Jaroslav Beneš
0f44e8d24c
LLeMbas now runs end to end. Register, add an OpenAI-compatible connection, and hold a real streaming conversation organised into folders. Verified against the local llama-swap instance. Streaming is the one genuinely tricky part. Sending a message returns two HTML fragments -- the user bubble and an empty assistant bubble carrying an sse-connect -- and that attribute is the ONLY thing that starts a generation. Rendering an incomplete assistant message as a streaming shell falls out of the same template, which means loading a page whose last reply never finished simply picks it up again. Details worth knowing about, each commented where it matters: - SSE payloads are split across several data: lines. A raw newline in one data: line truncates the event, which shows up the first time a model emits a code block. - Markdown is rendered server-side by the same helper for both the page and the final streamed frame, so the two cannot disagree. The fence renderer is replaced outright rather than using markdown-it's highlight option, which re-wraps output in a second <pre>. - escape_text is html.escape, not nh3.clean_text: it escapes character by character, so escaping stream chunks separately equals escaping the whole string. - The stream opens its own session via session_scope(); it outlives the request handler and the dependency-scoped session may be closed. - Deleting a folder keeps the chats inside it (FK is SET NULL). Losing a conversation to a mis-clicked folder delete is unforgivable. - Login failures use one message for "no such account" and "wrong password" so the form cannot enumerate registered addresses. Also adds deploy/ for the gamebox install at https://chat.lan: system unit, nginx vhost with buffering off (buffering on turns streaming into one lump at the end), and install/update scripts following the same service-user and /srv bind-mount conventions as llama-swap and comfyui. 70 tests, ruff clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
116 lines
4.2 KiB
Bash
Executable File
116 lines
4.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install LLeMbas as a system service behind nginx at https://chat.lan.
|
|
#
|
|
# Follows the conventions already used on this box for llama-swap and comfyui:
|
|
# a dedicated service user whose home lives on /home (the root LV is only
|
|
# 50 GB) and is bind-mounted to /srv/<name>, a system unit so it survives
|
|
# logout, and an nginx vhost with a self-signed cert.
|
|
#
|
|
# Idempotent: safe to re-run. To deploy new code afterwards use update.sh,
|
|
# which is what a `git push` should be followed by.
|
|
set -euo pipefail
|
|
|
|
REPO_URL="${LEMBAS_REPO_URL:-https://git.houmeres.sk/Houmeres/LLeMbas.git}"
|
|
BRANCH="${LEMBAS_BRANCH:-main}"
|
|
SERVICE_USER=lembas
|
|
HOME_DIR=/home/lembas
|
|
PREFIX=/srv/lembas
|
|
APP="$PREFIX/app"
|
|
VENV="$PREFIX/venv"
|
|
ENV_FILE="$PREFIX/lembas.env"
|
|
HERE="$(dirname "$(readlink -f "$0")")"
|
|
|
|
echo "== service user =="
|
|
# --system: no ageing, no mail spool. Home under /home, not /var/lib, so the
|
|
# venv and database sit on the big volume.
|
|
if ! getent passwd "$SERVICE_USER" >/dev/null; then
|
|
sudo useradd --system --create-home --home-dir "$HOME_DIR" \
|
|
--shell /usr/bin/nologin --comment "LLeMbas" "$SERVICE_USER"
|
|
else
|
|
echo " user $SERVICE_USER already exists"
|
|
fi
|
|
sudo chmod 755 "$HOME_DIR"
|
|
|
|
echo "== /srv/lembas bind-mount onto /home =="
|
|
sudo mkdir -p "$PREFIX"
|
|
grep -q "^$HOME_DIR[[:space:]]" /etc/fstab \
|
|
|| echo "$HOME_DIR $PREFIX none bind 0 0" | sudo tee -a /etc/fstab >/dev/null
|
|
sudo systemctl daemon-reload
|
|
mountpoint -q "$PREFIX" || sudo mount "$PREFIX"
|
|
|
|
echo "== checkout =="
|
|
if [[ ! -d "$APP/.git" ]]; then
|
|
sudo -u "$SERVICE_USER" git clone --branch "$BRANCH" "$REPO_URL" "$APP"
|
|
else
|
|
echo " already cloned; use update.sh to pull"
|
|
fi
|
|
|
|
echo "== virtualenv =="
|
|
if [[ ! -x "$VENV/bin/python" ]]; then
|
|
sudo -u "$SERVICE_USER" python -m venv "$VENV"
|
|
fi
|
|
sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet --upgrade pip
|
|
sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP"
|
|
|
|
echo "== environment =="
|
|
# Generated once and never regenerated: rotating LEMBAS_SECRET_KEY would sign
|
|
# every user out and make the stored API keys unreadable.
|
|
if [[ ! -f "$ENV_FILE" ]]; then
|
|
KEY=$("$VENV/bin/python" -c "import secrets; print(secrets.token_urlsafe(48))")
|
|
sudo tee "$ENV_FILE" >/dev/null <<EOF
|
|
# LLeMbas service environment. Generated by deploy/install.sh.
|
|
# LEMBAS_SECRET_KEY signs sessions and encrypts stored API keys.
|
|
# Changing it signs everyone out and makes stored API keys unreadable.
|
|
LEMBAS_SECRET_KEY=$KEY
|
|
LEMBAS_DATA_DIR=$PREFIX/data
|
|
# Loopback only: reachable through the nginx chat.lan vhost, never direct.
|
|
LEMBAS_HOST=127.0.0.1
|
|
LEMBAS_PORT=8080
|
|
LEMBAS_LOG_LEVEL=info
|
|
LEMBAS_ALLOW_SIGNUP=true
|
|
LEMBAS_DEFAULT_THEME=moria
|
|
EOF
|
|
sudo chown "$SERVICE_USER:$SERVICE_USER" "$ENV_FILE"
|
|
sudo chmod 600 "$ENV_FILE"
|
|
echo " generated $ENV_FILE"
|
|
else
|
|
echo " $ENV_FILE exists, keeping it (and its secret key)"
|
|
fi
|
|
|
|
sudo install -d -o "$SERVICE_USER" -g "$SERVICE_USER" -m 750 "$PREFIX/data"
|
|
|
|
echo "== systemd unit =="
|
|
sudo install -Dm644 "$HERE/lembas.service" /etc/systemd/system/lembas.service
|
|
sudo systemctl daemon-reload
|
|
|
|
echo "== self-signed cert for chat.lan =="
|
|
sudo mkdir -p /etc/nginx/ssl
|
|
if [[ ! -f /etc/nginx/ssl/chat.lan.crt ]]; then
|
|
sudo openssl req -x509 -newkey rsa:2048 -nodes \
|
|
-keyout /etc/nginx/ssl/chat.lan.key -out /etc/nginx/ssl/chat.lan.crt \
|
|
-days 3650 -subj "/CN=chat.lan" -addext "subjectAltName=DNS:chat.lan"
|
|
sudo chmod 600 /etc/nginx/ssl/chat.lan.key
|
|
sudo chmod 644 /etc/nginx/ssl/chat.lan.crt
|
|
fi
|
|
|
|
echo "== nginx vhost =="
|
|
sudo install -Dm644 "$HERE/chat.lan.nginx.conf" /etc/nginx/conf.d/chat.lan.conf
|
|
sudo nginx -t
|
|
sudo systemctl reload nginx
|
|
|
|
echo "== local name resolution =="
|
|
# chat.lan is in Pi-hole, but this box asks the router first and the router's
|
|
# dnsmasq is authoritative for .lan without forwarding it on -- same reason
|
|
# comfy.lan needs a hosts entry. Harmless if DNS already resolves it.
|
|
grep -q 'chat\.lan' /etc/hosts \
|
|
|| printf '127.0.0.1\tchat.lan\n::1\t\tchat.lan\n' | sudo tee -a /etc/hosts >/dev/null
|
|
|
|
echo "== enable service =="
|
|
sudo systemctl enable --now lembas
|
|
sleep 2
|
|
sudo systemctl --no-pager --lines=0 status lembas || true
|
|
|
|
echo
|
|
echo "LLeMbas is up at https://chat.lan (self-signed cert; accept the warning)"
|
|
echo "Create the first account -- it becomes the administrator."
|