Run FastAPI + Gradio together in one HF Space

Dockerfile

@@ -5,21 +5,14 @@ WORKDIR /app
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1
 
-# Install uv
 RUN pip install --no-cache-dir uv
 
-# Copy dependency metadata first (better caching)
 COPY pyproject.toml uv.lock ./
-
-# Install dependencies into the system interpreter
 RUN uv sync --frozen --no-dev
 
-# Copy application code
-COPY main.py README.md ./
-# If you have other files later, copy them too:
-# COPY . .
+COPY main.py app_gradio.py start.sh README.md ./
+RUN chmod +x /app/start.sh
 
-# HF Spaces uses $PORT (usually 7860)
 EXPOSE 7860
 
-CMD ["bash", "-lc", "uv run uvicorn main:app --host 0.0.0.0 --port ${PORT:-7860}"]
+CMD ["/app/start.sh"]

README.md

@@ -5,70 +5,81 @@ colorFrom: yellow
 colorTo: purple
 sdk: docker
 pinned: false
-short_description: "Simple secret storage API (FastAPI + Postgres)"
+short_description: "Secret storage with a minimal UI (Gradio) + API (FastAPI)"
 ---
 
-# Keyvault (FastAPI)
+# Keyvault (FastAPI + Gradio)
 
-A small **Key Vault API** for storing and retrieving secrets backed by a **PostgreSQL** database.
+This repo runs **one Hugging Face Space** that serves:
 
-## What you get
+- **Gradio UI** (public on port 7860 / `$PORT`)
+- **FastAPI API** (inside the same container on `127.0.0.1:8000`)
 
-- FastAPI REST API
-- Stores secrets in Postgres (via SQLAlchemy)
-- Loads configuration from environment variables (`DATABASE_URL`)
+The UI calls the API internally.
+
+## Endpoints (API)
+
+FastAPI routes (available inside the Space container, and available publicly via the Space URL):
+
+- `GET /` (help)
+- `GET /health`
+- `GET /secrets`
+- `GET /secrets/keys`
+- `GET /secrets/{key}`
+- `GET /secrets/{key}/full`
+- `PUT /secrets/{key}`
+- `POST /secrets`
+- `DELETE /secrets/{key}`
+- `GET /secrets/{key}/history`
+- `GET /audit`
+- `GET /stats`
+
+Swagger:
+
+- Local: `http://127.0.0.1:8000/docs`
+- On Spaces: `https://<your-space>.hf.space/docs`
 
 ## Run locally (Mac)
 
-### 1) Create `.env`
+### 1) Set DATABASE_URL
 
-Create a file named `.env` in the project root:
+Create `.env`:
 
 ```bash
 DATABASE_URL=postgresql+psycopg2://USER:PASSWORD@HOST:PORT/DBNAME?sslmode=require
 ```
 
-> Don’t commit `.env` (it’s ignored by `.gitignore`).
-
-### 2) Install + run (using uv)
+### 2) Install
 
 ```bash
 uv sync
-uv run uvicorn main:app --reload --host 127.0.0.1 --port 8000
 ```
 
-Open:
-
-- Swagger docs: http://127.0.0.1:8000/docs
-
-## Deploy on Hugging Face Spaces (Docker)
-
-### 1) Add secret in Spaces
-
-In your Space: **Settings → Repository secrets**
-
-- `DATABASE_URL` = your Postgres connection string
+### 3) Run API + UI together
 
-Do **not** upload your `.env` file.
+```bash
+chmod +x start.sh
+./start.sh
+```
 
-### 2) Docker / runtime
+- UI: http://127.0.0.1:7860
+- API docs: http://127.0.0.1:8000/docs
 
-This Space uses Docker and starts with:
+## Deploy on Hugging Face Spaces (Docker)
 
-- Host: `0.0.0.0`
-- Port: `$PORT` (Spaces provides this, usually `7860`)
+### 1) Add Space secret
 
-Once deployed, you can access:
+Space → **Settings → Repository secrets**:
 
-- `/docs` (Swagger UI)
-- `/health` (if implemented in `main.py`)
+- `DATABASE_URL` = your Postgres URL
 
-## Environment variables
+### 2) URLs on Spaces
 
-- `DATABASE_URL` (required): SQLAlchemy connection string for Postgres
+- UI: `https://<your-space>.hf.space/`
+- API docs: `https://<your-space>.hf.space/docs`
+- OpenAPI: `https://<your-space>.hf.space/openapi.json`
 
-Example:
+## Security note
 
-```text
-postgresql+psycopg2://avnadmin:password@your-host:26779/vault?sslmode=require
-```
+This is a demo vault. Secrets are stored in plaintext in the database.
+Do not use for real production secrets without encryption + auth.

app_gradio.py

@@ -0,0 +1,130 @@
+import os
+import requests
+import gradio as gr
+
+DEFAULT_BASE_LOCAL = "http://127.0.0.1:8000"
+DEFAULT_BASE_SPACE_INTERNAL = "http://127.0.0.1:8000"
+
+# If KEYVAULT_BASE_URL is not set, assume API is running in the same container
+BASE_URL = os.getenv("KEYVAULT_BASE_URL", DEFAULT_BASE_SPACE_INTERNAL).rstrip("/")
+
+
+def _url(path: str) -> str:
+    return f"{BASE_URL}{path}"
+
+
+def ping():
+    r = requests.get(_url("/health"), timeout=20)
+    r.raise_for_status()
+    return r.json()
+
+
+def list_keys():
+    r = requests.get(_url("/secrets/keys"), timeout=20)
+    r.raise_for_status()
+    return r.json()
+
+
+def get_secret(key: str):
+    if not key:
+        return {"error": "key required"}
+    r = requests.get(_url(f"/secrets/{key}"), timeout=20)
+    if r.status_code >= 400:
+        return {"error": r.text}
+    return r.json()
+
+
+def put_secret(key: str, value: str, description: str):
+    if not key:
+        return {"error": "key required"}
+    payload = {"value": value, "description": (description or None)}
+    r = requests.put(_url(f"/secrets/{key}"), json=payload, timeout=20)
+    if r.status_code >= 400:
+        return {"error": r.text}
+    return r.json()
+
+
+def delete_secret(key: str):
+    if not key:
+        return {"error": "key required"}
+    r = requests.delete(_url(f"/secrets/{key}"), timeout=20)
+    if r.status_code >= 400:
+        return {"error": r.text}
+    return r.json()
+
+
+def audit(limit: int, key_filter: str):
+    params = {"limit": int(limit)}
+    if key_filter:
+        params["key"] = key_filter
+    r = requests.get(_url("/audit"), params=params, timeout=20)
+    r.raise_for_status()
+    return r.json()
+
+
+def stats():
+    r = requests.get(_url("/stats"), timeout=20)
+    r.raise_for_status()
+    return r.json()
+
+
+with gr.Blocks(title="Keyvault UI") as blocks:
+    gr.Markdown("# Keyvault UI (Gradio)\nConsumes the Keyvault FastAPI endpoints.")
+
+    with gr.Row():
+        base = gr.Textbox(
+            label="API Base URL (set KEYVAULT_BASE_URL env var to override)",
+            value=BASE_URL,
+            interactive=False,
+        )
+
+    with gr.Row():
+        btn_ping = gr.Button("Health")
+        out_ping = gr.JSON(label="Health")
+    btn_ping.click(fn=ping, outputs=out_ping)
+
+    gr.Markdown("## Secrets")
+    with gr.Row():
+        btn_keys = gr.Button("List keys")
+        out_keys = gr.JSON(label="Keys")
+    btn_keys.click(fn=list_keys, outputs=out_keys)
+
+    with gr.Row():
+        in_key = gr.Textbox(label="Key", placeholder="e.g. STRIPE_API_KEY")
+    with gr.Row():
+        btn_get = gr.Button("Get secret")
+        out_get = gr.JSON(label="Get result")
+    btn_get.click(fn=get_secret, inputs=in_key, outputs=out_get)
+
+    with gr.Row():
+        in_value = gr.Textbox(label="Value", placeholder="secret value", lines=2)
+        in_desc = gr.Textbox(label="Description (optional)", placeholder="what is this secret?")
+    with gr.Row():
+        btn_put = gr.Button("Create/Update (PUT)")
+        out_put = gr.JSON(label="PUT result")
+    btn_put.click(fn=put_secret, inputs=[in_key, in_value, in_desc], outputs=out_put)
+
+    with gr.Row():
+        btn_del = gr.Button("Delete")
+        out_del = gr.JSON(label="Delete result")
+    btn_del.click(fn=delete_secret, inputs=in_key, outputs=out_del)
+
+    gr.Markdown("## Audit + Stats")
+    with gr.Row():
+        in_limit = gr.Slider(1, 2000, value=200, step=1, label="Audit limit")
+        in_key_filter = gr.Textbox(label="Filter by key (optional)")
+    with gr.Row():
+        btn_audit = gr.Button("Get audit logs")
+        out_audit = gr.JSON(label="Audit")
+    btn_audit.click(fn=audit, inputs=[in_limit, in_key_filter], outputs=out_audit)
+
+    with gr.Row():
+        btn_stats = gr.Button("Stats")
+        out_stats = gr.JSON(label="Stats")
+    btn_stats.click(fn=stats, outputs=out_stats)
+
+
+if __name__ == "__main__":
+    # HF Spaces requires 0.0.0.0 and PORT; local will default to 7860
+    port = int(os.getenv("PORT", "7860"))
+    blocks.launch(server_name="0.0.0.0", server_port=port)

pyproject.toml

@@ -11,4 +11,6 @@ dependencies = [
     "python-dotenv>=1.2.2",
     "sqlalchemy>=2.0.48",
     "uvicorn>=0.42.0",
+    "gradio>=5.0.0",
+    "requests>=2.31.0",
 ]

start.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+API_HOST="${API_HOST:-127.0.0.1}"
+API_PORT="${API_PORT:-8000}"
+UI_HOST="${UI_HOST:-0.0.0.0}"
+UI_PORT="${PORT:-7860}"
+
+: "${DATABASE_URL:?DATABASE_URL is not set. Add it as a Hugging Face Space Secret (Settings → Repository secrets).}"
+
+echo "Starting FastAPI on http://${API_HOST}:${API_PORT} ..."
+uv run uvicorn main:app --host "${API_HOST}" --port "${API_PORT}" &
+API_PID=$!
+
+cleanup() {
+  echo "Stopping FastAPI..."
+  kill "${API_PID}" 2>/dev/null || true
+}
+trap cleanup EXIT
+
+echo "Starting Gradio UI on http://${UI_HOST}:${UI_PORT} (API -> http://${API_HOST}:${API_PORT}) ..."
+export KEYVAULT_BASE_URL="http://${API_HOST}:${API_PORT}"
+uv run python app_gradio.py