Deploy HF RL Explorer

app/admin_app.py

@@ -42,6 +42,26 @@ def _startup() -> None:
     threading.Thread(target=lambda: catalog.environments(include_hidden=True), daemon=True, name="warm").start()
 
 
+@app.get("/healthz", include_in_schema=False)
+def healthz():
+    """Alive: the process answers."""
+    return {"ok": True}
+
+
+@app.get("/readyz", include_in_schema=False)
+def readyz():
+    """Ready: the bucket it keeps the settings in is mounted and writable (this app runs no rollouts or indexes)."""
+    from fastapi.responses import JSONResponse
+
+    try:
+        settings.DIR.mkdir(parents=True, exist_ok=True)
+        (settings.DIR / ".ready").write_text("ok")
+        store = "ok"
+    except OSError as e:
+        store = f"unwritable: {type(e).__name__}"
+    return JSONResponse({"ok": store == "ok", "store": store}, status_code=200 if store == "ok" else 503)
+
+
 @app.get("/api/me")
 def me(request: Request):
     u = auth.current_user(request)

scripts/deploy_spaces.py

@@ -36,7 +36,7 @@ SPACES = {
     },
     "admin": {
         "repo": "FineEnvs/RL-Explorer-admin", "private": True, "readme": "ADMIN_SPACE_README.md", "hardware": "cpu-basic",
-        "variables": {"RLX_APP": "app.admin_app:app", "RLX_OAUTH_SCOPES": "openid profile", "RLX_EXPLORER_URL": EXPLORER_URL},
+        "variables": {"RLX_APP": "app.admin_app:app", "RLX_OAUTH_SCOPES": "openid profile read-memberships", "RLX_EXPLORER_URL": EXPLORER_URL},
         "volumes": [DATA],
     },
 }

scripts/schedule_indexer.py

@@ -52,7 +52,8 @@ APP_DIR = "/home/user/app"   # the Dockerfile's WORKDIR
 
 def spec(args: argparse.Namespace) -> dict:
     run = (f"cd {APP_DIR} && exec uv run --frozen --no-dev python -m app.indexer --store /data "
-           f"--budget-min {args.budget_min:g} --max-builds {args.max_builds} --keep {args.keep} --use-token")
+           f"--budget-min {args.budget_min:g} --max-builds {args.max_builds} --keep {args.keep}"
+           + (" --use-token" if args.with_token else ""))
     return {
         "namespace": args.namespace,
         "name": args.name,
@@ -63,7 +64,9 @@ def spec(args: argparse.Namespace) -> dict:
         "flavor": args.flavor,
         "timeout": args.timeout,
         "env": {"STORAGE_DIR": "/data", "RLX_CACHE_DIR": "/tmp/rlx-cache", "HF_HOME": "/tmp/hf-home", "PYTHONUNBUFFERED": "1"},
-        "secrets": ["HF_TOKEN"],
+        # anonymous by default: public datasets need no token. --with-token sends RLX_INDEXER_TOKEN (a read-only token
+        # made for this) as HF_TOKEN, for the Hub's higher rate limits; never your login token, which can write
+        "secrets": ["HF_TOKEN"] if args.with_token else [],
         "volumes": [{"type": "bucket", "source": args.bucket, "mount_path": "/data"}],
         "labels": {"app": "rl-explorer", "role": "indexer"},
     }
@@ -87,10 +90,16 @@ def cli(s: dict) -> str:
 def apply(s: dict, replace: bool) -> int:
     from huggingface_hub import HfApi, Volume, get_token
 
+    import os
+
     token = get_token()
     if not token:
         print("No HF token: run `hf auth login` (a token that can create Jobs in the FineEnvs organization).", file=sys.stderr)
         return 2
+    job_token = os.environ.get("RLX_INDEXER_TOKEN")
+    if s["secrets"] and not job_token:
+        print("--with-token needs RLX_INDEXER_TOKEN: a read-only token made for the indexer (not your login token).", file=sys.stderr)
+        return 2
     api = HfApi(token=token)
     existing = [j for j in api.list_scheduled_jobs(namespace=s["namespace"], labels={"name": s["name"]})]
     if existing and not replace:
@@ -102,7 +111,7 @@ def apply(s: dict, replace: bool) -> int:
         print(f"deleted scheduled Job {j.id}")
     job = api.create_scheduled_job(
         image=s["image"], command=s["command"], schedule=s["schedule"], concurrency=s["concurrency"], env=s["env"],
-        secrets={k: token for k in s["secrets"]}, flavor=s["flavor"], timeout=s["timeout"], name=s["name"],
+        secrets={k: job_token for k in s["secrets"]} or None, flavor=s["flavor"], timeout=s["timeout"], name=s["name"],
         labels=s["labels"], volumes=[Volume(**v) for v in s["volumes"]], namespace=s["namespace"])
     print(f"created scheduled Job {job.id} ({s['schedule']}); runs: hf jobs scheduled inspect {job.id} --namespace {s['namespace']}")
     return 0
@@ -112,6 +121,7 @@ def main(argv: list[str] | None = None) -> int:
     ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
     ap.add_argument("--apply", action="store_true", help="create the scheduled Job (otherwise only print it)")
     ap.add_argument("--replace", action="store_true", help="with --apply: delete a scheduled Job of the same name first")
+    ap.add_argument("--with-token", action="store_true", help="send RLX_INDEXER_TOKEN (a read-only token) as the Job's HF_TOKEN")
     ap.add_argument("--namespace", default=NAMESPACE)
     ap.add_argument("--name", default=NAME)
     ap.add_argument("--image", default=IMAGE, help="a Docker image with this app: the explorer Space's, by default")

tests/test_security.py

@@ -545,3 +545,10 @@ def test_a_rollout_never_downloads_reference_solutions(monkeypatch):
     for f in ("tasks/t1/solution/solve.sh", "tasks/t1/steps/s1/solution/solve.sh", "tasks/t1/steps/two/solution/deep/x.py"):
         assert any(fnmatch(f, p) for p in seen["ignore_patterns"]), f
     assert not any(fnmatch("tasks/t1/steps/s1/instruction.md", p) for p in seen["ignore_patterns"])
+
+
+def test_the_admin_space_has_health_checks_and_nothing_else_open():
+    assert admin.get("/healthz").json() == {"ok": True}
+    r = admin.get("/readyz")
+    assert r.status_code == 200 and r.json()["store"] == "ok"
+    assert admin.get("/api/admin/settings").status_code == 401