Proxy ml-service through backend instead of a separate Lightsail service

ml-service goes back to being a second container in the same
aspc-backend-v1 deployment (reachable via localhost only, no public
endpoint of its own — Lightsail only allows one per service). backend
gains /api/ml (status, open) and /api/ml/match (API-key gated), the one
public door external callers like p-ickup/frontend use to reach it.

This replaces the standalone aspc-ml-service Lightsail service from the
previous approach, which needed its own AWS resource and gave external
callers an unpredictable, newly-assigned hostname. This way the URL is
the backend's already-known public address, and no new AWS resource is
needed at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Khai189

.github/workflows/deploy-backend.yml

@@ -1,11 +1,12 @@
-name: Deploy Backend to AWS Lightsail
+name: Deploy Backend + ML Service to AWS Lightsail
 on:
   pull_request:
     types: [closed]
     branches:
       - main
     paths:
       - 'backend/**'
+      - 'ml_microservice/**'
   workflow_dispatch:  # Add this to allow manual runs
     inputs:
       environment:
@@ -16,41 +17,49 @@ jobs:
   build-and-deploy:
     if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
     runs-on: ubuntu-latest
-    
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-      
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-      
+
       - name: Login to DockerHub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      
-      - name: Build and push Docker image
+
+      - name: Build and push backend image
         uses: docker/build-push-action@v5
         with:
           context: ./backend
           push: true
           tags: ${{ secrets.DOCKERHUB_USERNAME }}/aspc-backend:latest
           platforms: linux/amd64
-      
+
+      - name: Build and push ML service image
+        uses: docker/build-push-action@v5
+        with:
+          context: ./ml_microservice
+          push: true
+          tags: ${{ secrets.DOCKERHUB_USERNAME }}/aspc-ml-service:latest
+          platforms: linux/amd64
+
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: us-west-2
-      
+
       - name: Install Lightsail Control plugin
         run: |
           curl "https://s3.us-west-2.amazonaws.com/lightsailctl/latest/linux-amd64/lightsailctl" -o "lightsailctl"
           chmod +x ./lightsailctl
           sudo mv ./lightsailctl /usr/local/bin/lightsailctl
-      
+
       - name: Create deployment configuration
         run: |
           cat > containers.json << EOF
@@ -70,7 +79,21 @@ jobs:
                 "PORT": "5000",
                 "IDP_METADATA_URL": "${{ secrets.IDP_METADATA_URL }}",
                 "ENGAGE_API_KEY": "${{ secrets.ENGAGE_API_KEY }}",
-                "ENGAGE_API_URL": "${{ secrets.ENGAGE_API_URL }}"
+                "ENGAGE_API_URL": "${{ secrets.ENGAGE_API_URL }}",
+                "ML_SERVICE_URL": "http://localhost:8000",
+                "ML_SERVICE_API_KEY": "${{ secrets.ML_SERVICE_API_KEY }}",
+                "ML_PROXY_API_KEY": "${{ secrets.ML_PROXY_API_KEY }}"
+              }
+            },
+            "ml-service": {
+              "image": "${{ secrets.DOCKERHUB_USERNAME }}/aspc-ml-service:latest",
+              "ports": {
+                "8000": "HTTP"
+              },
+              "environment": {
+                "SUPABASE_URL": "${{ secrets.SUPABASE_URL }}",
+                "SUPABASE_SECRET_KEY": "${{ secrets.SUPABASE_SECRET_KEY }}",
+                "SERVICE_API_KEY": "${{ secrets.ML_SERVICE_API_KEY }}"
               }
             }
           }
@@ -90,12 +113,12 @@ jobs:
             }
           }
           EOF
-      
+
       - name: Deploy to Lightsail
         run: |
           aws lightsail create-container-service-deployment \
             --service-name aspc-backend-v1 \
             --containers file://containers.json \
             --public-endpoint file://public-endpoint.json
-            
+
           echo "Deployment initiated. Check the AWS Lightsail console for status."

.github/workflows/deploy-ml-service.yml

@@ -21,3 +21,16 @@ COURSE_API_KEY=
 # --- Campus Labs Engage (events) ---
 ENGAGE_API_URL=
 ENGAGE_API_KEY=
+
+# --- Ride-matching ML service (ml_microservice/, deployed as a second
+# container in this same Lightsail service — reachable at localhost, not
+# public on its own). /api/ml/* on this backend is the one public door to
+# it, for external callers like p-ickup/frontend. ---
+ML_SERVICE_URL=http://localhost:8000
+# Sent as X-API-Key when this backend calls ml-service internally. Must
+# match SERVICE_API_KEY in ml_microservice/.env.
+ML_SERVICE_API_KEY=
+# Sent as X-API-Key by external callers (e.g. p-ickup/frontend) hitting
+# POST /api/ml/match on *this* backend. Different key from the one above —
+# this one guards the public door, that one guards the internal hop.
+ML_PROXY_API_KEY=

backend/.env.example

@@ -0,0 +1,59 @@
+import express from 'express';
+import axios from 'axios';
+
+const router = express.Router();
+
+// ml-service runs as a second container in the same Lightsail deployment as
+// this backend, reachable only via localhost — not publicly exposed on its
+// own. This router is the one public door to it, for external callers like
+// p-ickup/frontend (which has no other way to reach it).
+const ML_SERVICE_URL = process.env.ML_SERVICE_URL || 'http://localhost:8000';
+
+const mlServiceHeaders = () =>
+    process.env.ML_SERVICE_API_KEY
+        ? { 'X-API-Key': process.env.ML_SERVICE_API_KEY }
+        : {};
+
+// Status check — intentionally no API key required, mirrors ml-service's own
+// open GET / (just reports configured/reachable, nothing sensitive).
+router.get('/', async (req, res) => {
+    try {
+        const response = await axios.get(ML_SERVICE_URL, {
+            headers: mlServiceHeaders(),
+            timeout: 5000,
+        });
+        res.json(response.data);
+    } catch (error) {
+        console.error('ml-service unreachable:', error);
+        res.status(502).json({ message: 'Could not reach the matching service.' });
+    }
+});
+
+router.post('/match', async (req, res) => {
+    const expectedKey = process.env.ML_PROXY_API_KEY;
+    if (!expectedKey) {
+        res.status(503).json({ message: 'ML_PROXY_API_KEY is not configured on the server.' });
+        return;
+    }
+    if (req.headers['x-api-key'] !== expectedKey) {
+        res.status(401).json({ message: 'Missing or invalid X-API-Key header.' });
+        return;
+    }
+
+    try {
+        const response = await axios.post(`${ML_SERVICE_URL}/match`, req.body, {
+            headers: mlServiceHeaders(),
+            timeout: 30000,
+        });
+        res.json(response.data);
+    } catch (error) {
+        if (axios.isAxiosError(error) && error.response) {
+            res.status(error.response.status).json(error.response.data);
+            return;
+        }
+        console.error('ml-service match request failed:', error);
+        res.status(502).json({ message: 'Failed to reach the matching service.' });
+    }
+});
+
+export default router;

backend/src/routes/MlProxyRoutes.ts

@@ -17,6 +17,7 @@ import instructorsRoutes from './routes/InstructorsRoutes';
 import reviewsRoutes from './routes/ReviewsRoutes';
 import forumRoutes from './routes/ForumRoutes';
 import votingRoutes from './routes/VotingRoutes';
+import mlProxyRoutes from './routes/MlProxyRoutes';
 import session from 'express-session';
 import https from 'https';
 import http from 'http';
@@ -131,6 +132,7 @@ app.use('/api/openforum', forumRoutes);
 app.use('/api/admin/elections', electionsDashboardRoutes);
 app.use('/api/admin/users', adminUsersRoutes);
 app.use('/api/voting', votingRoutes);
+app.use('/api/ml', mlProxyRoutes);
 
 const PORT = serverConfig.port;