Logan Cusano
a2cd2c57ca
upload_audio() could only sign a URL when GCP_CREDENTIALS_PATH pointed at a service-account key file. The deployed VM runs on Application Default Credentials with no key file, so every upload silently took the fallback branch and returned a bare gs:// URI. That broke two things at once: * Browsers cannot fetch a gs:// URI, so no recording was ever playable. * _public_url_to_gcs_uri() only matched https://storage.googleapis.com/ and returned None for it, so `if gcs_uri:` in the upload path was always false and transcription never ran. Nothing was logged, which is why this looked like an OpenAI credits problem rather than a storage one. The fallback also interpolated the client-supplied filename instead of the call_id-derived safe name, so the URI did not even name the object written. Calls now store only the canonical gs:// location. A short-lived playback link is minted per read as an HMAC over (call_id, expiry) keyed by SERVICE_KEY, and audio is served from the private bucket by the new /media route. An <audio src> cannot carry an Authorization header, so the link has to be the credential; that router is therefore public with the check done inline, as enrollment.py already does. Signing GCS URLs from the VM would have needed a serviceAccountTokenCreator grant on its own service account — this avoids the IAM change entirely and keeps the bucket private. gcs_uri_for_call() reconstructs the object name from call_id, so recordings made before this fix are reachable again without a data migration. Frontend rows come straight from Firestore via onSnapshot and never see a server-minted field, so CallRow fetches the link lazily on expand. Also removes the last long-lived (1 year) signed URL and the log line that printed it.
39 lines
1.7 KiB
Bash
39 lines
1.7 KiB
Bash
# drb-c2-core environment — Managed by Ansible. Do not edit manually.
|
|
|
|
MQTT_BROKER=mosquitto
|
|
MQTT_PORT=1883
|
|
MQTT_USER={{ vault_mqtt_c2_user }}
|
|
MQTT_PASS={{ vault_mqtt_c2_pass }}
|
|
|
|
# Same value as mosquitto's MOSQUITTO_DYNSEC_PASSWORD (root.env.j2) — lets
|
|
# c2-core log in as the dynsec plugin's built-in "admin" client to
|
|
# administer node credentials. See app/internal/dynsec.py.
|
|
MQTT_DYNSEC_ADMIN_PASS={{ vault_mqtt_dynsec_admin_pass }}
|
|
|
|
# No GCP_CREDENTIALS_PATH — the VM uses Application Default Credentials
|
|
# via the GCE metadata server. The Terraform IAM bindings grant the required roles.
|
|
# NOTE: because there is no service-account key file here, c2-core cannot mint
|
|
# GCS *signed* URLs. Call audio is therefore served through c2-core's own
|
|
# /media route (app/routers/media.py) rather than direct-from-bucket links.
|
|
FIRESTORE_DATABASE={{ vault_firestore_database }}
|
|
GCS_BUCKET={{ vault_gcs_bucket }}
|
|
|
|
# Absolute origin for call-audio playback links. The browser fetches <audio src>
|
|
# directly, so a relative path would resolve against the frontend origin
|
|
# (https://{{ domain }}) instead of the API's.
|
|
PUBLIC_API_URL=https://api.{{ domain }}
|
|
|
|
OPENAI_API_KEY={{ vault_openai_api_key }}
|
|
GOOGLE_MAPS_API_KEY={{ vault_google_maps_api_key }}
|
|
GEMINI_API_KEY={{ vault_gemini_api_key }}
|
|
|
|
SERVICE_KEY={{ vault_service_key }}
|
|
ENROLLMENT_TOKEN={{ vault_enrollment_token }}
|
|
|
|
# Bare domain, not app.<domain>: the frontend is served on {{ domain }} itself
|
|
# (see Caddyfile.j2 — only api. and the bare name have DNS records). This said
|
|
# app.{{ domain }} while the browser origin was https://{{ domain }}, so every
|
|
# frontend call to the API would have failed CORS. If the frontend ever moves
|
|
# to app.{{ domain }}, change this at the same time.
|
|
CORS_ORIGINS=["https://{{ domain }}"]
|