GCP Cloud Integration

.dockerignore

@@ -0,0 +1,10 @@
+# Keep the Docker build context small — the repo root is ~1.8G otherwise.
+# The Dockerfiles (deploy/Dockerfile.base, .nvidia) only COPY constraints.txt,
+# serve_requirements.txt, requirements-nvidia.txt and src/ — nothing below is
+# needed in the build context.
+.venv/
+.git/
+node_modules/
+**/__pycache__/
+**/*.pyc
+*.log

.gitignore

@@ -179,6 +179,42 @@ cython_debug/
 # Helm
 **/charts/*.tgz
 
+# Terraform 
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version
+# control as they are data points which are potentially sensitive and subject
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
 # Others
 .trash
 docs

config/client_aux.yaml

@@ -15,17 +15,11 @@ senders:
     args:
       sample_rate: 16000
       frame_duration: 0.030
-  text:
-    name: text
-    topic: question
-    args:
-      sample_rate: 16000
-      frame_duration: 0.030
 
 hooks:
-  text:
-    name: text
-    topics: [question, answer]
+  token:
+    name: token
+    topics: [token]
   audio:
     name: audio
     topics: [audio]
@@ -48,10 +42,34 @@ modules:
   #     block_duration: ${senders.audio.args.frame_duration}
   # tag:
   #   name: tag
+  stt:
+    name: stt
+    args:
+      language: "en"
+      block_duration: 0.030
+    logging: INFO
+  tag:
+    name: tag
+    logging: INFO
+  emo:
+    name: emo
+    args:
+      block_duration: 0.030
+  eag:
+    name: eag
+  qag:
+    name: qag
   rag:
     name: rag
     args:
       language: en
       tone: formal
+      response_format: paragraph
+      max_length: 1024
+    logging: INFO
   tts:
     name: tts
+    logging: INFO
+  gesture:
+    name: gesture
+    logging: INFO

config/client_text.yaml

@@ -8,9 +8,9 @@ senders:
     topic: question
 
 hooks:
-  text:
-    name: text
-    topics: [rag_response]
+  token:
+    name: token
+    topics: [token]
 
 modules:
   rag:

constraints.txt

@@ -0,0 +1,12 @@
+# Global pip constraints for all HuRI images. Pass to EVERY `pip install` via
+# `-c /app/constraints.txt` so a later requirements file cannot silently override
+# these versions (which is exactly how protobuf got clobbered before).
+#
+# protobuf: Ray Serve 2.55's ray/serve/_private/config.py:_proto_to_dict() reads
+# FieldDescriptor.label, an attribute protobuf's upb (C) backend removed at >=5.0.
+# With protobuf 5/6/7 every Serve replica crashes in __init__ with
+#   AttributeError: 'FieldDescriptor' object has no attribute 'label'
+# 4.25.8 is the floor onnxruntime requires (>=4.25.8) and stays <5 for
+# google-api-core / googleapis-common-protos / proto-plus / opentelemetry-proto /
+# google-cloud-storage, so it satisfies the whole dependency graph.
+protobuf==4.25.8

deploy/Dockerfile.amd

@@ -38,8 +38,11 @@ ENV LD_LIBRARY_PATH="${ROCM_PATH}/lib:${LD_LIBRARY_PATH}"
 USER ray
 
 
+# constraints.txt pins protobuf==4.25.8 so dep-resolving installs below can't
+# bump protobuf past 4.x (breaks Ray Serve's _proto_to_dict). See the file.
+COPY constraints.txt /app
 COPY serve_requirements.txt /app
-RUN pip install --no-cache-dir -r serve_requirements.txt
+RUN pip install --no-cache-dir -c /app/constraints.txt -r serve_requirements.txt
 
 # 1. AMD's PyTorch built for ROCm (NOT the PyPI one — it's built for ROCm 6.2 and will silently break)
 ARG ROCM_VERSION=7.2
@@ -69,11 +72,11 @@ RUN apt-get update && apt-get install -y unzip curl \
 USER ray
 
 # 4. faster-whisper
-RUN pip install --no-cache-dir faster-whisper
+RUN pip install --no-cache-dir -c /app/constraints.txt faster-whisper
 
 # 5. RAG / LLM extras (httpx, qdrant-client, sentence-transformers, …)
 #    Installed last so the ROCm torch wheel installed above is the resolved one.
 COPY requirements-amd.txt /app
-RUN pip install --no-cache-dir -r requirements-amd.txt
+RUN pip install --no-cache-dir -c /app/constraints.txt -r requirements-amd.txt
 
 COPY src /app/src

deploy/Dockerfile.base

@@ -10,7 +10,10 @@ build-essential \
 
 USER ray
 
+# constraints.txt pins protobuf==4.25.8 so serve_requirements.txt's deps can't
+# bump protobuf past 4.x (breaks Ray Serve's _proto_to_dict). See the file.
+COPY constraints.txt /app
 COPY serve_requirements.txt /app
-RUN pip install --no-cache-dir -r serve_requirements.txt
+RUN pip install --no-cache-dir -c /app/constraints.txt -r serve_requirements.txt
 
 COPY src /app/src

deploy/Dockerfile.nvidia

@@ -4,14 +4,18 @@ WORKDIR /app
 
 # Full CUDA 12.1 dependency stack (CosyVoice2, faster-whisper, TensorRT, …).
 # PyTorch cu121 wheels live on the PyTorch index; TensorRT wheels on the NGC index.
+# constraints.txt pins protobuf==4.25.8 (see the file). Passed to every pip
+# install below so serve_requirements.txt's deps (qdrant-client, onnxruntime —
+# no protobuf upper bound) can't bump protobuf past 4.x and break Ray Serve.
+COPY constraints.txt /app
 COPY requirements-nvidia.txt /app
-RUN pip install --no-cache-dir \
+RUN pip install --no-cache-dir -c /app/constraints.txt \
     --extra-index-url https://download.pytorch.org/whl/cu121 \
     --extra-index-url https://pypi.ngc.nvidia.com \
     -r requirements-nvidia.txt
 
 COPY serve_requirements.txt /app
-RUN pip install --no-cache-dir -r serve_requirements.txt
+RUN pip install --no-cache-dir -c /app/constraints.txt -r serve_requirements.txt
 
 USER root
 

deploy/examples/cloud/artifact_registry.tf

@@ -0,0 +1,34 @@
+# Private Artifact Registry holding the website backend image.
+#
+# This repository ALREADY EXISTS — Terraform should adopt it rather than try to
+# recreate it. After `terraform init`, import it once:
+#
+#   terraform import google_artifact_registry_repository.website \
+#     projects/${PROJECT}/locations/${LOCATION}/repositories/${REPO_ID}
+#
+# (LOCATION = var.website_image_location, REPO_ID = var.website_image_repo.)
+# The image itself is built and pushed out-of-band from
+# HuRI_website_demo/backend/Dockerfile.
+resource "google_artifact_registry_repository" "website" {
+  location      = var.website_image_location
+  repository_id = var.website_image_repo
+  format        = "DOCKER"
+  description   = "HuRI website backend images"
+
+  # Don't let an apply delete an existing shared registry.
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+data "google_project" "current" {}
+
+# GKE nodes pull with the node pool's service account (the default Compute
+# Engine SA here). Grant it read access to the repo so the kubelet can pull.
+resource "google_artifact_registry_repository_iam_member" "website_puller" {
+  project    = var.project_id
+  location   = google_artifact_registry_repository.website.location
+  repository = google_artifact_registry_repository.website.repository_id
+  role       = "roles/artifactregistry.reader"
+  member     = "serviceAccount:${data.google_project.current.number}-compute@developer.gserviceaccount.com"
+}

deploy/examples/cloud/backend.tf

@@ -0,0 +1,16 @@
+# Remote Terraform state in GCS (versioned, IAM-restricted). Holds the cluster
+# state — and, because Terraform decrypts Secret Manager values at apply time,
+# secret material too. Keep the bucket private.
+#
+# The bucket must EXIST before `terraform init` (chicken-and-egg: backends can't
+# create their own bucket and can't interpolate variables). It is supplied at
+# init time, so only the static prefix is committed here:
+#
+#   terraform init -backend-config="bucket=<your-tf-state-bucket>"
+#
+# See gcp_steps.md §0 for creating the bucket.
+terraform {
+  backend "gcs" {
+    prefix = "huri-cloud"
+  }
+}