feat: container entrypoint provisions Redis + supervises Celery worker

- entrypoint.py: resolves REDIS_URL/CELERY_BROKER_URL/CELERY_RESULT_BACKEND
from env (Space secrets win), else provisions Upstash free-tier DBs with
deterministic v4-form idempotency keys (restart-stable, re-fetchable);
runs Celery worker + uvicorn, restarts worker on death.
- celery_tasks.py: explicit broker_use_ssl/redis_backend_use_ssl with
CERT_REQUIRED for rediss:// brokers (TLS verification stays ON).
- Dockerfile / Dockerfile.hf: CMD -> python entrypoint.py.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Dockerfile

@@ -12,9 +12,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-# Copy app source
+# Copy app source + container entrypoint (provisions Redis, supervises worker)
 COPY app/ ./app/
+COPY entrypoint.py .
 
 EXPOSE 7860
 
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]
+CMD ["python", "entrypoint.py"]

Dockerfile.hf

@@ -16,4 +16,4 @@ COPY . .
 
 EXPOSE 7860
 
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]
+CMD ["python", "entrypoint.py"]

app/tasks/celery_tasks.py

@@ -33,6 +33,14 @@ celery_app.conf.update(
     task_reject_on_worker_lost=True,
 )
 
+# Hosted Redis (Upstash) arrives over rediss:// — always verify the server
+# certificate. Explicit CERT_REQUIRED so Celery never silently downgrades.
+import ssl as _ssl
+if settings.celery_broker_url.startswith("rediss"):
+    celery_app.conf.broker_use_ssl = {"ssl_cert_reqs": _ssl.CERT_REQUIRED}
+if settings.celery_result_backend.startswith("rediss"):
+    celery_app.conf.redis_backend_use_ssl = {"ssl_cert_reqs": _ssl.CERT_REQUIRED}
+
 
 @celery_app.task(bind=True, max_retries=3, rate_limit="100/m")
 def bulk_validate_task(self, emails: list, webhook_url: str = None):

entrypoint.py

@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+"""
+Container entrypoint for BRIDGE Modul-X on Hugging Face Spaces.
+
+Responsibilities
+----------------
+1. Ensure Redis/Celery env vars point at a reachable Redis:
+   - Space secrets win: REDIS_URL / CELERY_BROKER_URL / CELERY_RESULT_BACKEND.
+   - Otherwise provision Upstash free-tier databases (cache, celery-broker,
+     celery-result) via the unauthenticated start-redis endpoint with
+     *stable* Idempotency-Keys, so every container restart re-fetches the
+     same databases. Free DBs expire after ~3 days unless claimed at the
+     console URL printed in the boot logs (or unless the account-backed
+     secrets above are set).
+2. Supervise two child processes:
+   - Celery worker  (bulk validation queue)
+   - uvicorn        (FastAPI web app on $PORT / 7860)
+   The worker is restarted if it dies; if the web process dies the
+   container exits and the platform restarts it.
+"""
+import os
+import signal
+import subprocess
+import sys
+import time
+import uuid
+
+# Fixed namespace so the per-store Idempotency-Keys are deterministic.
+_NS = uuid.UUID("7c9e6679-7425-40de-944b-e07fc1f90ae7")
+
+
+def _stable_db_id(store: str) -> str:
+    """Deterministic UUIDv4-FORM id (Upstash rejects non-v4 idempotency keys):
+    derive bytes from uuid5, then patch version/variant bits to v4/RFC-4122."""
+    b = bytearray(uuid.uuid5(_NS, f"bridge-modul-x/{store}").bytes)
+    b[6] = (b[6] & 0x0F) | 0x40
+    b[8] = (b[8] & 0x3F) | 0x80
+    return str(uuid.UUID(bytes=bytes(b)))
+
+
+def _provision(store: str):
+    """Create/re-fetch a free-tier Upstash DB. Returns a rediss:// URL or None."""
+    from app.utils.upstash_free import create_database
+
+    # First try the stable key (re-fetch after restart); if Upstash rejects
+    # it (expired DB), fall back to one fresh random key.
+    for attempt, db_id in enumerate([_stable_db_id(store), ""]):
+        try:
+            db = create_database(db_id=db_id)
+            print(
+                f"[ENTRYPOINT] {store}: upstash db {db.db_id} ok "
+                f"(expires {db.expires}) - claim to keep it: {db.console_url}",
+                flush=True,
+            )
+            return db.connection_string(0)
+        except Exception as exc:
+            print(f"[ENTRYPOINT] {store}: provision failed (try {attempt}): {exc}", flush=True)
+    return None
+
+
+def _resolve(env_name: str, store: str):
+    url = os.environ.get(env_name, "").strip()
+    if url and "localhost" not in url and "127.0.0.1" not in url:
+        return url
+    print(f"[ENTRYPOINT] {env_name} unset/local - provisioning '{store}' on Upstash free tier", flush=True)
+    return _provision(store)
+
+
+def main():
+    cache_url = _resolve("REDIS_URL", "cache")
+    broker_url = _resolve("CELERY_BROKER_URL", "celery-broker") or cache_url
+    result_url = _resolve("CELERY_RESULT_BACKEND", "celery-result") or broker_url
+
+    if cache_url:
+        os.environ["REDIS_URL"] = cache_url
+    if broker_url:
+        os.environ["CELERY_BROKER_URL"] = broker_url
+    if result_url:
+        os.environ["CELERY_RESULT_BACKEND"] = result_url
+    if not broker_url:
+        print("[ENTRYPOINT] WARNING: no Redis reachable - bulk jobs use the synchronous fallback", flush=True)
+
+    port = os.environ.get("PORT", "7860")
+    children = {}
+    state = {"stopping": False}
+
+    def spawn(kind):
+        if kind == "worker":
+            cmd = [
+                sys.executable, "-m", "celery",
+                "-A", "app.tasks.celery_tasks:celery_app", "worker",
+                "--loglevel=info", "--concurrency=4",
+            ]
+        else:
+            cmd = [
+                sys.executable, "-m", "uvicorn", "app.main:app",
+                "--host", "0.0.0.0", "--port", port,
+            ]
+        proc = subprocess.Popen(cmd, env=os.environ)
+        children[kind] = proc
+        print(f"[ENTRYPOINT] started {kind} (pid {proc.pid})", flush=True)
+        return proc
+
+    def on_signal(signum, frame):
+        state["stopping"] = True
+        for proc in list(children.values()):
+            try:
+                proc.terminate()
+            except Exception:
+                pass
+
+    signal.signal(signal.SIGTERM, on_signal)
+    signal.signal(signal.SIGINT, on_signal)
+
+    spawn("worker")
+    web = spawn("web")
+
+    while not state["stopping"]:
+        if web.poll() is not None:
+            print(f"[ENTRYPOINT] web exited ({web.returncode}) - shutting down", flush=True)
+            break
+        worker = children["worker"]
+        if worker.poll() is not None:
+            print(f"[ENTRYPOINT] worker exited ({worker.returncode}) - restarting in 5s", flush=True)
+            time.sleep(5)
+            if not state["stopping"]:
+                spawn("worker")
+        time.sleep(2)
+
+    for proc in list(children.values()):
+        try:
+            proc.terminate()
+            proc.wait(timeout=10)
+        except Exception:
+            try:
+                proc.kill()
+            except Exception:
+                pass
+
+    sys.exit(web.returncode or 0)
+
+
+if __name__ == "__main__":
+    main()