webapp v2

.gitignore

@@ -122,6 +122,7 @@ celerybeat.pid
 
 # Environments
 .env
+.env.*
 .venv
 env/
 venv/
@@ -162,4 +163,7 @@ cython_debug/
 
 # do not push anythin in the condensed/out folder apart from .gitkeep
 condensed/out/*
-!condensed/out/.gitkeep
+!condensed/out/.gitkeep
+
+# macOS
+.DS_Store

app/Dockerfile.client

@@ -2,17 +2,27 @@
 # Provides proxies / api requests
 
 # Build React frontend
-FROM node:16-alpine as build-step 
+FROM node:20-alpine as build 
 WORKDIR /app 
-ENV PATH /app/node_modules/.bin:$PATH
+
+# Provide the site key at build time (public value)
+ARG REACT_APP_TURNSTILE_SITE_KEY
+ENV REACT_APP_TURNSTILE_SITE_KEY=${REACT_APP_TURNSTILE_SITE_KEY}
+
+# Install dependencies with cache-friendly order
 COPY ./src/client/package.json ./src/client/package-lock.json ./
+RUN npm ci
+
+# Build
 COPY ./src/client/src ./src
 COPY ./src/client/public ./public
-RUN npm install 
 RUN npm run build 
-COPY ./src/client/deployment/nginx.default.conf /etc/nginx/conf.d/default.conf
 
-# Build nginx container 
+# Nginx runtime
 FROM nginx:stable-alpine 
-COPY --from=build-step ./app/build /usr/share/nginx/html 
-COPY --from=build-step ./etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf
+
+COPY --from=build /app/build /usr/share/nginx/html
+COPY ./src/client/deployment/nginx.default.conf /etc/nginx/conf.d/default.conf
+
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]

app/Dockerfile.server

@@ -1,25 +1,51 @@
-# This Dockerfile builds API only
-FROM python:3.9 
+# Use Mambaforge for fast, reliable conda solves (includes mamba)
+FROM condaforge/mambaforge:24.9.2-0
 
-WORKDIR /app 
-COPY ./src/server/ ./
-RUN pip install -r ./requirements.txt 
-ENV FLASK_ENV production 
+# Make non-interactive shells load conda env nicely
+SHELL ["/bin/bash", "-lc"]
 
-EXPOSE 4009
+# Create a non-root user for saner file permissions
+ARG USERNAME=app
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+RUN groupadd --gid $USER_GID $USERNAME \
+ && useradd  --uid $USER_UID --gid $USER_GID -m $USERNAME
 
-# Install HMMER2
-RUN apt-get update 
-RUN apt-get install -y hmmer2
+# Workdir
+WORKDIR /app
 
-# Install MUSCLE
-RUN mkdir muscle
-WORKDIR /app/muscle
-RUN wget https://drive5.com/muscle/muscle_src_3.8.1551.tar.gz
-RUN tar -xvzf muscle_src_3.8.1551.tar.gz
-RUN make
-RUN cp muscle /usr/local/bin/muscle
+# Copy env first to leverage Docker layer caching
+COPY server-environment.yml /app/
+COPY server-requirements.txt /app/
 
-WORKDIR /app
+# Create Conda env with mamba (faster) and clean caches
+RUN mamba env create -n web -f server-environment.yml \
+ && conda clean -afy
+
+# Ensure `conda run -n web ...` works for ENTRYPOINT/CMD
+RUN echo "conda activate web" >> /etc/bash.bashrc
+
+# Copy the app code and give ownership to the non-root user
+COPY --chown=${USER_UID}:${USER_GID} ./src/server/ /app/
+
+# Ensure temp dir exists and is writable
+RUN mkdir -p /app/temp && chown -R ${USER_UID}:${USER_GID} /app
+
+# Runtime env: unbuffered logs, mmap for joblib, cap math threads
+ENV PYTHONUNBUFFERED=1 \
+    LOG_LEVEL=INFO \
+    OMP_NUM_THREADS=1 \
+    OPENBLAS_NUM_THREADS=1 \
+    MKL_NUM_THREADS=1 \
+    NUMEXPR_NUM_THREADS=1 \
+    JOBLIB_MMAP_MODE=r
+
+# Use the unprivileged user at runtime
+USER $USERNAME
+
+# Expose your service port
+EXPOSE 4009
 
-CMD ["sh", "-c", "gunicorn -b :4009 --timeout 120 api:app"]
+# Run everything inside the conda env without needing manual activation
+ENTRYPOINT ["conda", "run", "--no-capture-output", "-n", "web"]
+CMD ["gunicorn", "-b", ":4009", "--worker-class", "gthread", "--workers", "1", "--threads", "4", "--preload", "--timeout", "120", "api:app"]

app/docker-compose.yml

@@ -7,25 +7,44 @@ services:
       dockerfile: Dockerfile.server
     image: paras-server
     restart: always
+    env_file:
+      - .env  # Need secrets for submitting newly annotated domains
     container_name: paras-server
     volumes:
-      - ./models:/app/models
+      - ./models:/app/models:ro
     environment:
       - MODEL_DIR=/app/models
-    networks:
-      - paras-network
+      - LOG_LEVEL=INFO
+      # Also set in Dockerfile, can override here
+      - OMP_NUM_THREADS=1
+      - OPENBLAS_NUM_THREADS=1
+      - MKL_NUM_THREADS=1
+      - NUMEXPR_NUM_THREADS=1
+      - JOBLIB_MMAP_MODE=r
+    networks: [paras-network]
+    healthcheck:
+      # Use base Python; no curl/wget dependency needed
+      test: [ "CMD", "/opt/conda/bin/python", "-c",
+              "import urllib.request,sys; urllib.request.urlopen('http://localhost:4009/health', timeout=2); sys.exit(0)" ]
+      interval: 10s
+      timeout: 3s
+      retries: 10
+      start_period: 5s
 
   paras-client:
     build: 
       context: . 
       dockerfile: Dockerfile.client 
+      args:
+        - REACT_APP_TURNSTILE_SITE_KEY=${REACT_APP_TURNSTILE_SITE_KEY}
     image: paras-client
     ports:
       - "4010:80"
     restart: always
     container_name: paras-client
-    networks:
-      - paras-network
+    networks: [paras-network]
+    depends_on:
+      - paras-server
 
 networks:
   paras-network:

app/server-environment.yml

@@ -0,0 +1,17 @@
+name: web
+channels:
+  - conda-forge
+  - bioconda
+dependencies:
+  # Python runtime
+  - python=3.9
+
+  # Bio tools (from bioconda)
+  - hmmer             # HMMER v3 (hmmsearch, hmmscan, hmmpress, etc.)
+  - hmmer2            # HMMER v2 (e.g., hmmpfam, hmmsearch from v2 toolset)
+  - muscle=3.8.1551   # MUSCLE aligner
+
+  # Extra PyPI deps
+  - pip
+  - pip:
+      - -r /app/server-requirements.txt

app/src/server/requirements.txt → app/server-requirements.txt

@@ -6,4 +6,5 @@ flask_sqlalchemy
 gunicorn
 joblib
 apscheduler
-git+https://github.com/BTheDragonMaster/parasect@webapp
+psutil
+git+https://github.com/BTheDragonMaster/parasect@webapp_dev_docker

app/src/client/deployment/nginx.default.conf

@@ -1,37 +1,64 @@
-# nginx configuration for Docker.
+# nginx configuration for Docker (React SPA + API proxy)
 server {
-    listen 80;
-    server_name localhost;
-    root /usr/share/nginx/html;
-    index index.html;
-    error_page 500 502 503 504  /50x.html;
-
-    location / {
-        try_files $uri $uri/ /index.html$is_args$args =404; # https://stackoverflow.com/questions/43555282/react-js-application-showing-404-not-found-in-nginx-server
-        add_header Cache-Control "no-cache";
-    }
+  listen 80;
+  server_name _;
 
-    location /static {
-        expires 1y;
-        add_header Cache-Control "public";
-    }
+  root /usr/share/nginx/html;
+  index index.html;
+
+  # Serve static assets with long cache (immutable)
+  location /static/ {
+    try_files $uri =404;
+    access_log off;
+    expires 1y;
+    add_header Cache-Control "public, max-age=31536000, immutable";
+  }
+
+  # API proxy
+  location /api/ {
+    proxy_pass http://paras-server:4009;  # do not add slash at end!
+
+    # pass-thru headers
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    # websockets / SSE (if you ever use them)
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
 
-    location /api {
-        proxy_pass http://paras-server:4009;
-
-        # CORS headers
-        add_header Access-Control-Allow-Origin "*";
-        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
-        add_header Access-Control-Allow-Headers "Content-Type, Authorization";
-
-        # Handle preflight requests (for POST requests)
-        if ($request_method = 'OPTIONS') {
-            add_header Access-Control-Allow-Origin "*";
-            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
-            add_header Access-Control-Allow-Headers "Content-Type, Authorization";
-            add_header Content-Length 0;
-            add_header Content-Type text/plain;
-            return 204;
-        }
+    # (optional) timeouts for long requests
+    proxy_read_timeout 300s;
+    proxy_send_timeout 300s;
+
+    # CORS (only if you need cross-origin; if served via same origin, you can remove)
+    add_header Access-Control-Allow-Origin "*" always;
+    add_header Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS" always;
+    add_header Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With" always;
+
+    # Preflight
+    if ($request_method = OPTIONS) {
+      return 204;
     }
-}
+  }
+
+  # SPA fallback (client-side routing)
+  location / {
+    try_files $uri /index.html;
+    # Avoid caching index.html so new deploys show up
+    add_header Cache-Control "no-cache";
+  }
+
+  # Friendly error page
+  error_page 500 502 503 504 /50x.html;
+  location = /50x.html { 
+    internal;
+  }
+}
+
+# Globals
+map $http_upgrade $connection_upgrade {
+  default upgrade;
+  ''      close;
+}