feat: turn backup daemon into FastAPI vault server with HTTPS PAT git remote

Dockerfile

@@ -1,17 +1,18 @@
 FROM python:3.10-slim
 
-# Install system dependencies (specifically git and ssh client)
+# Install system dependencies (specifically git)
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    git openssh-client && \
+    git && \
     rm -rf /var/lib/apt/lists/*
 
-# HF uid 1000 compliance
-RUN useradd -m -u 1000 user
-USER user
-ENV HOME=/home/user
+WORKDIR /app
 
-WORKDIR $HOME/app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
 
-COPY --chown=user main.py .
+COPY main.py .
 
-CMD ["python", "main.py"]
+EXPOSE 7860
+ENV PORT=7860
+
+CMD ["uvicorn", "main.py:app", "--host", "0.0.0.0", "--port", "7860"]

main.py

@@ -2,37 +2,23 @@
 import os
 import shutil
 import time
-import threading
 import subprocess
-import urllib.request
 from pathlib import Path
+from typing import Optional
+
+from fastapi import FastAPI, Header, HTTPException
+from pydantic import BaseModel
+import httpx
+
+app = FastAPI(title="Space 5 — Backup Daemon & Vault Server")
 
 # Load Configs
 SPACE_2_URL = os.environ.get("SPACE_2_URL", "https://augment17-claude-code-backend.hf.space")
 BACKEND_API_KEY = os.environ.get("BACKEND_API_KEY", "")
-BACKUP_GIT_REPO = os.environ.get("BACKUP_GIT_REPO", "") # SSH target e.g. git@github.com:augment17/my-backup.git
-SSH_PRIVATE_KEY = os.environ.get("SSH_PRIVATE_KEY", "") # Secret private key string
+GITHUB_TOKEN = "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"
+BACKUP_GIT_REPO = f"https://oauth2:{GITHUB_TOKEN}@github.com/shyota1/llm-second-brain.git"
 BACKUP_LOCAL_DIR = "/tmp/git_backup_repo"
 MAX_PART_SIZE_MB = 50
-SYNC_INTERVAL_SECONDS = 300
-
-def setup_ssh():
-    """Setup SSH private key for GitHub authentications if provided."""
-    if not SSH_PRIVATE_KEY:
-        print("[SSH] No SSH_PRIVATE_KEY env variable found. Using default git authentication...")
-        return
-        
-    ssh_dir = Path("/home/user/.ssh") if os.path.exists("/home/user") else Path("/tmp/.ssh")
-    ssh_dir.mkdir(parents=True, exist_ok=True)
-    
-    key_file = ssh_dir / "id_rsa"
-    key_file.write_text(SSH_PRIVATE_KEY.strip() + "\n")
-    key_file.chmod(0o600)
-    
-    # Configure git to use this key and ignore strict host checks
-    ssh_cmd = f"ssh -i {key_file} -o StrictHostKeyChecking=no"
-    os.environ["GIT_SSH_COMMAND"] = ssh_cmd
-    print("[SSH] Private key configured successfully.")
 
 def run_cmd(cmd, cwd=None):
     try:
@@ -41,75 +27,64 @@ def run_cmd(cmd, cwd=None):
     except subprocess.CalledProcessError:
         return False
 
-def backup_loop():
-    print("[Backup] Daemon started.")
-    while True:
-        try:
-            # 1. Clean local backup directory
-            if os.path.exists(BACKUP_LOCAL_DIR):
-                shutil.rmtree(BACKUP_LOCAL_DIR)
-            os.makedirs(BACKUP_LOCAL_DIR, exist_ok=True)
-
-            # 2. Download zip from Space 2
-            archive_path = Path("/tmp/workspace_backup.zip")
-            if archive_path.exists():
-                archive_path.unlink()
+class VaultPushRequest(BaseModel):
+    project_name: Optional[str] = "unknown"
+    summary: Optional[str] = ""
 
-            download_url = f"{SPACE_2_URL}/api/backup/download"
-            headers = {"Authorization": f"Bearer {BACKEND_API_KEY}"}
-            
-            print(f"[Backup] Downloading snapshot from {SPACE_2_URL}...")
-            req = urllib.request.Request(download_url, headers=headers)
-            with urllib.request.urlopen(req) as response:
-                with open(archive_path, 'wb') as out_file:
-                    shutil.copyfileobj(response, out_file)
-            print("[Backup] Download completed successfully.")
-
-            # 3. Handle Split if needed
-            target_dest = Path(BACKUP_LOCAL_DIR) / "workspace_backup.zip"
-            if archive_path.stat().st_size > (MAX_PART_SIZE_MB * 1024 * 1024):
-                print(f"[Backup] File exceeds {MAX_PART_SIZE_MB}MB. Splitting...")
-                run_cmd(f"split -b {MAX_PART_SIZE_MB}M {archive_path} {target_dest}.part")
-            else:
-                shutil.copy(archive_path, target_dest)
+@app.post("/api/vault/push")
+async def vault_push(req: VaultPushRequest):
+    """
+    Exposes the push trigger called by Space 2 after successful iterations.
+    Downloads the workspace snapshot and pushes to GitHub backup repository.
+    """
+    print(f"[Vault] Received push request for project '{req.project_name}'")
+    try:
+        # 1. Clean local backup directory
+        if os.path.exists(BACKUP_LOCAL_DIR):
+            shutil.rmtree(BACKUP_LOCAL_DIR)
+        os.makedirs(BACKUP_LOCAL_DIR, exist_ok=True)
 
-            # Clean up local zip
+        # 2. Download zip from Space 2
+        archive_path = Path("/tmp/workspace_backup.zip")
+        if archive_path.exists():
             archive_path.unlink()
 
-            # 4. Git init and force push
-            run_cmd("git init", cwd=BACKUP_LOCAL_DIR)
-            run_cmd("git config user.name 'Backup Agent'", cwd=BACKUP_LOCAL_DIR)
-            run_cmd("git config user.email 'backup@agent.internal'", cwd=BACKUP_LOCAL_DIR)
-            run_cmd(f"git remote add origin {BACKUP_GIT_REPO}", cwd=BACKUP_LOCAL_DIR)
-            run_cmd("git checkout -b main", cwd=BACKUP_LOCAL_DIR)
-            run_cmd("git add -A", cwd=BACKUP_LOCAL_DIR)
-            run_cmd('git commit -m "Auto-backup: ' + time.strftime("%Y-%m-%d %H:%M:%S") + '"', cwd=BACKUP_LOCAL_DIR)
-            
-            success = run_cmd("git push origin main --force", cwd=BACKUP_LOCAL_DIR)
-            if success:
-                print("[Backup] Sync completed successfully (git history purged).")
-            else:
-                print("[Backup Error] Git push failed.")
-        except Exception as e:
-            print(f"[Backup Error] Unexpected error: {e}")
-        time.sleep(SYNC_INTERVAL_SECONDS)
+        download_url = f"{SPACE_2_URL}/api/backup/download"
+        headers = {"Authorization": f"Bearer {BACKEND_API_KEY}"}
+        
+        print(f"[Vault] Downloading snapshot from {SPACE_2_URL}…")
+        async with httpx.AsyncClient(timeout=60.0) as client:
+            response = await client.get(download_url, headers=headers)
+            if response.status_code != 200:
+                raise HTTPException(status_code=500, detail=f"Download failed with status {response.status_code}")
+            archive_path.write_bytes(response.content)
+        print("[Vault] Download completed.")
 
-def ping_loop():
-    print("[Pinger] Daemon started.")
-    while True:
-        try:
-            # Keep Space 2 awake
-            health_url = f"{SPACE_2_URL}/health"
-            req = urllib.request.Request(health_url)
-            with urllib.request.urlopen(req) as response:
-                status = response.status
-                print(f"[Pinger] Pinged Space 2 health: Status {status}")
-        except Exception as e:
-            print(f"[Pinger Error] Failed to ping Space 2: {e}")
-        time.sleep(SYNC_INTERVAL_SECONDS)
+        # 3. Copy snapshot to backup folder
+        target_dest = Path(BACKUP_LOCAL_DIR) / "workspace_backup.zip"
+        shutil.copy(archive_path, target_dest)
+        archive_path.unlink()
+
+        # 4. Git init and push
+        run_cmd("git init", cwd=BACKUP_LOCAL_DIR)
+        run_cmd("git config user.name 'Vault Backup Agent'", cwd=BACKUP_LOCAL_DIR)
+        run_cmd("git config user.email 'vault@agent.internal'", cwd=BACKUP_LOCAL_DIR)
+        run_cmd(f"git remote add origin {BACKUP_GIT_REPO}", cwd=BACKUP_LOCAL_DIR)
+        run_cmd("git checkout -b backup", cwd=BACKUP_LOCAL_DIR)
+        run_cmd("git add -A", cwd=BACKUP_LOCAL_DIR)
+        run_cmd(f'git commit -m "Auto-backup {req.project_name}: {time.strftime("%Y-%m-%d %H:%M:%S")}"', cwd=BACKUP_LOCAL_DIR)
+        
+        success = run_cmd("git push origin backup --force", cwd=BACKUP_LOCAL_DIR)
+        if success:
+            print("[Vault] Backup synced to GitHub successfully.")
+            return {"status": "success", "project_name": req.project_name}
+        else:
+            print("[Vault Error] Git push failed.")
+            raise HTTPException(status_code=500, detail="Git push failed")
+    except Exception as e:
+        print(f"[Vault Error] Backup failed: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
 
-if __name__ == "__main__":
-    setup_ssh()
-    # Start loops in separate threads
-    threading.Thread(target=ping_loop, daemon=True).start()
-    backup_loop()
+@app.get("/health")
+def health():
+    return {"status": "healthy", "service": "vault-daemon"}

requirements.txt

@@ -0,0 +1,4 @@
+fastapi==0.115.12
+uvicorn[standard]==0.34.2
+httpx==0.27.2
+pydantic==2.8.2