Metadata-Version: 2.4
Name: hpc-as-api
Version: 0.5.12
Summary: Domain-agnostic HTTP gateway for any HPC function via Globus Compute + WebSocket relay
Project-URL: Homepage, https://github.com/uicacer/hpc-as-api
Project-URL: Repository, https://github.com/uicacer/hpc-as-api
Project-URL: Bug Tracker, https://github.com/uicacer/hpc-as-api/issues
Author-email: Anas Nassar <nassar@uic.edu>
License:                                  Apache License
                                   Version 2.0, January 2004
                                http://www.apache.org/licenses/
        
           TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
        
           1. Definitions.
        
              "License" shall mean the terms and conditions for use, reproduction,
              and distribution as defined by Sections 1 through 9 of this document.
        
              "Licensor" shall mean the copyright owner or entity authorized by
              the copyright owner that is granting the License.
        
              "Legal Entity" shall mean the union of the acting entity and all
              other entities that control, are controlled by, or are under common
              control with that entity. For the purposes of this definition,
              "control" means (i) the power, direct or indirect, to cause the
              direction or management of such entity, whether by contract or
              otherwise, or (ii) ownership of fifty percent (50%) or more of the
              outstanding shares, or (iii) beneficial ownership of such entity.
        
              "You" (or "Your") shall mean an individual or Legal Entity
              exercising permissions granted by this License.
        
              "Source" form shall mean the preferred form for making modifications,
              including but not limited to software source code, documentation
              source, and configuration files.
        
              "Object" form shall mean any form resulting from mechanical
              transformation or translation of a Source form, including but
              not limited to compiled object code, generated documentation,
              and conversions to other media types.
        
              "Work" shall mean the work of authorship made available under
              the License, as indicated by a copyright notice that is included in
              or attached to the work (an example is provided in the Appendix below).
        
              "Derivative Works" shall mean any work, whether in Source or Object
              form, that is based on (or derived from) the Work and for which the
              editorial revisions, annotations, elaborations, or other modifications
              represent, as a whole, an original work of authorship. For the purposes
              of this License, Derivative Works shall not include works that remain
              separable from, or merely link (or bind by name) to the interfaces of,
              the Work and Derivative Works thereof.
        
              "Contribution" shall mean, as defined by Section 1(a), any work of
              authorship submitted to the Licensor for inclusion in the Work by the
              code owner or by an individual or Legal Entity authorized to
              submit on behalf of the copyright owner.
        
              "Contributor" shall mean Licensor and any Legal Entity on behalf of
              whom a Contribution has been received by the Licensor and included
              within the Work.
        
           2. Grant of Copyright License. Subject to the terms and conditions of
              this License, each Contributor hereby grants to You a perpetual,
              worldwide, non-exclusive, no-charge, royalty-free, irrevocable
              copyright license to reproduce, prepare Derivative Works of,
              publicly display, publicly perform, sublicense, and distribute the
              Work and such Derivative Works in Source or Object form.
        
           3. Grant of Patent License. Subject to the terms and conditions of
              this License, each Contributor hereby grants to You a perpetual,
              worldwide, non-exclusive, no-charge, royalty-free, irrevocable
              (except as stated in this section) patent license to make, have made,
              use, offer to sell, sell, import, and otherwise transfer the Work,
              where such license applies only to those patent claims licensable
              by such Contributor that are necessarily infringed by their
              Contribution(s) alone or by the combinations of their Contribution(s)
              with the Work to which such Contribution(s) was submitted. If You
              institute patent proceedings against any entity (including a
              cross-claim or counterclaim in a lawsuit) alleging that the Work
              or a Contribution incorporated within the Work constitutes direct
              or contributory patent infringement, then any patent licenses
              granted to You under this License for that Work shall terminate
              as of the date such litigation is filed.
        
           4. Redistribution. You may reproduce and distribute copies of the
              Work or Distribute or Derivative Works thereof in any medium, with or without
              modifications, and in Source or Object form, provided that You
              meet the following conditions:
        
              (a) You must give any other recipients of the Work or Derivative
                  Works a copy of this License; and
        
              (b) You must cause any modified files to carry prominent notices
                  stating that You changed the files; and
        
              (c) You must retain, in the Source form of any Derivative Works
                  that You distribute, all copyright, patent, trademark, and
                  attribution notices from the Source form of the Work,
                  excluding those notices that do not pertain to any part of
                  the Derivative Works; and
        
              (d) If the Work includes a "NOTICE" text file as part of its
                  distribution, You must include a readable copy of the
                  attribution notices contained within such NOTICE file, in
                  at least one of the following places: within a NOTICE text
                  file distributed as part of the Derivative Works; within
                  the Source form or documentation, if provided along with the
                  Derivative Works; or, within a display generated by the
                  Derivative Works, if and wherever such third-party notices
                  normally appear. The contents of the NOTICE file are for
                  informational purposes only and do not modify the License.
        
           5. Submission of Contributions. Unless You explicitly state otherwise,
              any Contribution intentionally submitted for inclusion in the Work
              by You to the Licensor shall be under the terms and conditions of
              this License, without any additional terms or conditions.
        
           6. Trademarks. This License does not grant permission to use the trade
              names, trademarks, service marks, or product names of the Licensor,
              except as required for reasonable and customary use in describing the
              origin of the Work and reproducing the content of the NOTICE file.
        
           7. Disclaimer of Warranty. Unless required by applicable law or agreed
              to in writing, Licensor provides the Work (and each Contributor
              provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES
              OR CONDITIONS OF ANY KIND, either express or implied, including,
              without limitation, any warranties or conditions of TITLE,
              NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
        
           8. Limitation of Liability. In no event and under no legal theory,
              whether in tort (including negligence), contract, or otherwise,
              unless required by applicable law (such as deliberate and grossly
              negligent acts) or agreed to in writing, shall any Contributor be
              liable to You for damages, including any direct, indirect, special,
              incidental, or exemplary damages of any kind arising as a result of
              this License or out of the use or inability to use the Work.
        
           9. Accepting Warranty or Liability. While redistributing the Work or
              Derivative Works thereof, You may choose to offer, and charge a fee
              for, acceptance of support, warranty, indemnity, or other liability
              obligations and/or rights consistent to the Law. However, in accepting
              such obligations, You may offer such obligations only on Your own behalf
              and on Your sole responsibility, not on behalf of any other Contributor.
        
           END OF TERMS AND CONDITIONS
        
           Copyright 2026 Anas Nassar, University of Illinois Chicago
        
           Licensed under the Apache License, Version 2.0 (the "License");
           you may not use this file except in compliance with the License.
           You may obtain a copy of the License at
        
               http://www.apache.org/licenses/LICENSE-2.0
        
           Unless required by applicable law or agreed to in writing, software
           distributed under the License is distributed on an "AS IS" BASIS,
           WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
           See the License for the specific language governing permissions and
           limitations under the License.
License-File: LICENSE
Keywords: api-gateway,domain-agnostic,globus-compute,hpc,llm,scientific-computing,slurm,streaming,vllm
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Science/Research
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
Classifier: Topic :: Scientific/Engineering
Classifier: Topic :: System :: Distributed Computing
Requires-Python: >=3.11
Requires-Dist: cryptography>=43.0
Requires-Dist: fastapi>=0.115
Requires-Dist: httpx>=0.28
Requires-Dist: streamrelay>=0.3.1
Requires-Dist: uvicorn[standard]>=0.34
Requires-Dist: websockets>=13.0
Provides-Extra: dev
Requires-Dist: httpx>=0.28; extra == 'dev'
Requires-Dist: mypy>=1.14; extra == 'dev'
Requires-Dist: pre-commit>=4.0; extra == 'dev'
Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff; extra == 'dev'
Provides-Extra: globus
Requires-Dist: globus-compute-sdk>=2.0; extra == 'globus'
Requires-Dist: globus-sdk>=4.0; extra == 'globus'
Description-Content-Type: text/markdown

# hpc-as-api

[![PyPI](https://img.shields.io/pypi/v/hpc-as-api)](https://pypi.org/project/hpc-as-api/)
[![Tests](https://github.com/uicacer/hpc-as-api/actions/workflows/tests.yml/badge.svg)](https://github.com/uicacer/hpc-as-api/actions)
[![License](https://img.shields.io/badge/license-Apache%202.0-blue)](https://github.com/uicacer/hpc-as-api/blob/main/LICENSE)

**HTTP gateway for any HPC function — real-time streaming from any HPC workload.**

`hpc-as-api` turns any Python function running on an HPC cluster into a streaming HTTP endpoint. Register your function, define its input schema with Pydantic, and get a production-ready REST API with authentication, rate limiting, and live SSE streaming — no open ports, no VPN, no firewall changes on the HPC side.

```python
from hpc_as_api.core import HPCApp
from pydantic import BaseModel

class SimRequest(BaseModel):
    steps: int = 1000
    grid_size: int = 100

def hpc_simulation(steps, grid_size, relay_url, channel_id, relay_secret=""):
    from streamrelay import RelayProducer
    with RelayProducer(relay_url, channel_id, relay_secret=relay_secret) as relay:
        for i in range(steps):
            result = run_timestep(i, grid_size)
            relay.send_token(f"step={i} energy={result:.4f}\n")

app = HPCApp(endpoint_id="...", relay_url="wss://relay.example.com") \
    .mount("/simulate", hpc_simulation, SimRequest) \
    .create_app()
```

Any output produced incrementally on the HPC side arrives in real time: simulation checkpoints, solver residuals, genome alignment progress, molecular dynamics snapshots, LLM tokens — anything.

## Why

HPC clusters run workloads impossible on commodity hardware — 72B+ parameter models, climate simulations, molecular dynamics at scale. But they expose no standard API. Each cluster has its own SLURM scripts, SSH tunnels, authentication systems, and job submission conventions.

`hpc-as-api` provides a uniform HTTP interface over any HPC function using [Globus Compute](https://www.globus.org/compute) for authentication and job dispatch and [streamrelay](https://github.com/uicacer/streamrelay) for real-time output streaming. Callers send a POST request; the framework handles everything else.

## Architecture

```
Your Application / HTTP Client
        │  POST /your-endpoint  (any input schema)
        ▼
  hpc-as-api (FastAPI)
        │  Globus Compute (AMQP — no HPC firewall holes)
        ▼
  HPC Cluster (SLURM / PBS / …)
        │  your function runs; output flows via streamrelay
        ▼
  GPU / CPU Compute Node
        │  tokens / results / checkpoints via WebSocket relay
        ▼
  hpc-as-api → SSE stream → Your Application
```

Key design points:
- **No open ports on HPC**: Globus Compute is outbound-only from the cluster
- **Real-time streaming**: Any incremental output arrives as SSE via [streamrelay](https://github.com/uicacer/streamrelay)
- **E2E encryption**: Optional AES-256-GCM encryption — relay sees only ciphertext
- **Domain-agnostic**: Register any Python function; not limited to LLMs

## Installation

```bash
# Base package (no Globus SDK)
pip install hpc-as-api

# With Globus Compute support
pip install "hpc-as-api[globus]"
```

## Quickstart: Domain-agnostic gateway

Register any HPC function and stream its output:

```python
from hpc_as_api.core import HPCApp
from pydantic import BaseModel

class RunRequest(BaseModel):
    steps: int = 1000
    param: float = 0.5

def my_hpc_function(steps, param, relay_url, channel_id, relay_secret=""):
    from streamrelay import RelayProducer
    with RelayProducer(relay_url, channel_id, relay_secret=relay_secret) as relay:
        for i in range(steps):
            relay.send_token(f"step={i} value={compute(i, param)}\n")

gateway = HPCApp(
    endpoint_id="your-globus-endpoint-uuid",
    relay_url="wss://relay.example.com",
    relay_secret="your-relay-secret",
)
gateway.mount("/run", my_hpc_function, RunRequest)
app = gateway.create_app()
```

Run with:
```bash
uvicorn mymodule:app --host 0.0.0.0 --port 8001
```

Clients stream the output in real time:
```bash
export API_KEY="sk-your-key"
curl -N -X POST http://localhost:8001/run \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"steps": 500, "param": 0.7}'
```

## Built-in preset: OpenAI-compatible LLM gateway

For vLLM-served language models, the OpenAI preset provides a drop-in
`/v1/chat/completions` endpoint compatible with any OpenAI client:

```python
from hpc_as_api.presets.openai import create_openai_app

app = create_openai_app(
    endpoint_id="8d978809-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    models={
        "gemma4-31b": {
            "hf_name": "gemma4-31b",
            "url": "http://127.0.0.1:8001",
            "context_reserve_output": 8192,
        }
    },
    relay_url="wss://relay.example.com",
    relay_secret="your-relay-secret",
)
```

Or run as a service from environment variables:

```bash
export GLOBUS_COMPUTE_ENDPOINT_ID="your-endpoint-uuid"
export HPC_MODELS='{"gemma4-31b": {"hf_name": "gemma4-31b", "url": "http://127.0.0.1:8001", "context_reserve_output": 8192}}'
export RELAY_URL="wss://relay.example.com"
export RELAY_SECRET="your-relay-secret"
export PROXY_API_KEY_MYSERVICE="sk-your-key"

uvicorn hpc_as_api.app:app --host 127.0.0.1 --port 8002
```

Any OpenAI client works without modification:
```python
import os
from openai import OpenAI

client = OpenAI(
    base_url="http://localhost:8002/v1",
    api_key=os.environ["PROXY_API_KEY_MYSERVICE"],
)
response = client.chat.completions.create(
    model="gemma4-31b",
    messages=[{"role": "user", "content": "Hello!"}],
    stream=True,
)
for chunk in response:
    print(chunk.choices[0].delta.content or "", end="", flush=True)
```

## Multiple independent gateways

`create_openai_app()` returns a fresh, independent instance each time — safe to
run multiple gateways with different configurations in the same process:

```python
from hpc_as_api.presets.openai import create_openai_app

llm_a = create_openai_app(endpoint_id="endpoint-a", models={...}, relay_url="wss://relay.example.com")
llm_b = create_openai_app(endpoint_id="endpoint-b", models={...}, relay_url="wss://relay.example.com")
```

## Programmatic auth configuration

```python
from hpc_as_api import AuthConfig
from hpc_as_api.core import HPCApp

gateway = HPCApp(
    endpoint_id="...",
    relay_url="wss://relay.example.com",
    auth=AuthConfig(
        globus_client_id="your-client-id",
        globus_client_secret="your-client-secret",
        allowed_domains=["university.edu"],
        api_keys={"my-service": "sk-xxxx"},
        rate_limit_requests=10000,
        rate_limit_window=60,
    ),
)
```

## Configuration reference

### HPCApp / create_openai_app()

| Argument | Env var fallback | Description |
|---|---|---|
| `endpoint_id` | `GLOBUS_COMPUTE_ENDPOINT_ID` | Globus endpoint UUID for the HPC cluster |
| `relay_url` | `RELAY_URL` | WebSocket relay URL for streaming |
| `relay_secret` | `RELAY_SECRET` | Shared secret for relay auth |
| `relay_encryption_key` | `RELAY_ENCRYPTION_KEY` | AES-256 hex key for E2E encryption |
| `auth` | — | `AuthConfig` or `Authenticator` instance |

### OpenAI preset environment variables

| Variable | Default | Description |
|---|---|---|
| `HPC_MODELS` | `{}` | JSON dict: model alias → `{"hf_name", "url", "context_reserve_output"}` |
| `PROXY_API_KEY_<NAME>` | — | API key for service `<NAME>` — any number of keys, any suffix |
| `PROXY_RATE_LIMIT_REQUESTS` | `10000` | Global max requests per window (per-caller sliding window) |
| `PROXY_RATE_LIMIT_WINDOW` | `60` | Window size in seconds |
| `PROXY_RATE_LIMIT_REQUESTS_<NAME>` | — | Per-key override; `<NAME>` must match the suffix in `PROXY_API_KEY_<NAME>` (lowercased) |
| `USE_GLOBUS_COMPUTE` | `true` | `false` to route directly to a vLLM URL without Globus |

### HPC_MODELS schema

```json
{
  "my-model-alias": {
    "hf_name": "my-model-alias",
    "url": "http://127.0.0.1:8001",
    "context_reserve_output": 8192
  }
}
```

`hf_name` must exactly match `--served-model-name` in the vLLM SLURM script.
`url` is where vLLM is reachable from the Globus Compute worker (usually `http://127.0.0.1:PORT` when workers are co-located).

## Authentication

Two auth modes coexist automatically, configured via `AuthConfig` or environment variables:

**Mode A — Globus token** (for institutional users)
The caller presents a Globus access token validated via introspection. The job runs under the caller's Globus identity. Set `GLOBUS_CLIENT_ID`, `GLOBUS_CLIENT_SECRET`, and optionally `PROXY_ALLOWED_DOMAINS`.

**Mode B — API key** (for service-to-service callers)
The caller presents a static key. Set one or more `PROXY_API_KEY_<NAME>=<value>` env vars. The `<NAME>` suffix (lowercased) identifies the caller in logs and rate-limit overrides.

```bash
# Example: two keys, different rate limits
PROXY_API_KEY_CLASS=sk-class-key
PROXY_API_KEY_DEMO=sk-demo-key
PROXY_RATE_LIMIT_REQUESTS=10000      # class key: 10k req/min
PROXY_RATE_LIMIT_REQUESTS_DEMO=20    # demo key: 20 req/min
```

> **Scaling to per-student keys (future work):** For classroom deployments with hundreds of students, the planned approach is a `PROXY_KEYS_FILE` pointing at a JSON file of `{"student_name": "sk-..."}` pairs loaded and merged with env-var keys at startup. A bulk generation script produces all keys at once; students receive theirs via Canvas. No OAuth, no login, no extra infrastructure. Not yet implemented.

## Development

```bash
git clone https://github.com/uicacer/hpc-as-api
cd hpc-as-api
uv sync --extra dev

# Install pre-commit hooks (ruff, mypy, gitleaks, hygiene checks)
pre-commit install

uv run pytest
```

## Deployment

See [docs/deployment.md](docs/deployment.md) for the full sysadmin guide (systemd, Caddy TLS, Globus endpoint, secrets management).

See [docs/tutorial.ipynb](docs/tutorial.ipynb) for a zero-to-hero walkthrough from relay primitives through production deployment.

## Related

- [streamrelay](https://github.com/uicacer/streamrelay) — WebSocket relay for real-time output streaming from Globus Compute
- [STREAM](https://github.com/uicacer/STREAM) — Full tiered LLM routing system that uses hpc-as-api

## Authors

- **Anas Nassar** (nassar@uic.edu) — University of Illinois Chicago

## License

Apache 2.0 — see [LICENSE](LICENSE).

## Citation

If you use hpc-as-api in research, please cite:

```bibtex
@software{nassar2025hpcgateway,
  author = {Nassar, Anas},
  title  = {hpc-as-api: HTTP gateway for any HPC function via Globus Compute and WebSocket relay},
  year   = {2025},
  url    = {https://github.com/uicacer/hpc-as-api}
}
```
