Backend Space: build-time clone of private source (no source in repo)

Dockerfile

@@ -0,0 +1,34 @@
+# syntax=docker/dockerfile:1
+FROM python:3.12-slim
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends build-essential curl ca-certificates git \
+ && rm -rf /var/lib/apt/lists/*
+
+# Hugging Face runs Spaces as uid 1000.
+RUN useradd -m -u 1000 user
+ENV HOME=/home/user \
+    PATH=/home/user/.local/bin:/app/.venv/bin:$PATH \
+    PYTHONUNBUFFERED=1 \
+    UV_LINK_MODE=copy \
+    UV_PROJECT_ENVIRONMENT=/app/.venv
+
+RUN mkdir -p /app && chown user:user /app
+USER user
+WORKDIR /app
+
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh
+
+# Pull the private backend source at BUILD time using the GH_TOKEN build secret.
+# Nothing sensitive (and no app source) is persisted in this public Space repo.
+RUN --mount=type=secret,id=GH_TOKEN,uid=1000 \
+    git clone --depth 1 "https://x-access-token:$(cat /run/secrets/GH_TOKEN)@github.com/henryle97/teaching-bot" /tmp/src \
+ && cp -r /tmp/src/backend/app /tmp/src/backend/engine /tmp/src/backend/worker \
+          /tmp/src/backend/pyproject.toml /tmp/src/backend/uv.lock /app/ \
+ && rm -rf /tmp/src
+
+RUN uv sync --frozen --no-install-project
+
+COPY --chown=user:user start.sh /app/start.sh
+EXPOSE 7860
+CMD ["bash", "start.sh"]

README.md

@@ -0,0 +1,16 @@
+---
+title: Teaching Bot API
+emoji: 📚
+colorFrom: indigo
+colorTo: pink
+sdk: docker
+app_port: 7860
+pinned: false
+---
+
+# Teaching-Bot — backend (API + worker)
+
+FastAPI API + Arq worker in one always-on container. The application source is
+**not** stored here — it is cloned from a private repository at build time via a
+build secret (`GH_TOKEN`). Postgres on Supabase, Redis on Upstash. Runtime config
+comes from Space **secrets**. Frontend lives on Vercel.

start.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Run the Arq worker and the FastAPI API in one container. If either exits, the
+# script exits non-zero so the Space restarts the container (crash recovery).
+set -uo pipefail
+arq worker.arq_worker.WorkerSettings &
+WORKER=$!
+uvicorn app.main:app --host 0.0.0.0 --port 7860 &
+API=$!
+wait -n
+echo "[start.sh] a process exited — stopping container for restart"
+kill "$WORKER" "$API" 2>/dev/null || true
+exit 1