Enhance Docker and SQLite support for Hugging Face Spaces

- Updated Dockerfile to create persistent data directories for SQLite and uploads.
- Modified README.md to provide deployment instructions for Hugging Face Spaces.
- Adjusted Alembic migration logic to skip for SQLite and use create_all() instead.
- Updated database initialization to support SQLite in HF Spaces.
- Refactored upload directory handling in services to use settings for compatibility with HF Spaces.
- Added dynamic CORS origin handling for Hugging Face Spaces.
- Implemented secure cookie settings for production environments.

Dockerfile

@@ -39,9 +39,14 @@ RUN set -eux; \
       libxext6 \
       libgomp1 \
       curl \
+      poppler-utils \
     ; \
     rm -rf /var/lib/apt/lists/*
 
+# Create persistent data directory for SQLite and uploads
+# Hugging Face Spaces mounts /data as persistent storage
+RUN mkdir -p /data /data/uploads /data/chroma_db && chmod -R 777 /data
+
 # Python deps
 COPY backend/requirements.txt ./requirements.txt
 RUN python -m pip install --no-cache-dir -r requirements.txt
@@ -51,12 +56,20 @@ COPY backend/ ./
 
 # Frontend production build served by FastAPI
 COPY --from=frontend-build /frontend/dist /app/frontend_dist
-ENV FRONTEND_DIST_DIR=/app/frontend_dist
+
+# Environment variables for HF Spaces
+ENV FRONTEND_DIST_DIR=/app/frontend_dist \
+    DATABASE_URL="sqlite+aiosqlite:////data/lumea.db" \
+    CHROMA_PERSIST_DIR="/data/chroma_db" \
+    UPLOAD_DIR="/data/uploads"
+
+# Create a startup script that ensures directories exist (using sh for slim image)
+RUN printf '#!/bin/sh\nmkdir -p /data /data/uploads /data/chroma_db 2>/dev/null || true\nexec uvicorn app.main:app --host 0.0.0.0 --port 7860\n' > /app/start.sh && chmod +x /app/start.sh
 
 EXPOSE 7860
 
-HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
   CMD curl -f http://localhost:7860/api || exit 1
 
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]
+CMD ["/app/start.sh"]
 

README.md

@@ -1043,7 +1043,28 @@ pytest tests/test_routes_medicines.py
 
 ## Deployment
 
-### Docker Compose (Development/Staging)
+### Hugging Face Spaces (Recommended for Demo)
+
+This app is optimized for Hugging Face Spaces with Docker SDK:
+
+1. **Create a new Space** on [huggingface.co/new-space](https://huggingface.co/new-space)
+2. **Select Docker SDK** and set port to `7860`
+3. **Push this repository** to the Space
+4. **Configure Secrets** (Settings → Secrets):
+   - `JWT_SECRET`: Strong random secret for auth tokens
+   - `GROQ_API_KEY`: For AI features (get free key at [console.groq.com](https://console.groq.com))
+   - `GEMINI_API_KEY`: Optional fallback for AI features
+   - `GOOGLE_PLACES_API_KEY`: Optional for pharmacy locator
+
+The app automatically:
+- Uses SQLite stored in `/data` (persistent storage)
+- Serves frontend from same FastAPI server (port 7860)
+- Configures HTTPS-compatible secure cookies
+- Creates database tables on first startup
+
+**No PostgreSQL required** - SQLite works out of the box!
+
+### Docker Compose (Local Development)
 
 ```bash
 docker-compose up -d
@@ -1056,11 +1077,13 @@ Includes:
 
 ### Production Considerations
 
-1. **Database**: Use Neon, Supabase, or managed PostgreSQL
+1. **Database**: 
+   - **HF Spaces**: SQLite (automatic, stored in /data)
+   - **Self-hosted**: Use Neon, Supabase, or managed PostgreSQL
 2. **Backend**: Deploy to Railway, Render, or AWS ECS
 3. **Frontend**: Deploy to Vercel, Netlify, or Cloudflare Pages
 4. **Secrets**: Use environment variables, never commit `.env`
-5. **HTTPS**: Enable secure cookies in production
+5. **HTTPS**: Enable secure cookies in production (automatic on HF Spaces)
 6. **CORS**: Update `FRONTEND_ORIGIN` for production domain
 
 ---

backend/alembic/env.py

@@ -73,13 +73,23 @@ def run_migrations_online() -> None:
     In this scenario we need to create an Engine
     and associate a connection with the context.
 
+    NOTE: Alembic migrations are PostgreSQL-specific. For SQLite, use create_all() instead.
     """
-    # Use synchronous postgres driver for migrations instead of asyncpg
-    # Parse the URL and convert SSL parameters
-    import re
-    from urllib.parse import urlparse, parse_qs, urlencode, urlunparse
+    from urllib.parse import urlparse, urlunparse
     
     async_url = settings.database_url
+    
+    # Skip migrations for SQLite - they use PostgreSQL-specific types
+    if async_url.startswith("sqlite"):
+        import logging
+        logging.getLogger(__name__).warning(
+            "Skipping Alembic migrations for SQLite. "
+            "Migrations use PostgreSQL-specific types. "
+            "Use SQLAlchemy create_all() instead."
+        )
+        return
+    
+    # Use synchronous postgres driver for migrations instead of asyncpg
     sync_url = async_url.replace("postgresql+asyncpg://", "postgresql://")
     
     # Parse URL to handle SSL parameter

backend/app/db.py

@@ -1,4 +1,5 @@
 import asyncio
+import logging
 from pathlib import Path
 from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession, async_sessionmaker
 from sqlalchemy.orm import declarative_base
@@ -59,9 +60,18 @@ async def get_db():
 
 async def run_migrations() -> None:
     """
-    Run Alembic migrations to `head` (best for dev/local).
+    Run Alembic migrations to `head` (best for dev/local with PostgreSQL).
     Uses the sync driver path configured in `backend/alembic/env.py`.
+    
+    NOTE: Migrations are PostgreSQL-specific. For SQLite, use create_all() instead.
     """
+    # Skip migrations for SQLite - they use PostgreSQL-specific types
+    if db_url.startswith("sqlite"):
+        logging.getLogger(__name__).info("Skipping Alembic migrations for SQLite - using create_all() instead")
+        async with engine.begin() as conn:
+            await conn.run_sync(Base.metadata.create_all)
+        return
+
     from alembic import command
     from alembic.config import Config
 
@@ -72,8 +82,16 @@ async def run_migrations() -> None:
     await asyncio.to_thread(command.upgrade, cfg, "head")
 
 async def init_db():
+    """Initialize database - uses create_all() for SQLite, optionally migrations for PostgreSQL."""
+    if db_url.startswith("sqlite"):
+        # SQLite: always use create_all() since migrations are PostgreSQL-specific
+        logging.getLogger(__name__).info("SQLite detected - creating tables with create_all()")
+        async with engine.begin() as conn:
+            await conn.run_sync(Base.metadata.create_all)
+        return
+
     if settings.AUTO_MIGRATE:
-        # Prefer migrations; create_all() does not add columns to existing tables.
+        # PostgreSQL: Prefer migrations; create_all() does not add columns to existing tables.
         await run_migrations()
         return
 

backend/app/main.py

@@ -67,6 +67,7 @@ async def lifespan(app: FastAPI):
 app = FastAPI(title="Lumea Health Platform API", lifespan=lifespan)
 
 # CORS configuration - allow both localhost ports and Docker
+# Build origins list dynamically for HF Spaces support
 origins = [
     "http://localhost:5173",
     "http://localhost:5174",
@@ -80,6 +81,18 @@ origins = [
     settings.frontend_origin,
 ]
 
+# Add Hugging Face Spaces origin if running in HF Space
+# SPACE_ID format: username/space-name
+space_id = os.getenv("SPACE_ID")
+if space_id:
+    # HF Spaces URL patterns
+    space_name = space_id.replace("/", "-").lower()
+    origins.extend([
+        f"https://{space_name}.hf.space",
+        f"https://huggingface.co/spaces/{space_id}",
+    ])
+    logger.info(f"Added HF Space origins for {space_id}")
+
 app.add_middleware(
     CORSMiddleware,
     allow_origins=origins,

backend/app/routes/auth.py

@@ -1,3 +1,4 @@
+import os
 from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
@@ -9,6 +10,9 @@ from app.security import hash_password, verify_password, create_access_token, ge
 
 router = APIRouter(prefix="/api/auth", tags=["auth"])
 
+# Detect if running in production (HF Spaces uses HTTPS)
+IS_PRODUCTION = bool(os.getenv("SPACE_ID")) or os.getenv("ENVIRONMENT") == "production"
+
 @router.post("/signup", response_model=TokenResponse)
 @router.post("/register", response_model=TokenResponse)
 async def signup(user_data: UserCreate, response: Response, db: AsyncSession = Depends(get_db)):
@@ -30,13 +34,13 @@ async def signup(user_data: UserCreate, response: Response, db: AsyncSession = D
     
     access_token = create_access_token({"sub": str(new_user.id)})
     
-    # Set httpOnly cookie
+    # Set httpOnly cookie (secure=True for HTTPS in production)
     response.set_cookie(
         key="auth_token",
         value=access_token,
         httponly=True,
-        secure=False,  # Set to True in production with HTTPS
-        samesite="lax",
+        secure=IS_PRODUCTION,
+        samesite="lax" if IS_PRODUCTION else "lax",
         max_age=7 * 24 * 60 * 60  # 7 days
     )
     
@@ -72,13 +76,13 @@ async def login(
     
     access_token = create_access_token({"sub": str(user.id)})
     
-    # Set httpOnly cookie
+    # Set httpOnly cookie (secure=True for HTTPS in production)
     response.set_cookie(
         key="auth_token",
         value=access_token,
         httponly=True,
-        secure=False,  # Set to True in production with HTTPS
-        samesite="lax",
+        secure=IS_PRODUCTION,
+        samesite="lax" if IS_PRODUCTION else "lax",
         max_age=7 * 24 * 60 * 60  # 7 days
     )
     

backend/app/routes/reports.py

@@ -24,15 +24,16 @@ from app.schemas import (
 )
 from app.services.report_service import ReportService
 from app.services.enhanced_report_service import EnhancedReportService
+from app.settings import settings
 
 logger = logging.getLogger(__name__)
 logging.basicConfig(level=logging.INFO)
 
 router = APIRouter(prefix="/api/reports", tags=["reports"])
 
-# Upload directory
-UPLOAD_DIR = Path("uploads")
-UPLOAD_DIR.mkdir(exist_ok=True)
+# Upload directory from settings (supports HF Spaces /data path)
+UPLOAD_DIR = Path(settings.UPLOAD_DIR)
+UPLOAD_DIR.mkdir(parents=True, exist_ok=True)
 
 # Allowed file types
 ALLOWED_EXTENSIONS = {'.pdf', '.png', '.jpg', '.jpeg', '.tiff'}

backend/app/services/document_processing.py

@@ -41,6 +41,7 @@ from app.services.grok_extractor import extract_document_metrics
 from app.services.memory_service import get_memory_service
 from app.services.graph_service import get_graph_service
 from app.services.rag_service import get_rag_service
+from app.settings import settings
 
 logger = logging.getLogger(__name__)
 
@@ -52,7 +53,6 @@ class DocumentProcessingService:
     Handles the entire flow from file upload to extracted observations.
     """
     
-    UPLOAD_DIR = Path("./uploads")
     ALLOWED_EXTENSIONS = {".pdf", ".png", ".jpg", ".jpeg", ".tiff", ".tif"}
     MAX_FILE_SIZE = 20 * 1024 * 1024  # 20MB
     
@@ -60,6 +60,8 @@ class DocumentProcessingService:
         self.db = db
         self.user = user
         self.pdf_extractor = PDFExtractor()
+        # Use settings for upload directory (supports HF Spaces /data path)
+        self.UPLOAD_DIR = Path(settings.UPLOAD_DIR)
     
     def _get_user_upload_dir(self) -> Path:
         """Get user-specific upload directory"""

backend/app/services/enhanced_report_service.py

@@ -20,6 +20,7 @@ from sqlalchemy import select
 from app.models import Report, Observation, ReportStatus, ObservationType
 from app.services.pdf_extractor import PDFExtractor
 from app.services.lab_parser import LabParser
+from app.settings import settings
 
 logger = logging.getLogger(__name__)
 logging.basicConfig(level=logging.INFO)
@@ -34,8 +35,9 @@ class EnhancedReportService:
         self.db = db
         self.extractor = PDFExtractor()
         self.parser = LabParser()
-        self.upload_dir = Path("uploads")
-        self.upload_dir.mkdir(exist_ok=True)
+        # Use settings for upload directory (supports HF Spaces /data path)
+        self.upload_dir = Path(settings.UPLOAD_DIR)
+        self.upload_dir.mkdir(parents=True, exist_ok=True)
     
     async def process_report(self, report_id: UUID, user_id: UUID):
         """

backend/app/services/profile_service.py

@@ -10,7 +10,6 @@ from datetime import datetime, date
 from typing import List, Dict, Any, Optional, Tuple
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select, delete
-from sqlalchemy.dialects.postgresql import insert
 
 from app.models import (
     User, UserProfile, ProfileAnswer, ProfileCondition, ProfileSymptom,

backend/app/services/report_service.py

@@ -18,12 +18,13 @@ from app.settings import settings
 class ReportService:
     """Service for managing medical reports"""
     
-    UPLOAD_DIR = Path("./uploads")
     ALLOWED_EXTENSIONS = {".pdf", ".png", ".jpg", ".jpeg", ".tiff", ".tif"}
     MAX_FILE_SIZE = 10 * 1024 * 1024  # 10MB
     
     def __init__(self, db: Session):
         self.db = db
+        # Use settings for upload directory (supports HF Spaces /data path)
+        self.UPLOAD_DIR = Path(settings.UPLOAD_DIR)
         self._ensure_upload_dir()
     
     def _ensure_upload_dir(self):

backend/app/settings.py

@@ -1,13 +1,27 @@
+import os
 from pydantic_settings import BaseSettings
 from typing import Optional
 
+
+def _get_default_database_url() -> str:
+    """
+    Determine the default database URL based on the environment.
+    - In Docker/HF Spaces: Use /data for persistent storage
+    - Locally: Use ./lumea.db in current directory
+    """
+    # Check if we're in a Docker/HF Spaces environment
+    if os.path.exists("/data") or os.getenv("SPACE_ID"):
+        return "sqlite+aiosqlite:////data/lumea.db"
+    return "sqlite+aiosqlite:///./lumea.db"
+
+
 class Settings(BaseSettings):
     # Defaults are set so the app can boot in environments like Hugging Face
     # Spaces without requiring secrets to be configured up front.
     #
     # IMPORTANT: Override JWT_SECRET + DATABASE_URL with Space Secrets for any
     # real deployment.
-    database_url: str = "sqlite+aiosqlite:///./lumea.db"
+    database_url: str = _get_default_database_url()
     jwt_secret: str = "dev-secret-change-me"
     frontend_origin: str = "http://localhost:5173"
     jwt_algorithm: str = "HS256"
@@ -26,8 +40,13 @@ class Settings(BaseSettings):
     OLLAMA_MODEL: str = "hf.co/unsloth/medgemma-4b-it-GGUF:Q6_K_XL"
     OLLAMA_TIMEOUT: int = 120  # seconds
 
+    # Upload directory for reports
+    # In Docker/HF Spaces: /data/uploads (persistent)
+    # Locally: ./uploads
+    UPLOAD_DIR: str = "/data/uploads" if os.path.exists("/data") or os.getenv("SPACE_ID") else "./uploads"
+
     # ChromaDB Configuration
-    CHROMA_PERSIST_DIR: str = "/app/chroma_db"
+    CHROMA_PERSIST_DIR: str = "/data/chroma_db" if os.path.exists("/data") or os.getenv("SPACE_ID") else "./chroma_db"
     EMBEDDING_MODEL: str = "all-MiniLM-L6-v2"
     RAG_TOP_K: int = 5