Working chat: auth, connections, streaming, folders
LLeMbas now runs end to end. Register, add an OpenAI-compatible connection, and hold a real streaming conversation organised into folders. Verified against the local llama-swap instance. Streaming is the one genuinely tricky part. Sending a message returns two HTML fragments -- the user bubble and an empty assistant bubble carrying an sse-connect -- and that attribute is the ONLY thing that starts a generation. Rendering an incomplete assistant message as a streaming shell falls out of the same template, which means loading a page whose last reply never finished simply picks it up again. Details worth knowing about, each commented where it matters: - SSE payloads are split across several data: lines. A raw newline in one data: line truncates the event, which shows up the first time a model emits a code block. - Markdown is rendered server-side by the same helper for both the page and the final streamed frame, so the two cannot disagree. The fence renderer is replaced outright rather than using markdown-it's highlight option, which re-wraps output in a second <pre>. - escape_text is html.escape, not nh3.clean_text: it escapes character by character, so escaping stream chunks separately equals escaping the whole string. - The stream opens its own session via session_scope(); it outlives the request handler and the dependency-scoped session may be closed. - Deleting a folder keeps the chats inside it (FK is SET NULL). Losing a conversation to a mis-clicked folder delete is unforgivable. - Login failures use one message for "no such account" and "wrong password" so the form cannot enumerate registered addresses. Also adds deploy/ for the gamebox install at https://chat.lan: system unit, nginx vhost with buffering off (buffering on turns streaming into one lump at the end), and install/update scripts following the same service-user and /srv bind-mount conventions as llama-swap and comfyui. 70 tests, ruff clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jaroslav Beneš
Executable
+115
@@ -0,0 +1,115 @@
|
||||
#!/usr/bin/env bash
|
||||
# Install LLeMbas as a system service behind nginx at https://chat.lan.
|
||||
#
|
||||
# Follows the conventions already used on this box for llama-swap and comfyui:
|
||||
# a dedicated service user whose home lives on /home (the root LV is only
|
||||
# 50 GB) and is bind-mounted to /srv/<name>, a system unit so it survives
|
||||
# logout, and an nginx vhost with a self-signed cert.
|
||||
#
|
||||
# Idempotent: safe to re-run. To deploy new code afterwards use update.sh,
|
||||
# which is what a `git push` should be followed by.
|
||||
set -euo pipefail
|
||||
|
||||
REPO_URL="${LEMBAS_REPO_URL:-https://git.houmeres.sk/Houmeres/LLeMbas.git}"
|
||||
BRANCH="${LEMBAS_BRANCH:-main}"
|
||||
SERVICE_USER=lembas
|
||||
HOME_DIR=/home/lembas
|
||||
PREFIX=/srv/lembas
|
||||
APP="$PREFIX/app"
|
||||
VENV="$PREFIX/venv"
|
||||
ENV_FILE="$PREFIX/lembas.env"
|
||||
HERE="$(dirname "$(readlink -f "$0")")"
|
||||
|
||||
echo "== service user =="
|
||||
# --system: no ageing, no mail spool. Home under /home, not /var/lib, so the
|
||||
# venv and database sit on the big volume.
|
||||
if ! getent passwd "$SERVICE_USER" >/dev/null; then
|
||||
sudo useradd --system --create-home --home-dir "$HOME_DIR" \
|
||||
--shell /usr/bin/nologin --comment "LLeMbas" "$SERVICE_USER"
|
||||
else
|
||||
echo " user $SERVICE_USER already exists"
|
||||
fi
|
||||
sudo chmod 755 "$HOME_DIR"
|
||||
|
||||
echo "== /srv/lembas bind-mount onto /home =="
|
||||
sudo mkdir -p "$PREFIX"
|
||||
grep -q "^$HOME_DIR[[:space:]]" /etc/fstab \
|
||||
|| echo "$HOME_DIR $PREFIX none bind 0 0" | sudo tee -a /etc/fstab >/dev/null
|
||||
sudo systemctl daemon-reload
|
||||
mountpoint -q "$PREFIX" || sudo mount "$PREFIX"
|
||||
|
||||
echo "== checkout =="
|
||||
if [[ ! -d "$APP/.git" ]]; then
|
||||
sudo -u "$SERVICE_USER" git clone --branch "$BRANCH" "$REPO_URL" "$APP"
|
||||
else
|
||||
echo " already cloned; use update.sh to pull"
|
||||
fi
|
||||
|
||||
echo "== virtualenv =="
|
||||
if [[ ! -x "$VENV/bin/python" ]]; then
|
||||
sudo -u "$SERVICE_USER" python -m venv "$VENV"
|
||||
fi
|
||||
sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet --upgrade pip
|
||||
sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP"
|
||||
|
||||
echo "== environment =="
|
||||
# Generated once and never regenerated: rotating LEMBAS_SECRET_KEY would sign
|
||||
# every user out and make the stored API keys unreadable.
|
||||
if [[ ! -f "$ENV_FILE" ]]; then
|
||||
KEY=$("$VENV/bin/python" -c "import secrets; print(secrets.token_urlsafe(48))")
|
||||
sudo tee "$ENV_FILE" >/dev/null <<EOF
|
||||
# LLeMbas service environment. Generated by deploy/install.sh.
|
||||
# LEMBAS_SECRET_KEY signs sessions and encrypts stored API keys.
|
||||
# Changing it signs everyone out and makes stored API keys unreadable.
|
||||
LEMBAS_SECRET_KEY=$KEY
|
||||
LEMBAS_DATA_DIR=$PREFIX/data
|
||||
# Loopback only: reachable through the nginx chat.lan vhost, never direct.
|
||||
LEMBAS_HOST=127.0.0.1
|
||||
LEMBAS_PORT=8080
|
||||
LEMBAS_LOG_LEVEL=info
|
||||
LEMBAS_ALLOW_SIGNUP=true
|
||||
LEMBAS_DEFAULT_THEME=moria
|
||||
EOF
|
||||
sudo chown "$SERVICE_USER:$SERVICE_USER" "$ENV_FILE"
|
||||
sudo chmod 600 "$ENV_FILE"
|
||||
echo " generated $ENV_FILE"
|
||||
else
|
||||
echo " $ENV_FILE exists, keeping it (and its secret key)"
|
||||
fi
|
||||
|
||||
sudo install -d -o "$SERVICE_USER" -g "$SERVICE_USER" -m 750 "$PREFIX/data"
|
||||
|
||||
echo "== systemd unit =="
|
||||
sudo install -Dm644 "$HERE/lembas.service" /etc/systemd/system/lembas.service
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "== self-signed cert for chat.lan =="
|
||||
sudo mkdir -p /etc/nginx/ssl
|
||||
if [[ ! -f /etc/nginx/ssl/chat.lan.crt ]]; then
|
||||
sudo openssl req -x509 -newkey rsa:2048 -nodes \
|
||||
-keyout /etc/nginx/ssl/chat.lan.key -out /etc/nginx/ssl/chat.lan.crt \
|
||||
-days 3650 -subj "/CN=chat.lan" -addext "subjectAltName=DNS:chat.lan"
|
||||
sudo chmod 600 /etc/nginx/ssl/chat.lan.key
|
||||
sudo chmod 644 /etc/nginx/ssl/chat.lan.crt
|
||||
fi
|
||||
|
||||
echo "== nginx vhost =="
|
||||
sudo install -Dm644 "$HERE/chat.lan.nginx.conf" /etc/nginx/conf.d/chat.lan.conf
|
||||
sudo nginx -t
|
||||
sudo systemctl reload nginx
|
||||
|
||||
echo "== local name resolution =="
|
||||
# chat.lan is in Pi-hole, but this box asks the router first and the router's
|
||||
# dnsmasq is authoritative for .lan without forwarding it on -- same reason
|
||||
# comfy.lan needs a hosts entry. Harmless if DNS already resolves it.
|
||||
grep -q 'chat\.lan' /etc/hosts \
|
||||
|| printf '127.0.0.1\tchat.lan\n::1\t\tchat.lan\n' | sudo tee -a /etc/hosts >/dev/null
|
||||
|
||||
echo "== enable service =="
|
||||
sudo systemctl enable --now lembas
|
||||
sleep 2
|
||||
sudo systemctl --no-pager --lines=0 status lembas || true
|
||||
|
||||
echo
|
||||
echo "LLeMbas is up at https://chat.lan (self-signed cert; accept the warning)"
|
||||
echo "Create the first account -- it becomes the administrator."
|
||||
Reference in New Issue
Block a user