Robo Pest: 24/7 hosting on CT144 nginx + auth token on both APIs (X-Auth-Token). App served at robopest-app.thetempleofdoom.com

apps/robo-pest/server/stt_relay.py

@@ -2,22 +2,34 @@
 """Robo Pest STT relay — faster-whisper on nightmare's RTX 4080 SUPER.
 
 POST /transcribe  (body: raw PCM 16kHz s16le mono bytes)  -> {"text": "..."}
-GET  /health -> {"status": "ok", "model": ...}
+GET  /health -> {"status": "ok", ...}
+
+Auth: X-Auth-Token header required (set via STT_AUTH_TOKEN env var).
+Health endpoint is open (no secrets).
 """
 import io
 import os
 import struct
 import numpy as np
-from fastapi import FastAPI, Request
+from fastapi import FastAPI, Request, HTTPException
 from faster_whisper import WhisperModel
 
 MODEL_NAME = os.environ.get("STT_MODEL", "small.en")
 DEVICE = os.environ.get("STT_DEVICE", "cuda")
+AUTH_TOKEN = os.environ.get("STT_AUTH_TOKEN", "")
 
 app = FastAPI()
 model = WhisperModel(MODEL_NAME, device=DEVICE, compute_type="float16")
 
 
+def check_auth(request: Request):
+    if not AUTH_TOKEN:
+        return
+    token = request.headers.get("X-Auth-Token", "")
+    if token != AUTH_TOKEN:
+        raise HTTPException(status_code=401, detail="bad token")
+
+
 def pcm16_to_float32(data: bytes) -> np.ndarray:
     n = len(data) // 2
     ints = struct.unpack(f"<{n}h", data[: n * 2])
@@ -31,6 +43,7 @@ def health():
 
 @app.post("/transcribe")
 async def transcribe(request: Request):
+    check_auth(request)
     body = await request.body()
     if not body:
         return {"text": ""}