DIR"'/backend.db"|' \
+    -e 's|path: "./data/media"|path: "'"$DATA_DIR"'/media"|' \
+    "$CONFIG_SOURCE"
+
+  apply_secret_overrides "$CONFIG_SOURCE"
+  echo "Initialized HF runtime config at $CONFIG_SOURCE"
+}
+
+if [ ! -f "$CONFIG_SOURCE" ]; then
+  if [ ! -f "$EXAMPLE_CONFIG" ]; then
+    echo "missing example config: $EXAMPLE_CONFIG" >&2
+    exit 1
+  fi
+  seed_config
+else
+  # Re-apply Space secrets every boot so placeholder configs can be fixed without rebuild.
+  apply_secret_overrides "$CONFIG_SOURCE"
+fi
+
+# Fail fast with clear guidance if placeholders remain.
+if grep -q 'replace-with-at-least-32-characters' "$CONFIG_SOURCE" \
+  || grep -q 'replace-with-base64-key' "$CONFIG_SOURCE" \
+  || grep -q 'replace-with-a-strong-password' "$CONFIG_SOURCE"; then
+  cat >&2 <<'EOF'
+ERROR: /data/config.yaml still contains example secrets.
+
+Fix one of:
+1) Edit HF Storage file: /data/config.yaml
+   - secrets.jwtSecret
+   - secrets.credentialEncryptionKey
+   - bootstrapAdmin.password
+2) Or set Space Secrets, then restart:
+   - GROK2API_JWT_SECRET          (openssl rand -hex 32)
+   - GROK2API_CREDENTIAL_ENCRYPTION_KEY  (openssl rand -base64 32)
+   - GROK2API_ADMIN_PASSWORD
+EOF
+  exit 1
+fi
+
+cp "$CONFIG_SOURCE" "$APP_CONFIG"
+chown grok2api:grok2api "$APP_CONFIG" 2>/dev/null || true
+chmod 0600 "$APP_CONFIG" || true
+chown -R grok2api:grok2api "$DATA_DIR" 2>/dev/null || true
+
+if ! printf '%s' "$*" | grep -q -- '--listen'; then
+  set -- "$@" --listen "$LISTEN_ADDR"
+fi
+
+if command -v su-exec >/dev/null 2>&1 && id grok2api >/dev/null 2>&1; then
+  exec su-exec grok2api:grok2api "$@"
+fi
+
+exec "$@"