Run the web UI entirely in the browser
The FastAPI backend kept one analysis session shared by every visitor and spooled each upload to the server's /tmp, and the browser copied audio into persistent OPFS storage. None of that fits a tool for unreleased masters, so the web UI is now a static site that decodes and analyses in the tab: - web/decode.js: WAV/AIFF PCM and float read directly with libsndfile's scaling (bit-identical to librosa.load; Chromium's WAV decoder scales positive int16 by 1/32767), other formats via decodeAudioData on an OfflineAudioContext at the header-sniffed native rate. ID3 song names. - web/dsp.js: ports of every Metric.compute with the same numerics (pyloudnorm K-weighting via lfilter's DF2T recurrence, BS.1770 gating, EBU LRA, resample_poly's Kaiser filter for true peak, librosa.stft and amplitude_to_db), streaming passes with no signal-length intermediates. - web/metrics.js: build_spec ports producing the existing plot payload. - web/analysis-worker.js + app.js: per-tab track list and result cache, a worker job queue where the visible metric jumps background prefetch, and the renderer, which now also draws the metrics' own reference lines. Deployment is nginx-unprivileged serving web/ read-only with Content-Security-Policy connect-src 'none', so the page cannot make network requests at all, and no access log. No secure context is needed, so plain http on a LAN works. The Python web backend, its smoke test, the web extra and the OPFS store are removed; the desktop app is unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015UXA39Sh9coAx4FhRkd8R2
This commit is contained in:
+12
-81
@@ -1,88 +1,19 @@
|
||||
# uj-mastering-master — web UI
|
||||
#
|
||||
# Multi-stage on purpose: the build stage compiles wheels (librosa pulls in
|
||||
# scipy, numba and llvmlite, all of which have C extensions), and none of that
|
||||
# toolchain belongs in the runtime image.
|
||||
# The web UI is a static site: decoding and every metric run in the visitor's
|
||||
# browser (web/dsp.js inside a Web Worker). This image only serves files — no
|
||||
# application server, no upload endpoint, nothing written anywhere — so it runs
|
||||
# read-only as nginx's unprivileged user. See deploy/nginx.conf for the CSP that
|
||||
# stops the page from making network requests at all.
|
||||
#
|
||||
# The runtime image installs the *installed package*, not a source tree, so the
|
||||
# same image works whether you built it from a checkout or a release tarball.
|
||||
#
|
||||
# Note on audio: the web UI stores uploaded audio in the browser (OPFS) and
|
||||
# spools each request body to /tmp only for the duration of that request. There
|
||||
# is no volume for audio, because the app never keeps any — see README.
|
||||
#
|
||||
# Note on the desktop app: this image is the *web* front end only. PyQt5 and
|
||||
# pyqtgraph are deliberately not installed — there is no display in a container.
|
||||
# The desktop app (PyQt5) is unaffected and not part of this image.
|
||||
|
||||
# ---- build -----------------------------------------------------------------
|
||||
FROM python:3.11-slim AS build
|
||||
FROM nginxinc/nginx-unprivileged:stable-alpine
|
||||
|
||||
ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
|
||||
PIP_NO_CACHE_DIR=1 \
|
||||
UV_LINK_MODE=copy
|
||||
COPY deploy/nginx.conf /etc/nginx/conf.d/default.conf
|
||||
COPY web/ /usr/share/nginx/html/
|
||||
|
||||
# numba/llvmlite and scipy need a compiler; libsndfile is what soundfile
|
||||
# (librosa's decoder) links against at runtime, but the wheel needs it at build
|
||||
# time to be detected.
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
build-essential \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
EXPOSE 8080
|
||||
|
||||
COPY --from=ghcr.io/astral-sh/uv:0.12.5 /uv /usr/local/bin/uv
|
||||
|
||||
WORKDIR /src
|
||||
# Copy the whole checkout minus .dockerignore. Deliberately not a hand-picked
|
||||
# file list: `py-modules` in pyproject.toml enumerates every module the build
|
||||
# backend must find, and a curated COPY that omits any of them fails the build
|
||||
# with "file <module>.py not found". The exclusions that matter (venv, caches,
|
||||
# .git, local state) are in .dockerignore, which is the right place for them.
|
||||
COPY . .
|
||||
|
||||
# Build a wheel, then install it into a self-contained prefix to copy forward.
|
||||
# `"uj-mastering-master[web]"` (not `--extra web`) is the syntax uv wants when
|
||||
# installing a source tree — `--extra` needs a lockfile/setup.py it does not
|
||||
# have here and fails with "Requesting extras requires a pylock.toml...".
|
||||
RUN uv venv /opt/venv \
|
||||
&& uv pip install --python /opt/venv/bin/python --no-cache \
|
||||
".[web]"
|
||||
|
||||
# ---- runtime ---------------------------------------------------------------
|
||||
FROM python:3.11-slim AS runtime
|
||||
|
||||
# libsndfile1 is the only runtime system dependency: librosa decodes through
|
||||
# soundfile, which dlopens it. Everything else is a self-contained wheel.
|
||||
# (FFmpeg is *not* needed — it only ever generated test fixtures.)
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
libsndfile1 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Non-root, with a home it can actually write to: librosa/numba want a cache
|
||||
# dir, and the app spools request bodies under /tmp.
|
||||
RUN useradd --create-home --uid 10001 --shell /usr/sbin/nologin ujm
|
||||
|
||||
COPY --from=build /opt/venv /opt/venv
|
||||
|
||||
ENV PATH=/opt/venv/bin:$PATH \
|
||||
PYTHONUNBUFFERED=1 \
|
||||
PYTHONDONTWRITEBYTECODE=1 \
|
||||
HOME=/home/ujm \
|
||||
NUMBA_CACHE_DIR=/tmp/numba-cache \
|
||||
MPLCONFIGDIR=/tmp/matplotlib
|
||||
|
||||
# The app's temporary spools land here. Declared so a read-only root filesystem
|
||||
# can still be used (`read_only: true` + `tmpfs: /tmp` in compose).
|
||||
VOLUME ["/tmp"]
|
||||
|
||||
USER ujm
|
||||
WORKDIR /home/ujm
|
||||
|
||||
EXPOSE 8000
|
||||
|
||||
# Baked-in healthcheck: hit the API rather than the page, so it fails when the
|
||||
# *backend* is broken and not merely when a static asset is missing.
|
||||
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
||||
CMD ["python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/metrics', timeout=4).status == 200 else 1)"]
|
||||
|
||||
# 0.0.0.0, not the CLI default of 127.0.0.1: loopback inside a container is
|
||||
# unreachable from the host, which is the whole point of publishing a port.
|
||||
CMD ["ujm-web", "--host", "0.0.0.0", "--port", "8000", "--log-level", "INFO"]
|
||||
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
|
||||
CMD wget -q -O /dev/null http://127.0.0.1:8080/ || exit 1
|
||||
|
||||
Reference in New Issue
Block a user