Upload start-space.sh with huggingface_hub

start-space.sh

@@ -0,0 +1,356 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ -n "${ADMIN_PASSWORD_V2:-}" ]; then
+  ADMIN_PASSWORD="$ADMIN_PASSWORD_V2"
+  echo "Admin password secret source: ADMIN_PASSWORD_V2"
+else
+  echo "Admin password secret source: ADMIN_PASSWORD"
+fi
+
+required_vars="ADMIN_PASSWORD JWT_SECRET TOTP_ENCRYPTION_KEY"
+
+for var_name in $required_vars; do
+  eval "var_value=\${$var_name:-}"
+  if [ -z "$var_value" ]; then
+    echo "Missing required secret: $var_name" >&2
+    exit 1
+  fi
+done
+
+ADMIN_EMAIL="${ADMIN_EMAIL:-2691539771@qq.com}"
+SERVER_PORT="${SERVER_PORT:-7860}"
+DATA_DIR="${DATA_DIR:-/tmp/gateway-data}"
+
+mkdir -p "$DATA_DIR" /tmp/gateway-redis /tmp/gateway-postgres
+chown -R sub2api:sub2api "$DATA_DIR" /tmp/gateway-redis
+chown -R postgres:postgres /tmp/gateway-postgres
+
+redis-server --daemonize yes --bind 127.0.0.1 --port 6379 --dir /tmp/gateway-redis --save "" --appendonly no
+
+if [ -z "${DATABASE_HOST:-}" ]; then
+  if [ ! -s /tmp/gateway-postgres/PG_VERSION ]; then
+    su-exec postgres initdb -D /tmp/gateway-postgres --auth=trust >/tmp/gateway-postgres-init.log
+  fi
+
+  su-exec postgres pg_ctl -D /tmp/gateway-postgres -l /tmp/gateway-postgres.log -o "-c listen_addresses=127.0.0.1 -c port=5432 -c unix_socket_directories=/tmp" start
+  createdb -h 127.0.0.1 -U postgres gatewaydb 2>/dev/null || true
+
+  DATABASE_HOST="127.0.0.1"
+  DATABASE_PORT="5432"
+  DATABASE_USER="postgres"
+  DATABASE_PASSWORD=""
+  DATABASE_DBNAME="gatewaydb"
+  DATABASE_SSLMODE="disable"
+  echo "Using ephemeral local PostgreSQL. Configure Supabase secrets for persistent data."
+else
+  DATABASE_PORT="${DATABASE_PORT:-5432}"
+  DATABASE_USER="${DATABASE_USER:-postgres}"
+  DATABASE_PASSWORD="${DATABASE_PASSWORD:-}"
+  DATABASE_DBNAME="${DATABASE_DBNAME:-postgres}"
+  DATABASE_SSLMODE="${DATABASE_SSLMODE:-require}"
+fi
+
+export AUTO_SETUP="${AUTO_SETUP:-true}"
+export ADMIN_EMAIL
+export ADMIN_PASSWORD
+export JWT_SECRET
+export TOTP_ENCRYPTION_KEY
+export DATA_DIR
+export DATABASE_HOST
+export DATABASE_PORT
+export DATABASE_USER
+export DATABASE_PASSWORD
+export DATABASE_DBNAME
+export DATABASE_SSLMODE
+export REDIS_HOST="${REDIS_HOST:-127.0.0.1}"
+export REDIS_PORT="${REDIS_PORT:-6379}"
+export SERVER_HOST="${SERVER_HOST:-0.0.0.0}"
+export SERVER_PORT
+export SERVER_MODE="${SERVER_MODE:-release}"
+export PORT="${PORT:-$SERVER_PORT}"
+export GIN_MODE="${GIN_MODE:-release}"
+
+migration_count() {
+  PGPASSWORD="${DATABASE_PASSWORD:-}" psql \
+    -h "$DATABASE_HOST" \
+    -p "$DATABASE_PORT" \
+    -U "$DATABASE_USER" \
+    -d "$DATABASE_DBNAME" \
+    -tAc "select count(1) from schema_migrations;" 2>/dev/null || printf '0\n'
+}
+
+sync_balance_cache_once() {
+  if [ "${BALANCE_CACHE_SYNC_ENABLED:-true}" != "true" ]; then
+    return 0
+  fi
+
+  rows="$(PGPASSWORD="${DATABASE_PASSWORD:-}" psql \
+    -h "$DATABASE_HOST" \
+    -p "$DATABASE_PORT" \
+    -U "$DATABASE_USER" \
+    -d "$DATABASE_DBNAME" \
+    -qAt \
+    -F '|' \
+    -c "select id, balance::double precision from users where deleted_at is null and status = 'active';" 2>/tmp/balance-cache-sync.err || true)"
+
+  if [ -z "$rows" ]; then
+    return 0
+  fi
+
+  ttl="${BALANCE_CACHE_SYNC_TTL_SECONDS:-300}"
+  printf '%s\n' "$rows" | while IFS='|' read -r user_id balance; do
+    case "$user_id" in
+      ''|*[!0-9]*) continue ;;
+    esac
+    if [ -n "${REDIS_PASSWORD:-}" ]; then
+      REDISCLI_AUTH="$REDIS_PASSWORD" redis-cli \
+        -h "${REDIS_HOST:-127.0.0.1}" \
+        -p "${REDIS_PORT:-6379}" \
+        -n "${REDIS_DB:-0}" \
+        SETEX "billing:balance:${user_id}" "$ttl" "$balance" >/dev/null 2>&1 || true
+    else
+      redis-cli \
+        -h "${REDIS_HOST:-127.0.0.1}" \
+        -p "${REDIS_PORT:-6379}" \
+        -n "${REDIS_DB:-0}" \
+        SETEX "billing:balance:${user_id}" "$ttl" "$balance" >/dev/null 2>&1 || true
+    fi
+  done
+}
+
+start_balance_cache_sync() {
+  if [ "${BALANCE_CACHE_SYNC_ENABLED:-true}" != "true" ]; then
+    return 0
+  fi
+
+  (
+    interval="${BALANCE_CACHE_SYNC_INTERVAL_SECONDS:-60}"
+    while :; do
+      sync_balance_cache_once || true
+      sleep "$interval"
+    done
+  ) &
+  echo "Balance cache sync loop started."
+}
+
+write_runtime_config() {
+  cat >"$DATA_DIR/config.yaml" <<EOF
+server:
+  host: "${SERVER_HOST}"
+  port: ${SERVER_PORT}
+  mode: "${SERVER_MODE}"
+database:
+  host: "${DATABASE_HOST}"
+  port: ${DATABASE_PORT}
+  user: "${DATABASE_USER}"
+  password: "${DATABASE_PASSWORD}"
+  dbname: "${DATABASE_DBNAME}"
+  sslmode: "${DATABASE_SSLMODE}"
+  max_open_conns: ${DATABASE_MAX_OPEN_CONNS:-10}
+  max_idle_conns: ${DATABASE_MAX_IDLE_CONNS:-4}
+  conn_max_lifetime_minutes: ${DATABASE_CONN_MAX_LIFETIME_MINUTES:-10}
+  conn_max_idle_time_minutes: ${DATABASE_CONN_MAX_IDLE_TIME_MINUTES:-5}
+redis:
+  host: "${REDIS_HOST}"
+  port: ${REDIS_PORT}
+  password: "${REDIS_PASSWORD:-}"
+  db: ${REDIS_DB:-0}
+  enable_tls: ${REDIS_ENABLE_TLS:-false}
+jwt:
+  secret: "${JWT_SECRET}"
+  expire_hour: ${JWT_EXPIRE_HOUR:-24}
+totp:
+  encryption_key: "${TOTP_ENCRYPTION_KEY}"
+timezone: "${TZ:-Asia/Shanghai}"
+default:
+  user_concurrency: 5
+  user_balance: 0
+  api_key_prefix: "sk-"
+  rate_multiplier: 1.0
+rate_limit:
+  requests_per_minute: 60
+  burst_size: 10
+gateway:
+  max_account_switches: ${GATEWAY_MAX_ACCOUNT_SWITCHES:-3}
+  max_account_switches_gemini: ${GATEWAY_MAX_ACCOUNT_SWITCHES_GEMINI:-2}
+  max_idle_conns: ${GATEWAY_MAX_IDLE_CONNS:-256}
+  max_idle_conns_per_host: ${GATEWAY_MAX_IDLE_CONNS_PER_HOST:-32}
+  max_conns_per_host: ${GATEWAY_MAX_CONNS_PER_HOST:-128}
+  max_upstream_clients: ${GATEWAY_MAX_UPSTREAM_CLIENTS:-256}
+  client_idle_ttl_seconds: ${GATEWAY_CLIENT_IDLE_TTL_SECONDS:-300}
+  stream_keepalive_interval: ${GATEWAY_STREAM_KEEPALIVE_INTERVAL:-5}
+  models_list_cache_ttl_seconds: ${GATEWAY_MODELS_LIST_CACHE_TTL_SECONDS:-30}
+  openai_http2:
+    enabled: ${OPENAI_HTTP2_ENABLED:-true}
+    allow_proxy_fallback_to_http1: ${OPENAI_HTTP2_ALLOW_PROXY_FALLBACK_TO_HTTP1:-true}
+  openai_ws:
+    max_conns_per_account: ${OPENAI_WS_MAX_CONNS_PER_ACCOUNT:-24}
+    min_idle_per_account: ${OPENAI_WS_MIN_IDLE_PER_ACCOUNT:-0}
+    max_idle_per_account: ${OPENAI_WS_MAX_IDLE_PER_ACCOUNT:-4}
+    event_flush_batch_size: ${OPENAI_WS_EVENT_FLUSH_BATCH_SIZE:-1}
+    event_flush_interval_ms: ${OPENAI_WS_EVENT_FLUSH_INTERVAL_MS:-5}
+  usage_record:
+    worker_count: ${USAGE_RECORD_WORKER_COUNT:-16}
+    queue_size: ${USAGE_RECORD_QUEUE_SIZE:-4096}
+    task_timeout_seconds: ${USAGE_RECORD_TASK_TIMEOUT_SECONDS:-15}
+    overflow_policy: "${USAGE_RECORD_OVERFLOW_POLICY:-sync}"
+    auto_scale_enabled: ${USAGE_RECORD_AUTO_SCALE_ENABLED:-false}
+EOF
+  printf 'installed_at=%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >"$DATA_DIR/.installed"
+  chown sub2api:sub2api "$DATA_DIR/config.yaml" "$DATA_DIR/.installed"
+  chmod 600 "$DATA_DIR/config.yaml"
+  chmod 400 "$DATA_DIR/.installed"
+}
+
+maybe_skip_auto_setup() {
+  if [ "${FORCE_RUNTIME_CONFIG:-false}" = "true" ]; then
+    write_runtime_config
+    export AUTO_SETUP=false
+    echo "Runtime config forced; skipping auto setup."
+    return 0
+  fi
+
+  if [ "${SKIP_AUTO_SETUP_WHEN_MIGRATED:-true}" != "true" ]; then
+    return 0
+  fi
+  if [ "$DATABASE_HOST" = "127.0.0.1" ]; then
+    return 0
+  fi
+
+  applied_count="$(migration_count | tr -d '[:space:]')"
+  case "$applied_count" in
+    ''|*[!0-9]*) applied_count=0 ;;
+  esac
+  required_count="${MIGRATION_BOOTSTRAP_MIN_COUNT:-178}"
+  echo "Detected applied migrations: ${applied_count}/${required_count}"
+  if [ "$applied_count" -ge "$required_count" ]; then
+    write_runtime_config
+    export AUTO_SETUP=false
+    echo "External database is already bootstrapped; skipping auto setup."
+  fi
+  return 0
+}
+
+sync_admin_password() {
+  if [ "${SYNC_ADMIN_PASSWORD:-true}" != "true" ]; then
+    return 0
+  fi
+
+  echo "Admin password sync loop started."
+  synced_dbs=""
+  candidate_dbs="$DATABASE_DBNAME"
+  if [ "$DATABASE_HOST" = "127.0.0.1" ]; then
+    candidate_dbs="$DATABASE_DBNAME postgres gatewaydb"
+  fi
+
+  for attempt in $(seq 1 15); do
+    password_hash="$(python3 - <<'PY'
+import bcrypt
+import os
+
+print(bcrypt.hashpw(os.environ["ADMIN_PASSWORD"].encode("utf-8"), bcrypt.gensalt()).decode("utf-8"))
+PY
+)"
+    synced_count=0
+    for sync_dbname in $candidate_dbs; do
+      case " $synced_dbs " in
+        *" $sync_dbname "*) continue ;;
+      esac
+
+      table_exists="$(PGPASSWORD="${DATABASE_PASSWORD:-}" psql \
+        -h "$DATABASE_HOST" \
+        -p "$DATABASE_PORT" \
+        -U "$DATABASE_USER" \
+        -d "$sync_dbname" \
+        -tAc "select to_regclass('public.users') is not null;" 2>/tmp/admin-user-check.err || true)"
+      table_exists="$(printf '%s' "$table_exists" | tr -d '[:space:]')"
+      admin_count="$(PGPASSWORD="${DATABASE_PASSWORD:-}" psql \
+        -h "$DATABASE_HOST" \
+        -p "$DATABASE_PORT" \
+        -U "$DATABASE_USER" \
+        -d "$sync_dbname" \
+        -tAc "select count(1) from users where role = 'admin';" 2>/dev/null || true)"
+      admin_count="$(printf '%s' "$admin_count" | tr -d '[:space:]')"
+
+      if [ "$table_exists" = "t" ]; then
+        PGPASSWORD="${DATABASE_PASSWORD:-}" psql \
+          -h "$DATABASE_HOST" \
+          -p "$DATABASE_PORT" \
+          -U "$DATABASE_USER" \
+          -d "$sync_dbname" \
+          -v ON_ERROR_STOP=1 \
+          -c "update users set password_hash = '${password_hash}', role = 'admin', status = 'active', updated_at = now() where email = '${ADMIN_EMAIL}'; insert into users (email, password_hash, role, balance, concurrency, status, created_at, updated_at) select '${ADMIN_EMAIL}', '${password_hash}', 'admin', 0, 5, 'active', now(), now() where not exists (select 1 from users where email = '${ADMIN_EMAIL}');" >/tmp/admin-password-sync.out 2>/tmp/admin-password-sync.err
+
+        stored_hash="$(PGPASSWORD="${DATABASE_PASSWORD:-}" psql \
+          -h "$DATABASE_HOST" \
+          -p "$DATABASE_PORT" \
+          -U "$DATABASE_USER" \
+          -d "$sync_dbname" \
+          -tAc "select password_hash from users where role = 'admin' limit 1;" 2>/tmp/admin-password-verify.err || true)"
+        export STORED_ADMIN_PASSWORD_HASH="$stored_hash"
+        verify_result="$(python3 - <<'PY'
+import bcrypt
+import os
+
+stored = os.environ.get("STORED_ADMIN_PASSWORD_HASH", "").strip()
+password = os.environ["ADMIN_PASSWORD"].encode("utf-8")
+print("ok" if stored and bcrypt.checkpw(password, stored.encode("utf-8")) else "failed")
+PY
+)"
+        echo "Admin password synchronized from HF secret in db=${sync_dbname}."
+        echo "Admin password bcrypt verification: ${verify_result}"
+        synced_dbs="$synced_dbs $sync_dbname"
+        synced_count=$((synced_count + 1))
+      fi
+    done
+    if [ -n "$(printf '%s' "$synced_dbs" | tr -d '[:space:]')" ] && [ "$attempt" -ge 5 ]; then
+      return 0
+    fi
+    sleep 2
+  done
+
+  echo "Admin password sync skipped: admin user not found before timeout." >&2
+  cat /tmp/admin-user-check.err >&2 || true
+}
+
+maybe_skip_auto_setup
+
+start_balance_cache_sync
+
+attempt=1
+max_attempts="${BOOTSTRAP_MAX_ATTEMPTS:-6}"
+while :; do
+  echo "Starting gateway on ${SERVER_HOST}:${SERVER_PORT} (attempt ${attempt}/${max_attempts})"
+  su-exec sub2api /app/hub-gateway &
+  app_pid="$!"
+  trap 'kill -TERM "$app_pid" 2>/dev/null || true' INT TERM
+  sync_admin_password &
+
+  set +e
+  wait "$app_pid"
+  app_status="$?"
+  set -e
+
+  if [ "$app_status" -eq 0 ]; then
+    exit 0
+  fi
+
+  if [ "$AUTO_SETUP" != "true" ] || [ "$DATABASE_HOST" = "127.0.0.1" ]; then
+    exit "$app_status"
+  fi
+
+  maybe_skip_auto_setup
+  if [ "$AUTO_SETUP" != "true" ]; then
+    attempt=$((attempt + 1))
+    continue
+  fi
+
+  if [ "$attempt" -ge "$max_attempts" ]; then
+    exit "$app_status"
+  fi
+
+  attempt=$((attempt + 1))
+  echo "Gateway exited during bootstrap; retrying to continue migrations."
+  sleep 2
+done