data "openstack_images_image_v2" "os" {
  name        = var.image_name
  most_recent = true
}

data "openstack_networking_network_v2" "external" {
  name = var.external_network
}

resource "aws_s3_bucket" "data" {
  bucket = var.data_bucket_name
}

resource "aws_s3_bucket_acl" "data" {
  bucket = aws_s3_bucket.data.id
  acl    = "private"
}


resource "openstack_networking_network_v2" "private" {
  name           = "${var.instance_name}-private"
  admin_state_up = true
}

resource "openstack_networking_subnet_v2" "private" {
  name            = "${var.instance_name}-private-sn"
  network_id      = openstack_networking_network_v2.private.id
  cidr            = var.private_cidr
  ip_version      = 4
  enable_dhcp     = true
  dns_nameservers = ["8.8.8.8", "8.8.4.4"]
}

resource "openstack_networking_router_v2" "router" {
  name                = "${var.instance_name}-router"
  external_network_id = data.openstack_networking_network_v2.external.id
  admin_state_up      = true
}

resource "openstack_networking_router_interface_v2" "private" {
  router_id = openstack_networking_router_v2.router.id
  subnet_id = openstack_networking_subnet_v2.private.id
}

resource "openstack_networking_secgroup_v2" "inference" {
  name        = "${var.instance_name}-sg"
  description = "Creator-AI gateway API, SSH from admin CIDR"
}

resource "openstack_networking_secgroup_rule_v2" "ssh" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = var.admin_cidr
  security_group_id = openstack_networking_secgroup_v2.inference.id
}

resource "openstack_networking_secgroup_rule_v2" "gateway_api" {
  count             = var.enable_public_api ? 1 : 0
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 8080
  port_range_max    = 8080
  remote_ip_prefix  = var.admin_cidr
  security_group_id = openstack_networking_secgroup_v2.inference.id
}

resource "openstack_networking_port_v2" "inference" {
  name               = "${var.instance_name}-port"
  network_id         = openstack_networking_network_v2.private.id
  security_group_ids = [openstack_networking_secgroup_v2.inference.id]

  fixed_ip {
    subnet_id = openstack_networking_subnet_v2.private.id
  }

  depends_on = [openstack_networking_router_interface_v2.private]
}

resource "openstack_compute_instance_v2" "inference" {
  name        = var.instance_name
  flavor_name = var.inference_flavor
  key_pair    = var.key_name

  user_data = templatefile("${path.module}/cloud-init/inference.yaml", {
    s3_endpoint   = var.s3_endpoint
    s3_region     = var.s3_region
    s3_access_key = var.s3_access_key
    s3_secret_key = var.s3_secret_key
    data_bucket   = aws_s3_bucket.data.id
    ollama_model  = var.ollama_model
    api_token     = var.api_token
  })

  block_device {
    uuid                  = data.openstack_images_image_v2.os.id
    source_type           = "image"
    destination_type      = "volume"
    volume_size           = 80
    boot_index            = 0
    delete_on_termination = true
  }

  network {
    port = openstack_networking_port_v2.inference.id
  }

  depends_on = [openstack_networking_router_interface_v2.private]
}

resource "openstack_networking_floatingip_v2" "inference" {
  count = var.enable_public_api ? 1 : 0
  pool  = var.external_network
}

resource "openstack_networking_floatingip_associate_v2" "inference" {
  count       = var.enable_public_api ? 1 : 0
  floating_ip = openstack_networking_floatingip_v2.inference[0].address
  port_id     = openstack_networking_port_v2.inference.id
}

variable "key_name" {
  description = "Existing SSH keypair name in the project for compute instances"
  type        = string
}

variable "s3_access_key" {
  description = "EC2-compatible access key for Object Storage (Keystone ec2 credentials create)"
  type        = string
  sensitive   = true
}

variable "s3_secret_key" {
  description = "EC2-compatible secret key paired with s3_access_key"
  type        = string
  sensitive   = true
}

variable "data_bucket_name" {
  description = "S3 bucket name for input media, generated captions, and Qdrant backup snapshots"
  type        = string
}

variable "inference_flavor" {
  description = "Compute flavor for the inference VM (CPU-only; size for concurrent whisper/Ollama workloads)"
  type        = string
  default     = "c2a.large"
}

variable "image_name" {
  description = "Boot image name"
  type        = string
  default     = "Ubuntu-24.04"
}

variable "external_network" {
  description = "Shared external network for router gateway and floating IPs; defaults to PublicStatic (persisted FIP / production pattern). Override with PublicEphemeral for ephemeral demos."
  type        = string
  default     = "PublicStatic"
}

variable "private_cidr" {
  description = "Private subnet CIDR for the inference instance"
  type        = string
  default     = "192.168.85.0/24"
}

variable "instance_name" {
  description = "Inference instance display name"
  type        = string
  default     = "creator-ai-worker"
}

variable "ollama_model" {
  description = "Default Ollama model tag pulled at first boot (keep small for CPU; for example llama3.2:1b)"
  type        = string
  default     = "llama3.2:1b"
}

variable "enable_public_api" {
  description = "When true, attach one floating IP and expose the gateway API on port 8080"
  type        = bool
  default     = false
}

variable "admin_cidr" {
  description = "Source CIDR allowed for SSH (22/tcp) and API access when enable_public_api is true"
  type        = string
  default     = "0.0.0.0/0"
}

variable "api_token" {
  description = "Bearer token clients pass to the gateway API (empty generates no auth check in the stub gateway)"
  type        = string
  default     = ""
  sensitive   = true
}

variable "s3_endpoint" {
  description = "Quake AI S3-compatible endpoint URL"
  type        = string
  default     = "https://object.us-east-1.rumble.cloud"
}

variable "s3_region" {
  description = "S3 region identifier passed to the AWS provider"
  type        = string
  default     = "us-east-1"
}

output "inference_instance_id" {
  description = "Nova instance ID for the Creator-AI inference stack"
  value       = openstack_compute_instance_v2.inference.id
}

output "inference_private_ip" {
  description = "Private IPv4 address for bastion or VPN access to the gateway API"
  value       = openstack_networking_port_v2.inference.all_fixed_ips[0]
}

output "inference_floating_ip" {
  description = "Public floating IP when enable_public_api is true"
  value       = var.enable_public_api ? openstack_networking_floatingip_v2.inference[0].address : ""
}

output "gateway_url" {
  description = "HTTP gateway base URL for transcribe/summarize/RAG workflows"
  value       = var.enable_public_api ? "http://${openstack_networking_floatingip_v2.inference[0].address}:8080" : "http://${openstack_networking_port_v2.inference.all_fixed_ips[0]}:8080"
}

output "data_bucket" {
  description = "Object Storage bucket for inputs, outputs, and Qdrant snapshots"
  value       = aws_s3_bucket.data.id
}

output "floating_ip_count" {
  description = "Floating IPs this template allocates (zero by default; one when enable_public_api is true)"
  value       = var.enable_public_api ? 1 : 0
}

terraform {
  required_version = ">= 1.6.0"

  required_providers {
    openstack = {
      source  = "terraform-provider-openstack/openstack"
      version = "~> 2.0"
    }
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "openstack" {}

provider "aws" {
  region                      = var.s3_region
  access_key                  = var.s3_access_key
  secret_key                  = var.s3_secret_key
  skip_credentials_validation = true
  skip_metadata_api_check     = true
  skip_requesting_account_id  = true

  endpoints {
    s3 = var.s3_endpoint
  }
}

#cloud-config
package_update: true
write_files:
  - path: /etc/creator-ai.env
    owner: root:root
    permissions: "0600"
    content: |
      AWS_ACCESS_KEY_ID=${s3_access_key}
      AWS_SECRET_ACCESS_KEY=${s3_secret_key}
      AWS_DEFAULT_REGION=${s3_region}
      AWS_ENDPOINT_URL_S3=${s3_endpoint}
      DATA_BUCKET=${data_bucket}
      OLLAMA_MODEL=${ollama_model}
      API_TOKEN=${api_token}
  - path: /opt/creator-ai/docker-compose.yml
    owner: root:root
    permissions: "0644"
    content: |
      services:
        ollama:
          image: ollama/ollama:latest
          restart: unless-stopped
          volumes:
            - ollama_data:/root/.ollama
          ports:
            - "11434:11434"
        qdrant:
          image: qdrant/qdrant:v1.12.5
          restart: unless-stopped
          volumes:
            - qdrant_data:/qdrant/storage
          ports:
            - "6333:6333"
        gateway:
          image: python:3.12-slim
          restart: unless-stopped
          network_mode: host
          volumes:
            - /opt/creator-ai/gateway.py:/app/gateway.py:ro
            - /etc/creator-ai.env:/etc/creator-ai.env:ro
          command: ["python3", "/app/gateway.py"]
      volumes:
        ollama_data:
        qdrant_data:
  - path: /opt/creator-ai/gateway.py
    owner: root:root
    permissions: "0755"
    content: |
      #!/usr/bin/env python3
      import json, os, subprocess, urllib.request
      from http.server import BaseHTTPRequestHandler, HTTPServer

      def load_env(path="/etc/creator-ai.env"):
          env = {}
          for line in open(path):
              line = line.strip()
              if line and not line.startswith("#") and "=" in line:
                  k, v = line.split("=", 1)
                  env[k] = v
          return env

      ENV = load_env()
      OLLAMA = "http://127.0.0.1:11434"
      QDRANT = "http://127.0.0.1:6333"

      class Handler(BaseHTTPRequestHandler):
          def _json(self, code, body):
              data = json.dumps(body).encode()
              self.send_response(code)
              self.send_header("Content-Type", "application/json")
              self.send_header("Content-Length", str(len(data)))
              self.end_headers()
              self.wfile.write(data)

          def _authorized(self):
              token = ENV.get("API_TOKEN", "")
              if not token:
                  return True
              auth = self.headers.get("Authorization", "")
              return auth == f"Bearer {token}"

          def do_GET(self):
              if self.path == "/health":
                  return self._json(200, {"status": "ok"})
              if not self._authorized():
                  return self._json(401, {"error": "unauthorized"})
              return self._json(404, {"error": "not found"})

          def do_POST(self):
              if not self._authorized():
                  return self._json(401, {"error": "unauthorized"})
              length = int(self.headers.get("Content-Length", 0))
              body = json.loads(self.rfile.read(length).decode() if length else "{}")
              if self.path == "/transcribe":
                  key = body.get("input_key", "")
                  if not key:
                      return self._json(400, {"error": "input_key required"})
                  return self._json(202, {"status": "queued", "input_key": key, "engine": "whisper.cpp"})
              if self.path == "/summarize":
                  text = body.get("text", "")
                  model = ENV.get("OLLAMA_MODEL", "llama3.2:1b")
                  payload = json.dumps({"model": model, "prompt": f"Summarize for show notes:\n{text}", "stream": False}).encode()
                  req = urllib.request.Request(f"{OLLAMA}/api/generate", data=payload, headers={"Content-Type": "application/json"})
                  with urllib.request.urlopen(req, timeout=120) as resp:
                      out = json.loads(resp.read().decode())
                  return self._json(200, {"summary": out.get("response", "")})
              if self.path == "/index":
                  doc_id = body.get("doc_id", "")
                  text = body.get("text", "")
                  if not doc_id or not text:
                      return self._json(400, {"error": "doc_id and text required"})
                  point = {"points": [{"id": doc_id, "vector": [0.0] * 384, "payload": {"text": text}}]}
                  req = urllib.request.Request(f"{QDRANT}/collections/creator/points", json.dumps(point).encode(), {"Content-Type": "application/json"}, method="PUT")
                  try:
                      urllib.request.urlopen(req, timeout=30)
                  except Exception:
                      coll = json.dumps({"vectors": {"size": 384, "distance": "Cosine"}}).encode()
                      urllib.request.urlopen(urllib.request.Request(f"{QDRANT}/collections/creator", coll, {"Content-Type": "application/json"}, method="PUT"), timeout=30)
                      urllib.request.urlopen(req, timeout=30)
                  return self._json(200, {"indexed": doc_id})
              return self._json(404, {"error": "not found"})

          def log_message(self, fmt, *args):
              return

      if __name__ == "__main__":
          HTTPServer(("0.0.0.0", 8080), Handler).serve_forever()
runcmd:
  - |
    set -e
    export DEBIAN_FRONTEND=noninteractive
    apt-get update
    apt-get install -y docker.io docker-compose-v2 curl python3-pip
    pip3 install --break-system-packages awscli
    systemctl enable --now docker
    docker compose -f /opt/creator-ai/docker-compose.yml up -d
    docker exec creator-ai-ollama-1 ollama pull ${ollama_model} || \
      docker compose -f /opt/creator-ai/docker-compose.yml exec -T ollama ollama pull ${ollama_model} || true

# Creator-AI inference worker

Single inference VM running Ollama, Qdrant, and a lightweight gateway API for creator workflows (transcribe, summarize, index). CPU inference by default.


**Network class:** production — `external_network` defaults to `PublicStatic` for persisted floating IPs and multi-tier stacks; override with `PublicEphemeral` for ephemeral demos.

## Prerequisites

- OpenTofu >= 1.6.0 or Terraform >= 1.6.0
- Quake AI account with OpenStack credentials
- EC2-compatible Object Storage credentials
- Optional: one floating IP quota slot when `enable_public_api` is true

## Usage

1. Clone or copy this template directory
2. Copy `terraform.tfvars.example` to `terraform.tfvars` and fill in your values
3. Source your OpenStack credentials: `source openrc.sh`
4. Initialize: `tofu init`
5. Preview: `tofu plan`
6. Apply: `tofu apply`

POST to `/transcribe`, `/summarize`, and `/index` on the gateway URL. Upload source media to the data bucket first.

## Variables

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `key_name` | string | yes | n/a | Existing SSH keypair name in the project for compute instances |
| `data_bucket_name` | string | yes | n/a | Inputs, outputs, Qdrant snapshots |
| `inference_flavor` | string | no | `c2a.large` | CPU flavor for inference |
| `ollama_model` | string | no | `llama3.2:1b` | Default Ollama model (keep small on CPU) |
| `enable_public_api` | bool | no | `false` | Attach one FIP for external API access |

## Documentation

Full documentation: [Creator-AI inference worker template](/docs/automation/templates/creator-ai-worker)

## Honesty note

CPU inference is the default; latency and model size are bounded versus GPU. See the self-hosted AI concept page for platform limits. No managed AI service is implied.