🔐(secrets) bump secrets

Bump secret in order to enable IA feature on staging

.github/workflows/docker-hub.yml

@@ -117,10 +117,63 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
+  build-and-push-summary:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "meet,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
+        with:
+          secret-file: secrets/numerique-gouv/meet/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: lasuite/meet-summary
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '--target production -f src/summary/Dockerfile'
+          docker-image-name: 'docker.io/lasuite/meet-summary:${{ github.sha }}'
+      -
+        name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./src/summary/Dockerfile
+          target: production
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+
   notify-argocd:
     needs:
       - build-and-push-frontend
       - build-and-push-backend
+      - build-and-push-summary
     runs-on: ubuntu-latest
     if: |
       github.event_name != 'pull_request'

.gitignore

@@ -79,3 +79,6 @@ db.sqlite3
 
 # Egress output
 docker/livekit/out
+
+# Summary
+src/vsummary

bin/Tiltfile

@@ -28,6 +28,17 @@ docker_build(
     ]
 )
 
+docker_build(
+    'localhost:5001/meet-summary:latest',
+    context='../src/summary',
+    dockerfile='../src/summary/Dockerfile',
+    only=['.', '../../docker', '../../.dockerignore'],
+    target = 'production',
+    live_update=[
+        sync('../src/summary', '/home/summary'),
+    ]
+)
+
 k8s_yaml(local('cd ../src/helm && helmfile -n meet -e dev template .'))
 
 migration = '''

src/helm/env.d/dev/values.meet.yaml.gotmpl

@@ -108,3 +108,61 @@ posthog:
   ingressAssets:
     enabled: false
 
+summary:
+  replicas: 1
+  envVars:
+    APP_NAME: summary-microservice
+    APP_API_TOKEN: password
+    AWS_STORAGE_BUCKET_NAME: meet-media-storage
+    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
+    OPENAI_API_KEY: password
+    AWS_S3_SECURE_ACCESS: False
+    WEBHOOK_API_TOKEN: password
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
+    CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
+
+  image:
+    repository: localhost:5001/meet-summary
+    pullPolicy: Always
+    tag: "latest"
+
+  command:
+    - "uvicorn"
+    - "summary.main:app"
+    - "--host"
+    - "0.0.0.0"
+    - "--port"
+    - "8000"
+    - "--reload"
+
+celery:
+  replicas: 1
+  envVars:
+    APP_NAME: summary-microservice
+    APP_API_TOKEN: password
+    AWS_STORAGE_BUCKET_NAME: meet-media-storage
+    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
+    OPENAI_API_KEY: password
+    AWS_S3_SECURE_ACCESS: False
+    WEBHOOK_API_TOKEN: password
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
+    CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
+
+  image:
+    repository: localhost:5001/meet-summary
+    pullPolicy: Always
+    tag: "latest"
+
+  command:
+    - "celery"
+    - "-A"
+    - "summary.celery_worker"
+    - "worker"
+    - "--pool=solo"
+    - "--loglevel=info"

src/helm/env.d/staging/values.meet.yaml.gotmpl

@@ -174,3 +174,107 @@ posthog:
       cert-manager.io/cluster-issuer: letsencrypt-prod
       nginx.ingress.kubernetes.io/upstream-vhost: eu-assets.i.posthog.com
       nginx.ingress.kubernetes.io/backend-protocol: https
+
+summary:
+  replicas: 1
+  envVars:
+    APP_NAME: summary-microservice
+    APP_API_TOKEN:
+      secretKeyRef:
+        name: summary
+        key: APP_API_TOKEN
+    AWS_S3_ENDPOINT_URL:
+      secretKeyRef:
+        name: meet-media-storage.bucket.libre.sh
+        key: url
+    AWS_S3_ACCESS_KEY_ID:
+      secretKeyRef:
+        name: meet-media-storage.bucket.libre.sh
+        key: accessKey
+    AWS_S3_SECRET_ACCESS_KEY:
+      secretKeyRef:
+        name: meet-media-storage.bucket.libre.sh
+        key: secretKey
+    AWS_STORAGE_BUCKET_NAME:
+      secretKeyRef:
+        name: meet-media-storage.bucket.libre.sh
+        key: bucket
+    AWS_S3_REGION_NAME: local
+    OPENAI_API_KEY:
+      secretKeyRef:
+        name: summary
+        key: OPENAI_API_KEY
+    WEBHOOK_API_TOKEN:
+      secretKeyRef:
+        name: summary
+        key: WEBHOOK_API_TOKEN
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL:
+      secretKeyRef:
+        name: redis-summary.redis.libre.sh
+        key: url
+    CELERY_RESULT_BACKEND:
+      secretKeyRef:
+        name: redis-summary.redis.libre.sh
+        key: url
+
+  image:
+    repository: lasuite/meet-summary
+    pullPolicy: Always
+    tag: "main"
+
+celery:
+  replicas: 1
+  envVars:
+    APP_NAME: summary-microservice
+    APP_API_TOKEN:
+      secretKeyRef:
+        name: summary
+        key: APP_API_TOKEN
+    AWS_S3_ENDPOINT_URL:
+      secretKeyRef:
+        name: meet-media-storage.bucket.libre.sh
+        key: url
+    AWS_S3_ACCESS_KEY_ID:
+      secretKeyRef:
+        name: meet-media-storage.bucket.libre.sh
+        key: accessKey
+    AWS_S3_SECRET_ACCESS_KEY:
+      secretKeyRef:
+        name: meet-media-storage.bucket.libre.sh
+        key: secretKey
+    AWS_STORAGE_BUCKET_NAME:
+      secretKeyRef:
+        name: meet-media-storage.bucket.libre.sh
+        key: bucket
+    AWS_S3_REGION_NAME: local
+    OPENAI_API_KEY:
+      secretKeyRef:
+        name: summary
+        key: OPENAI_API_KEY
+    WEBHOOK_API_TOKEN:
+      secretKeyRef:
+        name: summary
+        key: WEBHOOK_API_TOKEN
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL:
+      secretKeyRef:
+        name: redis-summary.redis.libre.sh
+        key: url
+    CELERY_RESULT_BACKEND:
+      secretKeyRef:
+        name: redis-summary.redis.libre.sh
+        key: url
+
+  image:
+    repository: lasuite/meet-summary
+    pullPolicy: Always
+    tag: "main"
+
+  command:
+    - "celery"
+    - "-A"
+    - "summary.celery_worker"
+    - "worker"
+    - "--pool=solo"
+    - "--loglevel=info"

src/helm/extra/templates/summary_keydb.yaml

@@ -0,0 +1,7 @@
+apiVersion: core.libre.sh/v1alpha1
+kind: Redis
+metadata:
+  name: redis-summary
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  disableAuth: false

src/helm/meet/templates/_helpers.tpl

@@ -166,6 +166,24 @@ Requires top level scope
 {{ include "meet.fullname" . }}-posthog
 {{- end }}
 
+{{/*
+Full name for the summary
+
+Requires top level scope
+*/}}
+{{- define "meet.summary.fullname" -}}
+{{ include "meet.fullname" . }}-summary
+{{- end }}
+
+{{/*
+Full name for the Celery
+
+Requires top level scope
+*/}}
+{{- define "meet.celery.fullname" -}}
+{{ include "meet.fullname" . }}-celery
+{{- end }}
+
 {{/*
 Usage : {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" .Values.path.to.the.image1) }}
 */}}

src/helm/meet/templates/celery_deployment.yaml

@@ -0,0 +1,137 @@
+{{- $envVars := include "meet.common.env" (list . .Values.celery) -}}
+{{- $fullName := include "meet.celery.fullname" . -}}
+{{- $component := "celery" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "meet.common.labels" (list . $component) | nindent 4 }}
+spec:
+  replicas: {{ .Values.celery.replicas }}
+  selector:
+    matchLabels:
+      {{- include "meet.common.selectorLabels" (list . $component) | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        {{- with .Values.celery.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+      labels:
+        {{- include "meet.common.selectorLabels" (list . $component) | nindent 8 }}
+    spec:
+      {{- if $.Values.image.credentials }}
+      imagePullSecrets:
+        - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
+      {{- end}}
+      shareProcessNamespace: {{ .Values.celery.shareProcessNamespace }}
+      containers:
+        {{- with .Values.celery.sidecars }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        - name: {{ .Chart.Name }}
+          image: "{{ (.Values.celery.image | default dict).repository | default .Values.image.repository }}:{{ (.Values.celery.image | default dict).tag | default .Values.image.tag }}"
+          imagePullPolicy: {{ (.Values.celery.image | default dict).pullPolicy | default .Values.image.pullPolicy }}
+          {{- with .Values.celery.command }}
+          command:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.celery.args }}
+          args:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          env:
+            {{- if $envVars}}
+            {{- $envVars | indent 12 }}
+            {{- end }}
+          {{- with .Values.celery.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.celery.service.targetPort }}
+              protocol: TCP
+          {{- if .Values.celery.probes.liveness }}
+          livenessProbe:
+            {{- include "meet.probes.abstract" (merge .Values.celery.probes.liveness (dict "targetPort" .Values.celery.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.celery.probes.readiness }}
+          readinessProbe:
+            {{- include "meet.probes.abstract" (merge .Values.celery.probes.readiness (dict "targetPort" .Values.celery.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.celery.probes.startup }}
+          startupProbe:
+            {{- include "meet.probes.abstract" (merge .Values.celery.probes.startup (dict "targetPort" .Values.celery.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- with .Values.celery.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            {{- range $index, $value := .Values.mountFiles }}
+            - name: "files-{{ $index }}"
+              mountPath: {{ $value.path }}
+              subPath: content
+            {{- end }}
+            {{- range $name, $volume := .Values.celery.persistence }}
+            - name: "{{ $name }}"
+              mountPath: "{{ $volume.mountPath }}"
+            {{- end }}
+            {{- range .Values.celery.extraVolumeMounts }}
+            - name: {{ .name }}
+              mountPath: {{ .mountPath }}
+              subPath: {{ .subPath | default "" }}
+              readOnly: {{ .readOnly }}
+            {{- end }}
+      {{- with .Values.celery.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.celery.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.celery.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        {{- range $index, $value := .Values.mountFiles }}
+        - name: "files-{{ $index }}"
+          configMap:
+            name: "{{ include "meet.fullname" $ }}-files-{{ $index }}"
+        {{- end }}
+        {{- range $name, $volume := .Values.celery.persistence }}
+        - name: "{{ $name }}"
+          {{- if eq $volume.type "emptyDir" }}
+          emptyDir: {}
+          {{- else }}
+          persistentVolumeClaim:
+            claimName: "{{ $fullName }}-{{ $name }}"
+          {{- end }}
+        {{- end }}
+        {{- range .Values.celery.extraVolumes }}
+        - name: {{ .name }}
+          {{- if .existingClaim }}
+          persistentVolumeClaim:
+            claimName: {{ .existingClaim }}
+          {{- else if .hostPath }}
+          hostPath:
+            {{ toYaml .hostPath | nindent 12 }}
+          {{- else if .csi }}
+          csi:
+            {{- toYaml .csi | nindent 12 }}
+          {{- else if .configMap }}
+          configMap:
+            {{- toYaml .configMap | nindent 12 }}
+          {{- else if .emptyDir }}
+          emptyDir:
+            {{- toYaml .emptyDir | nindent 12 }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        {{- end }}

src/helm/meet/templates/summary_deployment.yaml

@@ -0,0 +1,137 @@
+{{- $envVars := include "meet.common.env" (list . .Values.summary) -}}
+{{- $fullName := include "meet.summary.fullname" . -}}
+{{- $component := "summary" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "meet.common.labels" (list . $component) | nindent 4 }}
+spec:
+  replicas: {{ .Values.summary.replicas }}
+  selector:
+    matchLabels:
+      {{- include "meet.common.selectorLabels" (list . $component) | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        {{- with .Values.summary.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+      labels:
+        {{- include "meet.common.selectorLabels" (list . $component) | nindent 8 }}
+    spec:
+      {{- if $.Values.image.credentials }}
+      imagePullSecrets:
+        - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
+      {{- end}}
+      shareProcessNamespace: {{ .Values.summary.shareProcessNamespace }}
+      containers:
+        {{- with .Values.summary.sidecars }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        - name: {{ .Chart.Name }}
+          image: "{{ (.Values.summary.image | default dict).repository | default .Values.image.repository }}:{{ (.Values.summary.image | default dict).tag | default .Values.image.tag }}"
+          imagePullPolicy: {{ (.Values.summary.image | default dict).pullPolicy | default .Values.image.pullPolicy }}
+          {{- with .Values.summary.command }}
+          command:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.summary.args }}
+          args:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          env:
+            {{- if $envVars}}
+            {{- $envVars | indent 12 }}
+            {{- end }}
+          {{- with .Values.summary.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.summary.service.targetPort }}
+              protocol: TCP
+          {{- if .Values.summary.probes.liveness }}
+          livenessProbe:
+            {{- include "meet.probes.abstract" (merge .Values.summary.probes.liveness (dict "targetPort" .Values.summary.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.summary.probes.readiness }}
+          readinessProbe:
+            {{- include "meet.probes.abstract" (merge .Values.summary.probes.readiness (dict "targetPort" .Values.summary.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.summary.probes.startup }}
+          startupProbe:
+            {{- include "meet.probes.abstract" (merge .Values.summary.probes.startup (dict "targetPort" .Values.summary.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- with .Values.summary.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            {{- range $index, $value := .Values.mountFiles }}
+            - name: "files-{{ $index }}"
+              mountPath: {{ $value.path }}
+              subPath: content
+            {{- end }}
+            {{- range $name, $volume := .Values.summary.persistence }}
+            - name: "{{ $name }}"
+              mountPath: "{{ $volume.mountPath }}"
+            {{- end }}
+            {{- range .Values.summary.extraVolumeMounts }}
+            - name: {{ .name }}
+              mountPath: {{ .mountPath }}
+              subPath: {{ .subPath | default "" }}
+              readOnly: {{ .readOnly }}
+            {{- end }}
+      {{- with .Values.summary.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.summary.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.summary.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        {{- range $index, $value := .Values.mountFiles }}
+        - name: "files-{{ $index }}"
+          configMap:
+            name: "{{ include "meet.fullname" $ }}-files-{{ $index }}"
+        {{- end }}
+        {{- range $name, $volume := .Values.summary.persistence }}
+        - name: "{{ $name }}"
+          {{- if eq $volume.type "emptyDir" }}
+          emptyDir: {}
+          {{- else }}
+          persistentVolumeClaim:
+            claimName: "{{ $fullName }}-{{ $name }}"
+          {{- end }}
+        {{- end }}
+        {{- range .Values.summary.extraVolumes }}
+        - name: {{ .name }}
+          {{- if .existingClaim }}
+          persistentVolumeClaim:
+            claimName: {{ .existingClaim }}
+          {{- else if .hostPath }}
+          hostPath:
+            {{ toYaml .hostPath | nindent 12 }}
+          {{- else if .csi }}
+          csi:
+            {{- toYaml .csi | nindent 12 }}
+          {{- else if .configMap }}
+          configMap:
+            {{- toYaml .configMap | nindent 12 }}
+          {{- else if .emptyDir }}
+          emptyDir:
+            {{- toYaml .emptyDir | nindent 12 }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        {{- end }}

src/helm/meet/templates/summary_secrets.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: summary
+  namespace: {{ .Release.Namespace | quote }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-5"
+    "helm.sh/hook-delete-policy": before-hook-creation
+stringData:
+  APP_API_TOKEN: {{ .Values.appApiToken }}
+  OPENAI_API_KEY: {{ .Values.openaiApiKey }}
+  WEBHOOK_API_TOKEN: {{ .Values.webhookApiToken }}
+

src/helm/meet/templates/summary_svc.yaml

@@ -0,0 +1,21 @@
+{{- $envVars := include "meet.common.env" (list . .Values.summary) -}}
+{{- $fullName := include "meet.summary.fullname" . -}}
+{{- $component := "summary" -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "meet.common.labels" (list . $component) | nindent 4 }}
+  annotations:
+    {{- toYaml $.Values.summary.service.annotations | nindent 4 }}
+spec:
+  type: {{ .Values.summary.service.type }}
+  ports:
+    - port: {{ .Values.summary.service.port }}
+      targetPort: {{ .Values.summary.service.targetPort }}
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "meet.common.selectorLabels" (list . $component) | nindent 4 }}

src/helm/meet/values.yaml

@@ -305,3 +305,184 @@ posthog:
     externalName: eu-assets.i.posthog.com
     port: 443
     annotations: {}
+
+
+## @section summary
+
+summary:
+
+  ## @param summary.command Override the summary container command
+  command: []
+
+  ## @param summary.args Override the summary container args
+  args: []
+
+  ## @param summary.replicas Amount of summary replicas
+  replicas: 1
+
+  ## @param summary.shareProcessNamespace Enable share process namespace between containers
+  shareProcessNamespace: false
+
+  ## @param summary.sidecars Add sidecars containers to summary deployment
+  sidecars: []
+
+  ## @param summary.migrateJobAnnotations Annotations for the migrate job
+  migrateJobAnnotations: {}
+
+  ## @param summary.securityContext Configure summary Pod security context
+  securityContext: null
+
+  ## @param summary.envVars Configure summary container environment variables
+  ## @extra summary.envVars.BY_VALUE Example environment variable by setting value directly
+  ## @extra summary.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
+  ## @extra summary.envVars.FROM_CONFIGMAP.configMapKeyRef.key Key within a ConfigMap when configuring env vars from a ConfigMap
+  ## @extra summary.envVars.FROM_SECRET.secretKeyRef.name Name of a Secret when configuring env vars from a Secret
+  ## @extra summary.envVars.FROM_SECRET.secretKeyRef.key Key within a Secret when configuring env vars from a Secret
+  ## @skip summary.envVars
+  envVars:
+    <<: *commonEnvVars
+
+  ## @param summary.podAnnotations Annotations to add to the summary Pod
+  podAnnotations: {}
+
+  ## @param summary.service.type summary Service type
+  ## @param summary.service.port summary Service listening port
+  ## @param summary.service.targetPort summary container listening port
+  ## @param summary.service.annotations Annotations to add to the summary Service
+  service:
+    type: ClusterIP
+    port: 80
+    targetPort: 8000
+    annotations: {}
+
+  ## @param summary.probes.liveness.path [nullable] Configure path for summary HTTP liveness probe
+  ## @param summary.probes.liveness.targetPort [nullable] Configure port for summary HTTP liveness probe
+  ## @param summary.probes.liveness.initialDelaySeconds [nullable] Configure initial delay for summary liveness probe
+  ## @param summary.probes.liveness.initialDelaySeconds [nullable] Configure timeout for summary liveness probe
+  ## @param summary.probes.startup.path [nullable] Configure path for summary HTTP startup probe
+  ## @param summary.probes.startup.targetPort [nullable] Configure port for summary HTTP startup probe
+  ## @param summary.probes.startup.initialDelaySeconds [nullable] Configure initial delay for summary startup probe
+  ## @param summary.probes.startup.initialDelaySeconds [nullable] Configure timeout for summary startup probe
+  ## @param summary.probes.readiness.path [nullable] Configure path for summary HTTP readiness probe
+  ## @param summary.probes.readiness.targetPort [nullable] Configure port for summary HTTP readiness probe
+  ## @param summary.probes.readiness.initialDelaySeconds [nullable] Configure initial delay for summary readiness probe
+  ## @param summary.probes.readiness.initialDelaySeconds [nullable] Configure timeout for summary readiness probe
+  probes:
+    liveness:
+      path: /__heartbeat__
+      initialDelaySeconds: 30
+    readiness:
+      path: /__lbheartbeat__
+      initialDelaySeconds: 30
+
+  ## @param summary.resources Resource requirements for the summary container
+  resources: {}
+
+  ## @param summary.nodeSelector Node selector for the summary Pod
+  nodeSelector: {}
+
+  ## @param summary.tolerations Tolerations for the summary Pod
+  tolerations: []
+
+  ## @param summary.affinity Affinity for the summary Pod
+  affinity: {}
+
+  ## @param summary.persistence Additional volumes to create and mount on the summary. Used for debugging purposes
+  ## @extra summary.persistence.volume-name.size Size of the additional volume
+  ## @extra summary.persistence.volume-name.type Type of the additional volume, persistentVolumeClaim or emptyDir
+  ## @extra summary.persistence.volume-name.mountPath Path where the volume should be mounted to
+  persistence: {}
+
+  ## @param summary.extraVolumeMounts Additional volumes to mount on the summary.
+  extraVolumeMounts: []
+
+  ## @param summary.extraVolumes Additional volumes to mount on the summary.
+  extraVolumes: []
+
+
+## @section celery
+
+celery:
+
+  ## @param celery.command Override the celery container command
+  command: []
+
+  ## @param celery.args Override the celery container args
+  args: []
+
+  ## @param celery.replicas Amount of celery replicas
+  replicas: 1
+
+  ## @param celery.shareProcessNamespace Enable share process namespace between containers
+  shareProcessNamespace: false
+
+  ## @param celery.sidecars Add sidecars containers to celery deployment
+  sidecars: []
+
+  ## @param celery.migrateJobAnnotations Annotations for the migrate job
+  migrateJobAnnotations: {}
+
+  ## @param celery.securityContext Configure celery Pod security context
+  securityContext: null
+
+  ## @param celery.envVars Configure celery container environment variables
+  ## @extra celery.envVars.BY_VALUE Example environment variable by setting value directly
+  ## @extra celery.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
+  ## @extra celery.envVars.FROM_CONFIGMAP.configMapKeyRef.key Key within a ConfigMap when configuring env vars from a ConfigMap
+  ## @extra celery.envVars.FROM_SECRET.secretKeyRef.name Name of a Secret when configuring env vars from a Secret
+  ## @extra celery.envVars.FROM_SECRET.secretKeyRef.key Key within a Secret when configuring env vars from a Secret
+  ## @skip celery.envVars
+  envVars:
+    <<: *commonEnvVars
+
+  ## @param celery.podAnnotations Annotations to add to the celery Pod
+  podAnnotations: {}
+
+  ## @param celery.service.type celery Service type
+  ## @param celery.service.port celery Service listening port
+  ## @param celery.service.targetPort celery container listening port
+  ## @param celery.service.annotations Annotations to add to the celery Service
+  service:
+    type: ClusterIP
+    port: 80
+    targetPort: 8000
+    annotations: {}
+
+  ## @param celery.probes.liveness.path [nullable] Configure path for celery HTTP liveness probe
+  ## @param celery.probes.liveness.targetPort [nullable] Configure port for celery HTTP liveness probe
+  ## @param celery.probes.liveness.initialDelaySeconds [nullable] Configure initial delay for celery liveness probe
+  ## @param celery.probes.liveness.initialDelaySeconds [nullable] Configure timeout for celery liveness probe
+  ## @param celery.probes.startup.path [nullable] Configure path for celery HTTP startup probe
+  ## @param celery.probes.startup.targetPort [nullable] Configure port for celery HTTP startup probe
+  ## @param celery.probes.startup.initialDelaySeconds [nullable] Configure initial delay for celery startup probe
+  ## @param celery.probes.startup.initialDelaySeconds [nullable] Configure timeout for celery startup probe
+  ## @param celery.probes.readiness.path [nullable] Configure path for celery HTTP readiness probe
+  ## @param celery.probes.readiness.targetPort [nullable] Configure port for celery HTTP readiness probe
+  ## @param celery.probes.readiness.initialDelaySeconds [nullable] Configure initial delay for celery readiness probe
+  ## @param celery.probes.readiness.initialDelaySeconds [nullable] Configure timeout for celery readiness probe
+  probes: {}
+
+  ## @param celery.resources Resource requirements for the celery container
+  resources: {}
+
+  ## @param celery.nodeSelector Node selector for the celery Pod
+  nodeSelector: {}
+
+  ## @param celery.tolerations Tolerations for the celery Pod
+  tolerations: []
+
+  ## @param celery.affinity Affinity for the celery Pod
+  affinity: {}
+
+  ## @param celery.persistence Additional volumes to create and mount on the celery. Used for debugging purposes
+  ## @extra celery.persistence.volume-name.size Size of the additional volume
+  ## @extra celery.persistence.volume-name.type Type of the additional volume, persistentVolumeClaim or emptyDir
+  ## @extra celery.persistence.volume-name.mountPath Path where the volume should be mounted to
+  persistence: {}
+
+  ## @param celery.extraVolumeMounts Additional volumes to mount on the celery.
+  extraVolumeMounts: []
+
+  ## @param celery.extraVolumes Additional volumes to mount on the celery.
+  extraVolumes: []
+

src/summary/Dockerfile

@@ -0,0 +1,17 @@
+FROM python:3.12-slim AS builder
+
+WORKDIR /app
+
+COPY pyproject.toml .
+
+RUN pip3 install --no-cache-dir .
+
+FROM python:3.12-slim AS production
+
+WORKDIR /app
+
+COPY --from=builder /usr/local /usr/local
+COPY ./summary /app/summary
+
+
+CMD ["uvicorn", "summary.main:app", "--proxy-headers", "--host", "0.0.0.0", "--port", "8000"]

src/summary/compose.yaml

@@ -0,0 +1,27 @@
+services:
+  redis:
+    image: redis
+    ports:
+      - "6379:6379"
+  app:
+    container_name: app
+    build: .
+    command: uvicorn summary.main:app --host 0.0.0.0 --port 8000 --reload
+    volumes:
+      - .:/app
+    ports:
+      - "8000:8000"
+    restart: always
+    env_file:
+      ".env"
+    depends_on:
+      - redis
+  celery_worker:
+    container_name: celery_worker
+    build: .
+    command: celery -A summary.celery_worker worker --pool=solo --loglevel=debug
+    volumes:
+      - .:/app
+    depends_on:
+      - redis
+      - app

src/summary/pyproject.toml

@@ -0,0 +1,64 @@
+
+[project]
+name = "summary"
+version = "0.1.0"
+dependencies = [
+    "fastapi[standard]>=0.105.0",
+    "uvicorn>=0.24.0",
+    "pydantic>=2.5.0",
+    "pydantic-settings>=2.1.0",
+    "celery==5.4.0",
+    "redis==4.5.4",
+    "minio==7.2.9",
+    "openai==1.51.2",
+    "requests==2.32.3",
+]
+
+[project.optional-dependencies]
+dev = [
+    "ruff==0.7.4",
+]
+
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+
+[tool.ruff]
+target-version = "py310"
+
+[tool.ruff.lint]
+select = [
+    "B",  # flake8-bugbear
+    "C4",  # flake8-comprehensions
+    "D",  # pydocstyle
+    "E",  # pycodestyle error
+    "F",  # Pyflakes
+    "I",  # Isort
+    "ISC",  # flake8-implicit-str-concat
+    "PLC",  # Pylint Convention
+    "PLE",  # Pylint Error
+    "PLR",  # Pylint Refactor
+    "PLW",  # Pylint Warning
+    "RUF100",  # Ruff unused-noqa
+    "S",  # flake8-bandit
+    "T20", # flake8-print
+    "W",  # pycodestyle warning
+]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/*" = [
+    "S101", # use of assert
+]
+
+[tool.ruff.lint.pydocstyle]
+# Use Google-style docstrings.
+convention = "google"
+
+[tool.ruff.lint.flake8-bugbear]
+extend-immutable-calls = [
+  "fastapi.Depends",
+  "fastapi.params.Depends",
+  "fastapi.params.Query",
+  "fastapi.Query",
+]

src/summary/summary/__init__.py

@@ -0,0 +1 @@
+"""Summary package."""

src/summary/summary/celery_worker.py

@@ -0,0 +1,127 @@
+"""Celery workers."""
+
+import json
+import tempfile
+from pathlib import Path
+
+import openai
+from celery import Celery
+from celery.utils.log import get_task_logger
+from minio import Minio
+from requests import Session
+from requests.adapters import HTTPAdapter
+from urllib3.util import Retry
+
+from .config import Settings
+from .prompt import get_instructions
+
+settings = Settings()
+
+
+logger = get_task_logger(__name__)
+
+celery = Celery(
+    __name__,
+    broker=settings.celery_broker_url,
+    backend=settings.celery_result_backend,
+    broker_connection_retry_on_startup=True,
+)
+
+
+def save_audio_stream(audio_stream, chunk_size=32 * 1024):
+    """Save an audio stream to a temporary OGG file."""
+    with tempfile.NamedTemporaryFile(suffix=".ogg", delete=False) as tmp:
+        tmp.writelines(audio_stream.stream(chunk_size))
+        return Path(tmp.name)
+
+
+def create_retry_session():
+    """Create an HTTP session configured with retry logic."""
+    session = Session()
+    retries = Retry(
+        total=settings.webhook_max_retries,
+        backoff_factor=settings.webhook_backoff_factor,
+        status_forcelist=settings.webhook_status_forcelist,
+        allowed_methods={"POST"},
+    )
+    session.mount("https://", HTTPAdapter(max_retries=retries))
+    return session
+
+
+def post_with_retries(url, data):
+    """Send POST request with automatic retries."""
+    session = create_retry_session()
+    session.headers.update({"Authorization": f"Bearer {settings.webhook_api_token}"})
+    try:
+        response = session.post(url, json=data)
+        response.raise_for_status()
+        return response
+    finally:
+        session.close()
+
+
+@celery.task(max_retries=1)
+def process_audio_transcribe_summarize(filename: str, email: str, sub: str):
+    """Process an audio file by transcribing it and generating a summary.
+
+    This Celery task performs the following operations:
+    1. Retrieves the audio file from MinIO storage
+    2. Transcribes the audio using OpenAI-compliant API's ASR model
+    3. Generates a summary of the transcription using OpenAI-compliant API's LLM
+    4. Sends the results via webhook
+    """
+    logger.info("Notification received")
+    logger.debug("filename: %s", filename)
+
+    minio_client = Minio(
+        settings.aws_s3_endpoint_url,
+        access_key=settings.aws_s3_access_key_id,
+        secret_key=settings.aws_s3_secret_access_key,
+        secure=settings.aws_s3_secure_access,
+    )
+
+    logger.debug("Connection to the Minio bucket successful")
+
+    audio_file_stream = minio_client.get_object(
+        settings.aws_storage_bucket_name, object_name=filename
+    )
+
+    temp_file_path = save_audio_stream(audio_file_stream)
+    logger.debug("Recording successfully downloaded, filepath: %s", temp_file_path)
+
+    logger.debug("Initiating OpenAI client")
+    openai_client = openai.OpenAI(
+        api_key=settings.openai_api_key, base_url=settings.openai_base_url
+    )
+
+    logger.debug("Querying transcription …")
+    with open(temp_file_path, "rb") as audio_file:
+        transcription = openai_client.audio.transcriptions.create(
+            model=settings.openai_asr_model, file=audio_file
+        )
+
+        transcription = transcription.text
+
+        logger.debug("Transcription: \n %s", transcription)
+
+    instructions = get_instructions(transcription)
+    summary_response = openai_client.chat.completions.create(
+        model=settings.openai_llm_model, messages=instructions
+    )
+
+    summary = summary_response.choices[0].message.content
+    logger.debug("Summary: \n %s", summary)
+
+    data = {
+        "summary": summary,
+        "email": email,
+        "sub": sub,
+    }
+
+    logger.debug("Submitting webhook to %s", settings.webhook_url)
+    logger.debug("Request payload: %s", json.dumps(data, indent=2))
+
+    response = post_with_retries(settings.webhook_url, data)
+
+    logger.info("Webhook submitted successfully. Status: %s", response.status_code)
+    logger.debug("Response body: %s", response.text)

src/summary/summary/config.py

@@ -0,0 +1,48 @@
+"""Application configuration and settings."""
+
+from functools import lru_cache
+from typing import Annotated
+
+from fastapi import Depends
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    """Configuration settings loaded from environment variables and .env file."""
+
+    app_name: str = "Awesome API"
+    model_config = SettingsConfigDict(env_file=".env")
+    app_api_token: str
+
+    # Celery settings
+    celery_broker_url: str = "redis://redis/0"
+    celery_result_backend: str = "redis://redis/0"
+
+    # Minio settings
+    aws_storage_bucket_name: str
+    aws_s3_endpoint_url: str
+    aws_s3_access_key_id: str
+    aws_s3_secret_access_key: str
+    aws_s3_secure_access: bool = True
+
+    # AI-related settings
+    openai_api_key: str
+    openai_base_url: str = "https://api.openai.com/v1"
+    openai_asr_model: str = "whisper-1"
+    openai_llm_model: str = "gpt-4o"
+
+    # Webhook-related settings
+    webhook_max_retries: int = 2
+    webhook_status_forcelist: list[int] = [502, 503, 504]
+    webhook_backoff_factor: float = 0.1
+    webhook_api_token: str
+    webhook_url: str
+
+
+@lru_cache
+def get_settings():
+    """Load and cache application settings."""
+    return Settings()
+
+
+SettingsDeps = Annotated[Settings, Depends(get_settings)]

src/summary/summary/main.py

@@ -0,0 +1,46 @@
+"""Application endpoint."""
+
+from celery.result import AsyncResult
+from fastapi import Depends, FastAPI
+from pydantic import BaseModel
+
+from .celery_worker import process_audio_transcribe_summarize
+from .security import verify_token
+
+app = FastAPI()
+
+
+@app.get("/__heartbeat__")
+async def heartbeat():
+    """Health check endpoint for monitoring."""
+    return {"status": "ok"}
+
+
+@app.get("/__lbheartbeat__")
+async def lbheartbeat():
+    """Health check endpoint for load balancer."""
+    return {"status": "ok"}
+
+
+class NotificationRequest(BaseModel):
+    """Notification data."""
+
+    filename: str
+    email: str
+    sub: str
+
+
+@app.post("/push")
+async def notify(request: NotificationRequest, token: str = Depends(verify_token)):
+    """Push a notification."""
+    task = process_audio_transcribe_summarize.delay(
+        request.filename, request.email, request.sub
+    )
+    return {"task_id": task.id, "message": "Notification sent"}
+
+
+@app.get("/status/{task_id}")
+async def get_status(task_id: str, token: str = Depends(verify_token)):
+    """Check task status by ID."""
+    task = AsyncResult(task_id)
+    return {"task_id": task_id, "status": task.status}

src/summary/summary/prompt.py

@@ -0,0 +1,52 @@
+# ruff: noqa
+
+
+def get_instructions(transcript):
+    """Wip."""
+    prompt = f"""
+    Audience: Coworkers.
+
+    **Do:**
+    - Detect the language of the transcript and provide your entire response in the same language.
+    - If any part of the transcript is unclear or lacks detail, politely inform the user, specifying which areas need further clarification.
+    - Ensure the accuracy of all information and refrain from adding unverified details.
+    - Format the response using proper markdown and structured sections.
+    - Be concise and avoid repeating yourself between the sections.
+    - Be super precise on nickname
+    - Be a nit-picker
+    - Auto-evaluate your response
+
+    **Don't:**
+    - Write something your are not sure.
+    - Write something that is not mention in the transcript.
+    - Don't make mistake while mentioning someone
+    **Task:**
+    Summarize the provided meeting transcript into clear and well-organized meeting minutes. The summary should be structured into the following sections, excluding irrelevant or inapplicable details:
+
+    1. **Summary**: Write a  TL;DR of the meeting.
+    2. **Subjects Discussed**: List the key points or issues in bullet points.
+    4. **Next Steps**: Provide action items as bullet points, assigning each task to a responsible individual and including deadlines (if mentioned). Format action items as tickable checkboxes. Ensure every action is assigned and, if a deadline is provided, that it is clearly stated.
+
+    **Transcript**:  
+    {transcript}
+
+    **Response:**
+
+    ### Summary [Translate this title based on the transcript’s language]
+    [Provide a brief overview of the key points discussed]
+
+    ### Subjects Discussed [Translate this title based on the transcript’s language]
+    - [Summarize each topic concisely]
+
+    ### Next Steps [Translate this title based on the transcript’s language]  
+    - [ ] Action item [Assign to the responsible individual(s) and include a deadline if applicable, follow this strict format: Action - List of owner(s), deadline.]
+
+    """
+
+    return [
+        {
+            "role": "system",
+            "content": "You are a concise and structured assistant, that summarizes meeting transcripts.",
+        },
+        {"role": "user", "content": prompt},
+    ]

src/summary/summary/security.py

@@ -0,0 +1,19 @@
+"""Application security."""
+
+from fastapi import HTTPException, Security
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from .config import SettingsDeps
+
+security = HTTPBearer()
+
+
+def verify_token(
+    settings: SettingsDeps,
+    credentials: HTTPAuthorizationCredentials = Security(security),  # noqa: B008
+):
+    """Verify the bearer token from the Authorization header."""
+    token = credentials.credentials
+    if token != settings.app_api_token:
+        raise HTTPException(status_code=401, detail="Invalid token")
+    return token