MarioGLealPandClaude Opus 5.5
84807850ec
CI / test (pull_request) Successful in 27s
Off unless DRIVE_RAG_TLS_BUNDLE is set (plain HTTP as before), so this ships ahead of the switch. - server/mtls.py: the same module as felt-voice's (B5.1): uvicorn with TLS 1.3, client cert required against DRIVE_RAG_TLS_CA (the pki_felt intermediate, partial chain - never the root); the peer must carry exactly one SPIFFE URI from DRIVE_RAG_TLS_ALLOWED (default felt-core), checked before any request byte; the server cert reloads when the bundle is renewed. - server/serve.py: the entry point (Dockerfile CMD) - plain uvicorn or mTLS. - tests/test_mtls.py: real test PKI (name-constrained intermediate): felt-core in; no cert, another Felt identity, wrong CA, TLS 1.2 refused; a renewed cert is picked up without a restart. 6 pass. CI runs them. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_015bTPg3qG72vYPLBigJks5h
23 lines
729 B
Docker
23 lines
729 B
Docker
# drive-rag backend — FastAPI + model2vec + sqlite-vec.
|
|
FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim
|
|
|
|
ENV UV_COMPILE_BYTECODE=1 \
|
|
UV_LINK_MODE=copy \
|
|
UV_NO_CACHE=1 \
|
|
HF_HOME=/models \
|
|
DRIVE_DB=/data/drive.db
|
|
|
|
WORKDIR /app
|
|
|
|
COPY pyproject.toml uv.lock ./
|
|
RUN uv sync --frozen --no-dev --group server
|
|
|
|
# bake the embedding model into the image so the container is offline-capable
|
|
RUN uv run python -c "from model2vec import StaticModel; StaticModel.from_pretrained('minishlab/potion-retrieval-32M')"
|
|
|
|
COPY server/ ./server/
|
|
|
|
EXPOSE 8000
|
|
# plain uvicorn, or mTLS when DRIVE_RAG_TLS_BUNDLE is set (server/serve.py, WP-62 M2b)
|
|
CMD ["uv", "run", "--no-dev", "--group", "server", "python", "-m", "server.serve"]
|