From d207537b538c4d488f850bcb9bd7bb9a6f25a276 Mon Sep 17 00:00:00 2001 From: zukki259 Date: Tue, 18 Aug 2026 01:27:08 +0900 Subject: [PATCH] Add GUI settings panel for API keys, model presets, and embedding model - Add a password-protected /api/settings endpoint (HTTP Basic auth, backend/app/core/auth.py) backed by a DB-stored allowlist of connection settings (OPENAI_API_KEY, ANTHROPIC_API_KEY, AWS creds, OLLAMA_API_BASE, TAVILY_API_KEY, LOCAL_KB_EMBEDDING_MODEL). Saved values override .env and apply immediately via os.environ, so Lightsail deployments no longer need SSH + `.env` edits to rotate keys. Values are always returned masked to the frontend. - Replace ModelSelector.vue's hardcoded model list with a DB-backed /api/models CRUD API (read is public, writes reuse the settings password) so the chat model dropdown can be edited from the GUI; seed it once with the previous hardcoded presets on first boot. - Fix local_knowledge.py reading LOCAL_KB_EMBEDDING_MODEL once at import time instead of per-call, which would have silently ignored GUI/DB overrides for the embedding model. - Add SettingsPanel.vue (API keys + model management UI) and document the new SETTINGS_PASSWORD env var in .env.example and the Lightsail deploy guide. Co-Authored-By: Claude Sonnet 5 --- .claude/launch.json | 11 + backend/.env.example | 5 + backend/app/api/models.py | 67 ++++++ backend/app/api/settings.py | 46 +++++ backend/app/core/auth.py | 23 +++ backend/app/core/config.py | 3 + backend/app/core/memory_kb/local_knowledge.py | 12 +- backend/app/core/settings_store.py | 89 ++++++++ backend/app/db/models.py | 19 ++ backend/app/main.py | 46 ++++- docs/deploy-lightsail.md | 46 ++++- frontend/src/App.vue | 18 +- frontend/src/api/client.ts | 66 ++++++ frontend/src/components/ModelSelector.vue | 29 +-- frontend/src/components/SettingsPanel.vue | 195 ++++++++++++++++++ frontend/src/stores/settings.ts | 138 +++++++++++++ 16 files changed, 788 insertions(+), 25 deletions(-) create mode 100644 .claude/launch.json create mode 100644 backend/app/api/models.py create mode 100644 backend/app/api/settings.py create mode 100644 backend/app/core/auth.py create mode 100644 backend/app/core/settings_store.py create mode 100644 frontend/src/components/SettingsPanel.vue create mode 100644 frontend/src/stores/settings.ts diff --git a/.claude/launch.json b/.claude/launch.json new file mode 100644 index 0000000..809006e --- /dev/null +++ b/.claude/launch.json @@ -0,0 +1,11 @@ +{ + "version": "0.0.1", + "configurations": [ + { + "name": "frontend-dev", + "runtimeExecutable": "npm", + "runtimeArgs": ["--prefix", "frontend", "run", "dev"], + "port": 5173 + } + ] +} diff --git a/backend/.env.example b/backend/.env.example index 956dd47..1a4a74a 100644 --- a/backend/.env.example +++ b/backend/.env.example @@ -16,6 +16,11 @@ AWS_BEARER_TOKEN_BEDROCK= # デバッグ (true にすると LiteLLM の詳細ログが出力される) DEBUG=false +# GUIの「設定」画面（APIキー等の変更）を保護する簡易パスワード。 +# 未設定だと設定画面は常に403で拒否される（＝GUIからのAPIキー変更機能を使わないなら空でよい）。 +# HTTPS化していない環境ではBasic認証の資格情報が平文で流れるため、公開環境ではHTTPS化とセットで使うこと。 +SETTINGS_PASSWORD= + # Tavily Web検索（未設定だとweb_searchツールは何も検索せず空振りする） TAVILY_API_KEY= # 蓄積知識をシステムプロンプトに注入する際の最大件数 diff --git a/backend/app/api/models.py b/backend/app/api/models.py new file mode 100644 index 0000000..003b9b8 --- /dev/null +++ b/backend/app/api/models.py @@ -0,0 +1,67 @@ +from fastapi import APIRouter, Depends, HTTPException +from pydantic import BaseModel +from sqlalchemy.exc import IntegrityError +from sqlalchemy.orm import Session as DBSession + +from app.core.auth import require_settings_password +from app.db.database import get_db +from app.db.models import ModelPreset + +router = APIRouter(prefix="/api/models", tags=["models"]) + + +class ModelPresetResponse(BaseModel): + id: int + label: str + value: str + + class Config: + from_attributes = True + + +class ModelPresetRequest(BaseModel): + label: str + value: str + + +@router.get("", response_model=list[ModelPresetResponse]) +def list_model_presets(db: DBSession = Depends(get_db)): + """モデル選択プルダウンの表示に使うため認証不要（誰でも読める）。""" + return db.query(ModelPreset).order_by(ModelPreset.id).all() + + +@router.post("", response_model=ModelPresetResponse, dependencies=[Depends(require_settings_password)]) +def create_model_preset(req: ModelPresetRequest, db: DBSession = Depends(get_db)): + preset = ModelPreset(label=req.label, value=req.value) + db.add(preset) + try: + db.commit() + except IntegrityError as e: + db.rollback() + raise HTTPException(status_code=400, detail=f"モデル文字列が重複しています: {req.value}") from e + db.refresh(preset) + return preset + + +@router.put("/{preset_id}", response_model=ModelPresetResponse, dependencies=[Depends(require_settings_password)]) +def update_model_preset(preset_id: int, req: ModelPresetRequest, db: DBSession = Depends(get_db)): + preset = db.get(ModelPreset, preset_id) + if not preset: + raise HTTPException(status_code=404, detail="Model preset not found") + preset.label = req.label + preset.value = req.value + try: + db.commit() + except IntegrityError as e: + db.rollback() + raise HTTPException(status_code=400, detail=f"モデル文字列が重複しています: {req.value}") from e + db.refresh(preset) + return preset + + +@router.delete("/{preset_id}", status_code=204, dependencies=[Depends(require_settings_password)]) +def delete_model_preset(preset_id: int, db: DBSession = Depends(get_db)): + preset = db.get(ModelPreset, preset_id) + if preset: + db.delete(preset) + db.commit() diff --git a/backend/app/api/settings.py b/backend/app/api/settings.py new file mode 100644 index 0000000..f01a663 --- /dev/null +++ b/backend/app/api/settings.py @@ -0,0 +1,46 @@ +from fastapi import APIRouter, Depends, HTTPException +from pydantic import BaseModel +from sqlalchemy.orm import Session as DBSession + +from app.core import settings_store +from app.core.auth import require_settings_password +from app.db.database import get_db + +router = APIRouter(prefix="/api/settings", tags=["settings"], dependencies=[Depends(require_settings_password)]) + + +class SettingEntry(BaseModel): + key: str + is_set: bool + masked: str | None + overridden: bool + + +class SaveSettingsRequest(BaseModel): + values: dict[str, str] + + +@router.get("", response_model=list[SettingEntry]) +def list_settings(db: DBSession = Depends(get_db)): + return settings_store.list_masked(db) + + +@router.put("", response_model=list[SettingEntry]) +def save_settings(req: SaveSettingsRequest, db: DBSession = Depends(get_db)): + try: + for key, value in req.values.items(): + if not value: + continue # 空欄は「変更なし」として無視する + settings_store.save(db, key, value) + except ValueError as e: + raise HTTPException(status_code=400, detail=str(e)) from e + return settings_store.list_masked(db) + + +@router.delete("/{key}", response_model=list[SettingEntry]) +def clear_setting(key: str, db: DBSession = Depends(get_db)): + try: + settings_store.clear(db, key) + except ValueError as e: + raise HTTPException(status_code=400, detail=str(e)) from e + return settings_store.list_masked(db) diff --git a/backend/app/core/auth.py b/backend/app/core/auth.py new file mode 100644 index 0000000..ec3a9bb --- /dev/null +++ b/backend/app/core/auth.py @@ -0,0 +1,23 @@ +import secrets + +from fastapi import Depends, HTTPException +from fastapi.security import HTTPBasic, HTTPBasicCredentials + +from app.core.config import SETTINGS_PASSWORD + +_security = HTTPBasic() + + +def require_settings_password(credentials: HTTPBasicCredentials = Depends(_security)) -> None: + """設定画面（/api/settings）専用の簡易パスワード認証。ユーザー名は見ない。 + + SETTINGS_PASSWORD が未設定の場合は、空パスワードでの突破を防ぐため常に拒否する。 + """ + if not SETTINGS_PASSWORD: + raise HTTPException(status_code=403, detail="SETTINGS_PASSWORD is not configured on the server") + if not secrets.compare_digest(credentials.password, SETTINGS_PASSWORD): + raise HTTPException( + status_code=401, + detail="Invalid password", + headers={"WWW-Authenticate": "Basic"}, + ) diff --git a/backend/app/core/config.py b/backend/app/core/config.py index ecdd6f9..e766123 100644 --- a/backend/app/core/config.py +++ b/backend/app/core/config.py @@ -9,6 +9,9 @@ MEMORY_SUMMARIZE_THRESHOLD: int = int(os.getenv("MEMORY_SUMMARIZE_THRESHOLD", "2 CORS_ORIGINS: list[str] = os.getenv("CORS_ORIGINS", "http://localhost:5173").split(",") DEBUG: bool = os.getenv("DEBUG", "false").lower() in ("1", "true", "yes") +# GUI設定画面（/api/settings）を保護する簡易パスワード。未設定の場合、設定画面は常に403で拒否する。 +SETTINGS_PASSWORD: str | None = os.getenv("SETTINGS_PASSWORD") + # メッセージへの自動タグ付けに使うモデル（未設定ならDEFAULT_MODELを使用） TAGGING_MODEL: str | None = os.getenv("TAGGING_MODEL") diff --git a/backend/app/core/memory_kb/local_knowledge.py b/backend/app/core/memory_kb/local_knowledge.py index 0e6658c..de06c82 100644 --- a/backend/app/core/memory_kb/local_knowledge.py +++ b/backend/app/core/memory_kb/local_knowledge.py @@ -7,12 +7,13 @@ import hashlib import json import logging import math +import os from pathlib import Path from sqlalchemy.orm import Session as DBSession from app.core import llm -from app.core.config import LOCAL_KB_DIR, LOCAL_KB_EMBEDDING_MODEL, LOCAL_KB_MIN_SCORE, LOCAL_KB_TOP_K +from app.core.config import LOCAL_KB_DIR, LOCAL_KB_MIN_SCORE, LOCAL_KB_TOP_K from app.db.models import KnowledgeEntry, LocalKnowledgeDoc logger = logging.getLogger(__name__) @@ -22,6 +23,11 @@ def _kb_dir() -> Path: return Path(LOCAL_KB_DIR) +def _embedding_model() -> str: + """GUIの設定画面から実行時に変更できるよう、起動時定数ではなく都度 os.environ を見に行く。""" + return os.environ.get("LOCAL_KB_EMBEDDING_MODEL", "text-embedding-3-small") + + def _hash(content: str) -> str: return hashlib.sha256(content.encode("utf-8")).hexdigest() @@ -104,7 +110,7 @@ async def sync_local_kb(db: DBSession) -> None: continue try: - [embedding] = await llm.embed([content], model=LOCAL_KB_EMBEDDING_MODEL) + [embedding] = await llm.embed([content], model=_embedding_model()) except Exception: logger.exception("Failed to embed local knowledge file: %s", rel_path) continue @@ -142,7 +148,7 @@ async def get_local_kb_context(db: DBSession, query_text: str) -> str | None: return None try: - [query_embedding] = await llm.embed([query_text], model=LOCAL_KB_EMBEDDING_MODEL) + [query_embedding] = await llm.embed([query_text], model=_embedding_model()) except Exception: logger.exception("Failed to embed query for local knowledge search") return None diff --git a/backend/app/core/settings_store.py b/backend/app/core/settings_store.py new file mode 100644 index 0000000..9feb7dc --- /dev/null +++ b/backend/app/core/settings_store.py @@ -0,0 +1,89 @@ +import os + +from sqlalchemy.orm import Session as DBSession + +from app.db.models import AppSetting + +# GUIから編集可能な環境変数の許可リスト。ここに無いキーは save()/clear() で拒否する。 +CONFIGURABLE_KEYS = [ + "OPENAI_API_KEY", + "ANTHROPIC_API_KEY", + "AWS_ACCESS_KEY_ID", + "AWS_SECRET_ACCESS_KEY", + "AWS_SESSION_TOKEN", + "AWS_BEARER_TOKEN_BEDROCK", + "AWS_REGION_NAME", + "OLLAMA_API_BASE", + "TAVILY_API_KEY", + "LOCAL_KB_EMBEDDING_MODEL", +] + +# .env由来の起動時の値のスナップショット。clear() で戻す先として使う。 +_env_defaults: dict[str, str | None] = {} +_snapshot_taken = False + + +def _ensure_snapshot() -> None: + global _snapshot_taken + if _snapshot_taken: + return + for key in CONFIGURABLE_KEYS: + _env_defaults[key] = os.environ.get(key) + _snapshot_taken = True + + +def _mask(value: str) -> str: + if len(value) <= 4: + return "••••" + return f"••••{value[-4:]}" + + +def load_into_env(db: DBSession) -> None: + """DBに保存済みの値をos.environに適用する。起動時に一度呼ぶ。""" + _ensure_snapshot() + for row in db.query(AppSetting).all(): + if row.key in CONFIGURABLE_KEYS: + os.environ[row.key] = row.value + + +def list_masked(db: DBSession) -> list[dict]: + _ensure_snapshot() + saved = {row.key: row.value for row in db.query(AppSetting).all()} + result = [] + for key in CONFIGURABLE_KEYS: + current = os.environ.get(key) + result.append({ + "key": key, + "is_set": bool(current), + "masked": _mask(current) if current else None, + "overridden": key in saved, + }) + return result + + +def save(db: DBSession, key: str, value: str) -> None: + if key not in CONFIGURABLE_KEYS: + raise ValueError(f"Unknown setting key: {key}") + _ensure_snapshot() + row = db.get(AppSetting, key) + if row: + row.value = value + else: + db.add(AppSetting(key=key, value=value)) + db.commit() + os.environ[key] = value + + +def clear(db: DBSession, key: str) -> None: + if key not in CONFIGURABLE_KEYS: + raise ValueError(f"Unknown setting key: {key}") + _ensure_snapshot() + row = db.get(AppSetting, key) + if row: + db.delete(row) + db.commit() + original = _env_defaults.get(key) + if original is None: + os.environ.pop(key, None) + else: + os.environ[key] = original diff --git a/backend/app/db/models.py b/backend/app/db/models.py index f3bd340..6d64534 100644 --- a/backend/app/db/models.py +++ b/backend/app/db/models.py @@ -104,6 +104,25 @@ class LocalKnowledgeDoc(Base): updated_at: Mapped[datetime] = mapped_column(DateTime, default=lambda: datetime.now(timezone.utc), onupdate=lambda: datetime.now(timezone.utc)) +class AppSetting(Base): + """GUIの設定画面から編集する接続情報（APIキー等）。app.core.settings_store が読み書きする。""" + __tablename__ = "app_settings" + + key: Mapped[str] = mapped_column(String, primary_key=True) + value: Mapped[str] = mapped_column(Text) + updated_at: Mapped[datetime] = mapped_column(DateTime, default=lambda: datetime.now(timezone.utc), onupdate=lambda: datetime.now(timezone.utc)) + + +class ModelPreset(Base): + """モデル選択プルダウン（ModelSelector.vue）に表示するプリセット。GUIの設定画面から編集する。""" + __tablename__ = "model_presets" + + id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True) + label: Mapped[str] = mapped_column(String) + value: Mapped[str] = mapped_column(String, unique=True) + created_at: Mapped[datetime] = mapped_column(DateTime, default=lambda: datetime.now(timezone.utc)) + + class ApiLog(Base): __tablename__ = "api_logs" diff --git a/backend/app/main.py b/backend/app/main.py index 5a092ad..27a1b03 100644 --- a/backend/app/main.py +++ b/backend/app/main.py @@ -4,13 +4,31 @@ from contextlib import asynccontextmanager from fastapi import FastAPI from fastapi.middleware.cors import CORSMiddleware +from app.api import chat, logs, memory, system +from app.api import models as models_api +from app.api import settings as settings_api +from app.core import settings_store from app.core.config import CORS_ORIGINS from app.core.discord.discord_bot import start_discord_bot from app.core.discord.scheduler import start_scheduler from app.core.memory_kb.word_memory import seed_from_history from app.db.database import SessionLocal, init_db -from app.db.models import Message -from app.api import chat, memory, logs, system +from app.db.models import Message, ModelPreset + +# ModelSelector.vue に元々ハードコードされていたプリセット。初回起動時のみDBへシードする。 +_DEFAULT_MODEL_PRESETS = [ + ("GPT-5.5", "gpt-5.5"), + ("GPT-5.4", "gpt-5.4"), + ("GPT-5.4 mini", "gpt-5.4-mini"), + ("Claude Sonnet 4.6", "claude-sonnet-4-6"), + ("Claude Haiku 4.5", "claude-haiku-4-5-20251001"), + ("Ollama llama3", "ollama/llama3"), + ("Ollama Gemma4", "ollama/gemma4"), + ("Gemma 4 12B (llama-server)", "gpt-3.5-turbo"), + ("Claude Sonnet 4.6 (Bedrock)", "bedrock/jp.anthropic.claude-sonnet-4-6"), + ("Llama 3 70B (Bedrock)", "bedrock/meta.llama3-70b-instruct-v1:0"), + ("Nova 2 Lite (Bedrock)", "bedrock/jp.amazon.nova-2-lite-v1:0"), +] def _seed_word_memory_from_db() -> None: @@ -28,9 +46,31 @@ def _seed_word_memory_from_db() -> None: db.close() +def _load_settings_into_env() -> None: + db = SessionLocal() + try: + settings_store.load_into_env(db) + finally: + db.close() + + +def _seed_default_models() -> None: + db = SessionLocal() + try: + if db.query(ModelPreset).first() is not None: + return + for label, value in _DEFAULT_MODEL_PRESETS: + db.add(ModelPreset(label=label, value=value)) + db.commit() + finally: + db.close() + + @asynccontextmanager async def lifespan(app: FastAPI): init_db() + _load_settings_into_env() + _seed_default_models() _seed_word_memory_from_db() start_scheduler() asyncio.create_task(start_discord_bot()) @@ -52,6 +92,8 @@ app.include_router(chat.router) app.include_router(memory.router) app.include_router(logs.router) app.include_router(system.router) +app.include_router(settings_api.router) +app.include_router(models_api.router) @app.get("/health") diff --git a/docs/deploy-lightsail.md b/docs/deploy-lightsail.md index ca0d3ff..9f8c128 100644 --- a/docs/deploy-lightsail.md +++ b/docs/deploy-lightsail.md @@ -59,10 +59,40 @@ docker compose version ## 3. リポジトリの取得と設定 -```bash -git clone <このリポジトリのURL> playchat -cd playchat +リポジトリは自前の Git サーバー（`colc-git.duckdns.org`、Gitea/Forgejo系）でホストしている。 +DuckDNS 経由の公開IPで、HTTPS(443)・SSH(22) とも外部から到達可能なので、Lightsail インスタンスからも +VPN 等は不要で直接クローンできる。認証方法は以下のどちらか。 +### 方法A: SSH デプロイキー（推奨・pull専用なら安全） + +```bash +ssh-keygen -t ed25519 -C "lightsail-playchat" -f ~/.ssh/id_ed25519 -N "" +cat ~/.ssh/id_ed25519.pub +``` + +表示された公開鍵を colc-git.duckdns.org 側のリポジトリ設定の **Deploy Keys** に **Read only** で登録してから： + +```bash +git clone git@colc-git.duckdns.org:colcaroli/playchat.git +cd playchat +``` + +### 方法B: HTTPS + アクセストークン + +colc-git.duckdns.org 側で個人アクセストークン（PAT）を発行し： + +```bash +git clone https://colc-git.duckdns.org/colcaroli/playchat.git +cd playchat +# Username / Password 入力を求められたら、Password 欄に発行したトークンを入力 +``` + +トークンをキャッシュしたい場合は `git config credential.helper cache`（メモリに一時保存。 +`store` は平文保存になるため非推奨）。 + +### .env の設定 + +```bash cp backend/.env.example backend/.env nano backend/.env # APIキーやモデル名など本番用の値を設定 ``` @@ -76,9 +106,19 @@ nano backend/.env # APIキーやモデル名など本番用の値を設定 | `CORS_ORIGINS` | `http://<静的IP>` またはドメイン（nginx が同一オリジンで配信するので基本は素通りするが念のため合わせておく） | | `DATABASE_URL` | **編集不要**（`docker-compose.yml` が `/app/data/playchat.db` に上書きし、Docker Volume に永続化する） | | `DISCORD_BOT_TOKEN` 等 | Discord Bot / 通知機能を使うなら設定。不要なら空のままでよい（未設定時は該当機能が無効） | +| `SETTINGS_PASSWORD` | GUIの「設定」画面（後述）を使うなら必ず設定する。未設定だと設定画面は403で拒否される | `backend/.env` はコンテナに `env_file` として渡され、Git 管理対象外（`.gitignore` 済み）なので直接編集してよい。 +### GUIからのAPIキー管理 + +初回起動後は、`OPENAI_API_KEY` / `ANTHROPIC_API_KEY` / AWS認証情報などをSSHで`.env`を編集し直さなくても、 +アプリ右上の「設定」ボタン（`SETTINGS_PASSWORD` によるBasic認証で保護）から変更できる。GUIで保存した値は +SQLite（`AppSetting`テーブル、`backend_data`ボリュームで永続化）に保存され、`.env`の値より優先される。 + +**注意:** このパスワード保護は簡易的なものであり、HTTP平文通信の場合はBasic認証の資格情報がネットワーク上に +そのまま流れてしまう。この機能を使うなら[6. HTTPS化](#6-https-化ドメインがある場合)と合わせて運用すること。 + ## 4. ビルド & 起動 ```bash diff --git a/frontend/src/App.vue b/frontend/src/App.vue index 1b7a6da..d0c7da7 100644 --- a/frontend/src/App.vue +++ b/frontend/src/App.vue @@ -5,12 +5,18 @@ import ChatWindow from './components/ChatWindow.vue' import MessageInput from './components/MessageInput.vue' import ModelSelector from './components/ModelSelector.vue' import LogViewer from './components/LogViewer.vue' +import SettingsPanel from './components/SettingsPanel.vue' import ToastList from './components/ToastList.vue' import MemoryMonitor from './components/MemoryMonitor.vue' import Clock from './components/Clock.vue' import WordPool from './components/WordPool.vue' -const showLogs = ref(false) +type SidePanel = 'none' | 'logs' | 'settings' +const activePanel = ref('none') + +function togglePanel(panel: SidePanel) { + activePanel.value = activePanel.value === panel ? 'none' : panel +}