deploy: privacy-sanitizer backend 2026-04-28

Dockerfile

@@ -27,4 +27,4 @@ ENV PORT=7860
 ENV APP_ENV=staging
 EXPOSE 7860
 
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860", "--forwarded-allow-ips", "*"]

app/main.py

@@ -11,7 +11,17 @@ from app.config import settings
 from app.routers.sanitize import router as sanitize_router
 from app.services.sanitizer import preload_pipeline
 
-limiter = Limiter(key_func=get_remote_address)
+
+def _get_real_ip(request: Request) -> str:
+    """Extract the real client IP — honours X-Forwarded-For set by HF Spaces / reverse proxy."""
+    forwarded_for = request.headers.get("X-Forwarded-For")
+    if forwarded_for:
+        # X-Forwarded-For: client, proxy1, proxy2 — take the leftmost (real client)
+        return forwarded_for.split(",")[0].strip()
+    return get_remote_address(request)
+
+
+limiter = Limiter(key_func=_get_real_ip)
 
 
 @asynccontextmanager

app/routers/sanitize.py

@@ -1,3 +1,6 @@
+import asyncio
+from concurrent.futures import ThreadPoolExecutor
+
 from fastapi import APIRouter, HTTPException, Request
 from slowapi import Limiter
 from slowapi.util import get_remote_address
@@ -15,6 +18,17 @@ _ALLOWED_MODEL_IDS: set[str] = {m["id"] for m in AVAILABLE_MODELS}
 # Maximum input text length (~10 000 chars ≈ ~2 000 tokens — well within BERT limits)
 _MAX_TEXT_LENGTH = 10_000
 
+# Max simultaneous NER inference jobs — prevents CPU saturation on single-process deployments.
+# Requests beyond this limit receive 503 immediately rather than queuing indefinitely.
+_MAX_CONCURRENT_INFERENCES = 2
+_inference_semaphore = asyncio.Semaphore(_MAX_CONCURRENT_INFERENCES)
+
+# Dedicated thread pool for CPU-bound inference (avoids blocking the event loop)
+_inference_executor = ThreadPoolExecutor(max_workers=_MAX_CONCURRENT_INFERENCES, thread_name_prefix="ner")
+
+# Timeout for a single inference call (seconds) — prevents a slow model from blocking forever
+_INFERENCE_TIMEOUT_SECONDS = 60
+
 
 @router.get("/models", response_model=list[ModelInfo])
 @limiter.limit("60/minute")
@@ -37,9 +51,32 @@ async def sanitize(request: Request, body: SanitizeRequest) -> SanitizeResponse:
             detail=f"Unknown model '{body.model_name}'. Use GET /api/models for available options.",
         )
 
-    try:
-        return sanitize_text(body.text, model_id=body.model_name)
-    except RuntimeError as exc:
-        raise HTTPException(status_code=503, detail=str(exc)) from exc
-    except Exception as exc:
-        raise HTTPException(status_code=500, detail="Model inference failed") from exc
+    # Reject immediately if server is already at inference capacity
+    if not _inference_semaphore._value:  # noqa: SLF001
+        raise HTTPException(
+            status_code=503,
+            detail="Server is busy processing other requests. Please retry in a few seconds.",
+        )
+
+    loop = asyncio.get_running_loop()
+    async with _inference_semaphore:
+        try:
+            result = await asyncio.wait_for(
+                loop.run_in_executor(
+                    _inference_executor,
+                    sanitize_text,
+                    body.text,
+                    body.model_name,
+                ),
+                timeout=_INFERENCE_TIMEOUT_SECONDS,
+            )
+            return result
+        except asyncio.TimeoutError:
+            raise HTTPException(
+                status_code=504,
+                detail="Model inference timed out. Try a shorter text or switch to BERT-base.",
+            )
+        except RuntimeError as exc:
+            raise HTTPException(status_code=503, detail=str(exc)) from exc
+        except Exception as exc:
+            raise HTTPException(status_code=500, detail="Model inference failed") from exc