Run all 3 backend servers in-container behind a single API-key gateway

The HF Space previously ran only Chrome + extensions + monitor; the ChatGPT/
Gemini/Flow API servers existed only in docker-compose (self-host). Because the
extensions dial their servers on hardcoded 127.0.0.1:9225/9226/9227, the servers
must share Chrome's localhost — a separate Space can't reach them. So:

- Dockerfile builds the chatgpt (Go) + gemini (Go) binaries and installs the flow
(Python/FastAPI) deps into the chrome image.
- start_hf.sh launches all three on localhost alongside Chrome.
- monitor/main.go doubles as a reverse-proxy gateway on :3001, routing /gpt /gemini
/flow to 127.0.0.1:9225/8000/8101, gated by an API_KEY bearer token (fail-closed).
- docker-compose.yml collapses to the single chrome service (servers are now baked in;
separate containers would collide on the same ports).
- Add cryptography to flow requirements (lazy-imported in cli/api.py).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -10,6 +10,18 @@ WORKDIR /src
 COPY profilesync/ ./
 RUN go mod tidy && CGO_ENABLED=0 go build -ldflags="-s -w" -o /profilesync .
 
+# Build the ChatGPT API server (talks to gpt-extension on 127.0.0.1:9225).
+FROM golang:1.26-bookworm AS chatgpt-build
+WORKDIR /src
+COPY chatgpt-free-api/ ./
+RUN go mod download && CGO_ENABLED=0 go build -ldflags="-s -w" -o /agent .
+
+# Build the Gemini API server (talks to gemini-extension on 127.0.0.1:9226).
+FROM golang:1.26-bookworm AS gemini-build
+WORKDIR /src
+COPY free-gemini-api/ ./
+RUN go mod download && CGO_ENABLED=0 go build -ldflags="-s -w" -o /free-gemini-api .
+
 FROM akashyadav758/chrome:latest
 
 USER root
@@ -25,6 +37,17 @@ COPY --from=monitor-build /monitor /opt/monitor3/monitor
 # Profile-sync binary (Chrome profile <-> Postgres snapshot)
 COPY --from=profilesync-build /profilesync /opt/profilesync/profilesync
 
+# Backend API servers (run on localhost; the monitor gateway fronts them).
+COPY --from=chatgpt-build /agent /opt/chatgpt/agent
+COPY chatgpt-free-api/config.json /opt/chatgpt/config.json
+COPY --from=gemini-build /free-gemini-api /opt/gemini-srv/free-gemini-api
+COPY flow-agent/ /opt/flow-srv/
+
+# Flow server is Python (FastAPI/uvicorn). Base image has python3; add pip + deps.
+RUN apt-get update && apt-get install -y --no-install-recommends python3-pip && \
+    pip3 install --no-cache-dir --break-system-packages -r /opt/flow-srv/requirements.txt && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
+
 # Install Chrome for Testing (unbranded). Branded google-chrome-stable (>=128)
 # silently ignores --load-extension, so unpacked extensions never load. CfT is the
 # unbranded build of the same Chrome version where --load-extension still works.
@@ -38,8 +61,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends unzip && \
 
 # Set correct permissions and ownership
 RUN rm -rf /opt/flow-extension/_metadata && \
-    chown -R 1000:1000 /opt/gpt-extension /opt/gemini-extension /opt/flow-extension /opt/chrome-linux64 /opt/monitor3 /opt/profilesync && \
-    chmod -R 755 /opt/gpt-extension /opt/gemini-extension /opt/flow-extension /opt/chrome-linux64 /opt/monitor3 /opt/profilesync
+    chown -R 1000:1000 /opt/gpt-extension /opt/gemini-extension /opt/flow-extension /opt/chrome-linux64 /opt/monitor3 /opt/profilesync /opt/chatgpt /opt/gemini-srv /opt/flow-srv && \
+    chmod -R 755 /opt/gpt-extension /opt/gemini-extension /opt/flow-extension /opt/chrome-linux64 /opt/monitor3 /opt/profilesync /opt/chatgpt /opt/gemini-srv /opt/flow-srv
 
 # Replace the start script with the non-root version
 COPY --chmod=755 start_hf.sh /start.sh

README.md

@@ -46,10 +46,11 @@ run yourself — see each subproject's README for setup):
 | [`free-gemini-api`](free-gemini-api/README.md) | Go reverse-proxy | local server | Gemini text / Imagen 3 images / Gemini video |
 | [`flow-agent`](flow-agent/README.md) | Python FastAPI + CLI | `127.0.0.1:8100` | Google Flow T2V / V2V / I2V video + T2I / I2I images |
 
-> ⚠️ The HF Space builds **only the root `Dockerfile`** → it runs **the browser + the 3
-> extensions + the monitor**. It does **not** start the backend servers. To run the full
-> stack (browser **and** all three API servers sharing one loopback), use
-> `docker-compose.yml` for self-hosting — see [Self-hosting](#self-hosting-full-stack).
+> ✅ The HF Space now runs **all three servers in the same container** as Chrome, and the
+> monitor doubles as a **single API gateway** that fronts them on one public port — see
+> [API gateway](#api-gateway). (The extensions dial their servers on hardcoded
+> `127.0.0.1:9225/9226/9227`, so the servers *must* share Chrome's localhost — a separate
+> Space can't reach them.) `docker-compose.yml` does the same wiring for self-hosting.
 
 ---
 
@@ -171,13 +172,47 @@ exact UA — stays valid across the browser and the backend.
 
 | URL | Description |
 |-----|-------------|
-| `https://akash1313-selfapi.hf.space/` | Live Chrome monitor UI |
+| `https://akash1313-selfapi.hf.space/` | Live Chrome monitor UI (open, no key) |
 | `https://akash1313-selfapi.hf.space/chrome.log` | Streaming Chrome log (debugging) |
+| `https://akash1313-selfapi.hf.space/gpt/…` | ChatGPT API (gateway → `127.0.0.1:9225`) |
+| `https://akash1313-selfapi.hf.space/gemini/…` | Gemini API (gateway → `127.0.0.1:8000`) |
+| `https://akash1313-selfapi.hf.space/flow/…` | Flow API (gateway → `127.0.0.1:8101`) |
 | `127.0.0.1:9222` (in-container) | Chrome DevTools Protocol |
 | `:9223` | CDP proxied for external tools (via socat) |
 
 ---
 
+## API gateway
+
+The monitor (`monitor/main.go`) is also a reverse-proxy gateway: HF exposes only one public
+port (`3001`), so all three backend APIs are reached under one base URL by path prefix. The
+gateway strips the prefix and forwards to the server on localhost:
+
+| Prefix | Backend | Example endpoints |
+|--------|---------|-------------------|
+| `/gpt/` | chatgpt-free-api `:9225` | `/gpt/api/chat`, `/gpt/v1/chat/completions`, `/gpt/health` |
+| `/gemini/` | free-gemini-api `:8000` | `/gemini/chat`, `/gemini/status`, `/gemini/output/*` |
+| `/flow/` | flow-agent `:8101` | `/flow/generate/video`, `/flow/generate/image`, `/flow/health` |
+
+### Auth — required
+
+The three prefixes are gated by an **`API_KEY`** Space secret. Every request must send it as a
+Bearer token (or `?key=`). **Fail-closed:** if `API_KEY` is unset the gateway returns `503`, so
+the logged-in accounts are never accidentally exposed. The monitor UI (`/`, `/chrome.log`) stays
+open.
+
+1. Set the Space secret **`API_KEY`** (Settings → Variables and secrets) to a strong random string.
+2. Call it:
+   ```bash
+   curl -X POST https://akash1313-selfapi.hf.space/gpt/api/chat \
+     -H "Authorization: Bearer $API_KEY" \
+     -H "Content-Type: application/json" \
+     -d '{"message":"hello"}'
+   ```
+   No/!wrong key → `401`. Wrong path → forwarded to the backend (may `404` there).
+
+---
+
 ## Project layout
 
 ```

SETUP.md

@@ -52,3 +52,25 @@ HF free Spaces have **no permanent disk**, so there logins need a Postgres datab
 4. The Space restarts → **log in once** → it auto-saves every 5 min and survives rebuilds.
 
 > Deploy code to HF with `git push`. Never commit the connection string.
+
+---
+
+## Using the API
+
+All three servers run inside the container; the monitor fronts them on one URL by path:
+
+| Service | Base path | Example |
+|---------|-----------|---------|
+| ChatGPT | `/gpt/` | `POST /gpt/api/chat` |
+| Gemini | `/gemini/` | `POST /gemini/chat` |
+| Flow | `/flow/` | `POST /flow/generate/video` |
+
+**Set an `API_KEY` secret** (HF: Settings → secret `API_KEY`; Docker: add to `.env`) — every API
+call must send it:
+```bash
+curl -X POST https://YOUR-SPACE.hf.space/gpt/api/chat \
+  -H "Authorization: Bearer YOUR_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"message":"hello"}'
+```
+Without the key the API returns `401`/`503`. The monitor UI stays open (no key).

docker-compose.yml

@@ -1,13 +1,16 @@
-# Runs the headless Chrome + 3-tab monitor together with the three backend servers.
+# Runs the whole stack in one container: headless Chrome + 3 extensions + the monitor
+# (which also serves the API gateway) + the three backend servers.
 #
-# The server containers join the chrome container's network namespace
-# (network_mode: "service:chrome"), so they all share one 127.0.0.1 — exactly what the
-# extensions expect. Only the chrome service publishes ports.
+# The chrome image (built from ./Dockerfile) now bakes in all three servers and start_hf.sh
+# launches them on localhost alongside Chrome — exactly what the extensions expect (they dial
+# 127.0.0.1:9225/9226/9227). So there are no separate server containers anymore; that would
+# collide on the same ports. Only port 3001 is published.
 #
-# Port map (shared loopback):
-#   chrome   : 9222 CDP, 3001 monitor UI
-#   chatgpt  : 9225 (ws+http)
-#   gemini   : 8000 http, 9226 cookie-WS
+# Internal port map (all on the container's 127.0.0.1):
+#   chrome   : 9222 CDP, 9223 CDP-proxy
+#   monitor  : 3001 UI + API gateway (/gpt /gemini /flow)
+#   chatgpt  : 9225 (ws + http API)
+#   gemini   : 8000 http API, 9226 cookie-WS
 #   flow     : 8101 http API, 8100 ext-callback, 9227 cookie-WS
 
 services:
@@ -15,41 +18,13 @@ services:
     build: .
     platform: linux/amd64
     ports:
-      - "3001:3001"   # 3-tab monitor UI (also the only published port)
+      - "3001:3001"   # monitor UI + API gateway (the only published port)
+    environment:
+      API_KEY: ${API_KEY:-}   # gates /gpt /gemini /flow; from .env. Unset = APIs disabled (503)
     volumes:
       - chrome-profile:/home/chrome/data   # persists cookies/logins across restarts
     restart: unless-stopped
 
-  chatgpt:
-    build: ./chatgpt-free-api
-    platform: linux/amd64
-    network_mode: "service:chrome"
-    depends_on:
-      - chrome
-    restart: unless-stopped
-
-  gemini:
-    build: ./free-gemini-api
-    platform: linux/amd64
-    environment:
-      WS_PORT: "9226"
-      PORT: "8000"
-    network_mode: "service:chrome"
-    depends_on:
-      - chrome
-    restart: unless-stopped
-
-  flow:
-    build: ./flow-agent
-    platform: linux/amd64
-    environment:
-      WS_PORT: "9227"
-      HTTP_PORT: "8100"
-    network_mode: "service:chrome"
-    depends_on:
-      - chrome
-    restart: unless-stopped
-
 # Named volume keeps the Chrome profile (logins/cookies) across `docker compose down/up`
 # and host reboots — the self-host equivalent of HF persistent storage, no Postgres needed.
 volumes:

flow-agent/requirements.txt

@@ -2,3 +2,4 @@ websockets>=12.0
 fastapi>=0.100.0
 uvicorn>=0.22.0
 python-multipart>=0.0.6
+cryptography>=42.0      # lazy-imported in cli/api.py for self-signed cert generation

monitor/main.go

@@ -18,6 +18,8 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"net/http/httputil"
+	"net/url"
 	"os"
 	"sort"
 	"strings"
@@ -496,6 +498,62 @@ func statsHandler(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+// ---- API gateway ----------------------------------------------------------
+// The monitor doubles as the single public entry point for the three backend
+// servers that run on localhost inside this same container. HF exposes only one
+// port (3001), so /gpt, /gemini and /flow are reverse-proxied to the servers'
+// loopback HTTP ports. All three are gated by an API key (fail-closed).
+
+var apiKey = os.Getenv("API_KEY")
+
+// authOK enforces the API key on gateway routes. If API_KEY is unset it refuses
+// every call (503) so the logged-in accounts are never accidentally wide open.
+func authOK(w http.ResponseWriter, r *http.Request) bool {
+	if apiKey == "" {
+		http.Error(w, "gateway disabled: API_KEY not set on the server", http.StatusServiceUnavailable)
+		return false
+	}
+	got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+	if got == "" {
+		got = r.URL.Query().Get("key")
+	}
+	if got != apiKey {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return false
+	}
+	return true
+}
+
+// gatewayHandler builds an API-key-gated reverse proxy that strips prefix and
+// forwards to target (e.g. /gpt/api/chat -> http://127.0.0.1:9225/api/chat).
+func gatewayHandler(prefix, target string) http.HandlerFunc {
+	u, err := url.Parse(target)
+	if err != nil {
+		log.Fatalf("bad gateway target %q: %v", target, err)
+	}
+	proxy := &httputil.ReverseProxy{
+		Director: func(r *http.Request) {
+			r.URL.Scheme = u.Scheme
+			r.URL.Host = u.Host
+			r.Host = u.Host
+			p := strings.TrimPrefix(r.URL.Path, prefix)
+			if p == "" || p[0] != '/' {
+				p = "/" + p
+			}
+			r.URL.Path = p
+		},
+		ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
+			http.Error(w, "backend unavailable: "+err.Error(), http.StatusBadGateway)
+		},
+	}
+	return func(w http.ResponseWriter, r *http.Request) {
+		if !authOK(w, r) {
+			return
+		}
+		proxy.ServeHTTP(w, r)
+	}
+}
+
 func main() {
 	// Pre-open the known AI services in the background so they're ready by first view.
 	go func() {
@@ -534,6 +592,14 @@ func main() {
 	http.HandleFunc("/api/stats", statsHandler)
 	http.HandleFunc("/chrome.log", chromeLogHandler)
 
+	// API gateway → the three backend servers on localhost (API-key gated).
+	http.HandleFunc("/gpt/", gatewayHandler("/gpt", "http://127.0.0.1:9225"))
+	http.HandleFunc("/gemini/", gatewayHandler("/gemini", "http://127.0.0.1:8000"))
+	http.HandleFunc("/flow/", gatewayHandler("/flow", "http://127.0.0.1:8101"))
+	if apiKey == "" {
+		log.Println("WARNING: API_KEY not set — /gpt /gemini /flow are disabled (503) until it is set")
+	}
+
 	addr := ":3001"
 	if p := os.Getenv("MONITOR_PORT"); p != "" {
 		addr = ":" + p

start_hf.sh

@@ -106,6 +106,14 @@ touch /home/chrome/chrome.log
 echo "🔌 Starting CDP Proxy..."
 socat TCP-LISTEN:9223,fork,bind=0.0.0.0 TCP:127.0.0.1:9222 &
 
+# 6a. Start the three backend API servers on localhost. The monitor doubles as a
+#     gateway and fronts them on :3001 (/gpt, /gemini, /flow). Each logs separately
+#     and runs in the background so a crash never blocks the boot.
+echo "🧩 Starting backend API servers (gpt / gemini / flow)..."
+( cd /opt/chatgpt    && ./agent                                  >> /home/chrome/chatgpt.log 2>&1 & )
+( cd /opt/gemini-srv && WS_PORT=9226 PORT=8000 ./free-gemini-api >> /home/chrome/gemini.log  2>&1 & )
+( cd /opt/flow-srv   && WS_PORT=9227 HTTP_PORT=8100 python3 -m uvicorn cli.api:app --host 127.0.0.1 --port 8101 >> /home/chrome/flow.log 2>&1 & )
+
 # 6b. Periodic profile backup (safety net if HF kills the container without a clean
 #     SIGTERM). Best-effort every 5 minutes; the shutdown trap does the final one.
 if [ -n "$DATABASE_URL" ]; then