Livrare LOT 1 - Didi

ai_platform/modules/gateway/deploy/.env.example

@@ -0,0 +1,8 @@
+# Gateway Configuration
+# =============================================================================
+# REQUIRED (no defaults)
+# =============================================================================
+
+# API token for Bearer authentication - ALL requests must include this
+# Generate with: python3 -c "import secrets; print(secrets.token_urlsafe(32))"
+GATEWAY_API_TOKEN=

ai_platform/modules/gateway/deploy/deploy.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+#
+# Docker Compose Startup Script for API Gateway
+#
+# Usage: ./deploy/deploy.sh [OPTIONS]
+#
+# Options:
+#   --detach, -d          Run in detached mode
+#   --down                Stop and remove containers
+#   --logs                Show logs
+#   --help, -h            Show this help message
+#
+# Required: Set GATEWAY_API_TOKEN in deploy/.env file.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Load .env file
+if [[ -f "$SCRIPT_DIR/.env" ]]; then
+    echo "Loading environment from: $SCRIPT_DIR/.env"
+    set -a
+    source "$SCRIPT_DIR/.env"
+    set +a
+fi
+
+DETACH=""
+ACTION="up"
+
+show_help() {
+    sed -n '2,15p' "$0" | sed 's/^# //' | sed 's/^#//'
+    exit 0
+}
+
+check_required_var() {
+    local var_name="$1"
+    if [[ -z "${!var_name:-}" ]]; then
+        echo "ERROR: Required environment variable $var_name is not set"
+        echo "Set it in deploy/.env file or export it before running this script"
+        exit 1
+    fi
+}
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --detach|-d)
+            DETACH="-d"
+            shift
+            ;;
+        --down)
+            ACTION="down"
+            shift
+            ;;
+        --logs)
+            ACTION="logs"
+            shift
+            ;;
+        --help|-h)
+            show_help
+            ;;
+        *)
+            echo "Unknown option: $1"
+            echo "Use --help for usage information"
+            exit 1
+            ;;
+    esac
+done
+
+# Fail-fast required vars
+check_required_var "GATEWAY_API_TOKEN"
+
+cd "$SCRIPT_DIR"
+
+case $ACTION in
+    up)
+        echo "Starting API Gateway on port 11000"
+        echo "  Routes: /llm/ /audio/ /web/ /catalog/ /health"
+        echo ""
+        # shellcheck disable=SC2086
+        exec docker compose up $DETACH
+        ;;
+    down)
+        echo "Stopping API Gateway..."
+        exec docker compose down
+        ;;
+    logs)
+        exec docker compose logs -f
+        ;;
+esac

ai_platform/modules/gateway/deploy/docker-compose.yml

@@ -0,0 +1,50 @@
+# Gateway Module - Docker Compose Configuration
+#
+# Port Allocation:
+#   11000 - API Gateway (ONLY externally exposed port)
+#
+# This is the single entry point for all didiAI services.
+# All requests require Bearer token authentication.
+#
+# Routes:
+#   /llm/         → LLM Inference API
+#   /audio/       → Audio Transcription API
+#   /web/         → Web Fact-checking API
+#   /catalog/     → Catalog API (internal monitoring)
+#   /embeddings/  → Embeddings API
+#   /rerank/      → Rerank API
+#   /health       → Gateway health (no auth)
+#
+# Naming Convention: didiAI-{module}-{service}
+#
+# Network:
+#   Uses deploy_default network (shared with other modules)
+
+networks:
+  didi-network:
+    external: true   # single shared network for all DIDI + AI platform stacks
+
+services:
+  gateway:
+    container_name: didiAI-gateway
+    image: nginx:1.27-alpine
+    ports:
+      - "11000:11000"
+    networks:
+      - didi-network
+    volumes:
+      - ./nginx.conf.template:/etc/nginx/nginx.conf.template:ro
+    environment:
+      - GATEWAY_API_TOKEN=${GATEWAY_API_TOKEN}
+    command: >
+      /bin/sh -c "envsubst '$$GATEWAY_API_TOKEN'
+      < /etc/nginx/nginx.conf.template
+      > /etc/nginx/nginx.conf
+      && nginx -g 'daemon off;'"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:11000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+    restart: unless-stopped

ai_platform/modules/gateway/deploy/nginx.conf.template

@@ -0,0 +1,169 @@
+worker_processes auto;
+error_log /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    # ======================================================================
+    # Logging
+    # ======================================================================
+    log_format main '$remote_addr [$time_local] "$request" '
+                    '$status $body_bytes_sent rt=$request_time '
+                    'auth=$auth_status';
+
+    access_log /var/log/nginx/access.log main;
+
+    # Hide nginx version
+    server_tokens off;
+
+    # ======================================================================
+    # Bearer Token Authentication
+    # ======================================================================
+    map_hash_bucket_size 128;
+    map $http_authorization $auth_status {
+        default       "denied";
+        "Bearer ${GATEWAY_API_TOKEN}" "ok";
+    }
+
+    # ======================================================================
+    # Upstreams
+    # ======================================================================
+    # NOTE: nginx resolves all upstream hostnames at config load time.
+    # Missing names abort startup, so only deployed services are listed here.
+    # Re-enable an upstream when its container exists on this host.
+    #
+    # upstream llm {
+    #     server didiAI-llm-api:14011;
+    # }
+    #
+    # upstream audio {
+    #     server didiAI-audio-api:54300;
+    # }
+
+    upstream web {
+        server didiAI-web-api:51100;
+    }
+
+    upstream catalog {
+        server didiAI-catalog-api:11000;
+    }
+
+    # upstream embeddings {
+    #     server didiAI-embeddings-api:14100;
+    # }
+    #
+    # upstream rerank {
+    #     server didiAI-rerank-api:14200;
+    # }
+
+    # ======================================================================
+    # Gateway Server
+    # ======================================================================
+    server {
+        listen 11000;
+        server_name _;
+
+        # Max upload size (audio files up to 500MB)
+        client_max_body_size 500M;
+
+        # Default JSON content type for error responses
+        default_type application/json;
+
+        # Timeouts
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 600s;
+
+        # Common proxy headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Request-ID $request_id;
+
+        # ==================================================================
+        # Health - NO auth required
+        # ==================================================================
+        location = /health {
+            access_log off;
+            default_type application/json;
+            return 200 '{"status":"ok","service":"didiAI-gateway"}';
+        }
+
+        # ==================================================================
+        # LLM Inference / Audio Transcription — DISABLED on this host
+        # (didiAI-llm-api and didiAI-audio-api containers not present locally)
+        # Re-enable the upstream block above + location block below when deployed.
+        # ==================================================================
+        # location /llm/ {
+        #     if ($auth_status = "denied") {
+        #         return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
+        #     }
+        #     proxy_pass http://llm/;
+        #     proxy_buffering off;
+        #     proxy_cache off;
+        #     proxy_set_header Connection '';
+        #     proxy_http_version 1.1;
+        #     chunked_transfer_encoding on;
+        # }
+        #
+        # location /audio/ {
+        #     if ($auth_status = "denied") {
+        #         return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
+        #     }
+        #     proxy_pass http://audio/;
+        #     client_body_buffer_size 10M;
+        # }
+
+        # ==================================================================
+        # Web Fact-checking - /web/
+        # ==================================================================
+        location /web/ {
+            if ($auth_status = "denied") {
+                return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
+            }
+
+            proxy_pass http://web/;
+        }
+
+        # ==================================================================
+        # Catalog (internal monitoring) - /catalog/
+        # ==================================================================
+        location /catalog/ {
+            if ($auth_status = "denied") {
+                return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
+            }
+
+            proxy_pass http://catalog/;
+        }
+
+        # ==================================================================
+        # Embeddings / Rerank — DISABLED on this host
+        # (FastAPI wrappers not deployed; live BGE-M3 servers run elsewhere)
+        # Re-enable the upstream blocks above + location blocks below when deployed.
+        # ==================================================================
+        # location /embeddings/ {
+        #     if ($auth_status = "denied") {
+        #         return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
+        #     }
+        #     proxy_pass http://embeddings/;
+        # }
+        #
+        # location /rerank/ {
+        #     if ($auth_status = "denied") {
+        #         return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
+        #     }
+        #     proxy_pass http://rerank/;
+        # }
+
+        # ==================================================================
+        # Default - show available routes
+        # ==================================================================
+        location / {
+            default_type application/json;
+            return 404 '{"error":"not_found","routes":["/web/","/catalog/","/health"]}';
+        }
+    }
+}