Metadata-Version: 2.5
Name: aieng-platform-onboard
Version: 0.7.6
Summary: CLI tool for onboarding participants to AI Engineering bootcamps
Author-email: Vector AI Engineering <ai_engineering@vectorinstitute.ai>
License-Expression: Apache-2.0
License-File: LICENSE.md
Requires-Python: >=3.12
Requires-Dist: authlib==1.9.1
Requires-Dist: cryptography>=50.0.0
Requires-Dist: filelock>=3.24.2
Requires-Dist: firebase-admin>=6.5.0
Requires-Dist: google-auth>=2.29.0
Requires-Dist: google-cloud-firestore>=2.18.0
Requires-Dist: google-cloud-secret-manager>=2.20.0
Requires-Dist: google-cloud-storage
Requires-Dist: idna>=3.15
Requires-Dist: msgpack>=1.2.1
Requires-Dist: openai>=1.0.0
Requires-Dist: pandas>=2.3.3
Requires-Dist: pygments>=2.20.0
Requires-Dist: pyjwt>=2.14.0
Requires-Dist: python-dotenv>=1.0.0
Requires-Dist: requests>=2.33.0
Requires-Dist: rich>=13.0.0
Requires-Dist: urllib3>=2.8.0
Requires-Dist: virtualenv>=21.7.13
Requires-Dist: weaviate-client>=4.0.0
Description-Content-Type: text/markdown

# AI Engineering Platform

----------------------------------------------------------------------------------------

[![PyPI](https://img.shields.io/pypi/v/aieng-platform-onboard)](https://pypi.org/project/aieng-platform-onboard)
[![code checks](https://github.com/VectorInstitute/aieng-platform/actions/workflows/code_checks.yml/badge.svg)](https://github.com/VectorInstitute/aieng-platform/actions/workflows/code_checks.yml)
[![unit tests](https://github.com/VectorInstitute/aieng-platform/actions/workflows/unit_tests.yml/badge.svg)](https://github.com/VectorInstitute/aieng-platform/actions/workflows/unit_tests.yml)
[![docs](https://github.com/VectorInstitute/aieng-platform/actions/workflows/docs.yml/badge.svg)](https://github.com/VectorInstitute/aieng-platform/actions/workflows/docs.yml)
[![codecov](https://codecov.io/github/VectorInstitute/aieng-platform/graph/badge.svg?token=83MYFZ3UPA)](https://codecov.io/github/VectorInstitute/aieng-platform)
[![GitHub License](https://img.shields.io/github/license/VectorInstitute/aieng-platform)](https://img.shields.io/github/license/VectorInstitute/aieng-platform)


Infrastructure and tooling for AI Engineering bootcamps, providing secure, isolated development environments and automated participant onboarding.

## Overview

This platform consists of the following components:

1. **Coder Deployment** - Containerized development environments supported by [Coder](https://coder.com)
2. **Participant Onboarding System** - Secure, automated participant onboarding

---

## 1. Coder Deployment for GCP

The `coder` folder contains all resources needed to deploy a [Coder](https://coder.com) instance on Google Cloud Platform (GCP), along with reusable workspace templates and Docker images for the workspace environment.

### Structure

- **deploy/** - Terraform scripts and startup automation for provisioning the Coder server on a GCP VM
- **docker/** - Dockerfiles and guides for building custom images used by Coder workspace templates
- **templates/** - Coder workspace templates for reproducible, containerized development environments on GCP

### Architecture

![Coder deployment architecture](docs/assets/coder_architecture.svg)

*Figure: participants reach the Coder server through a Google-managed HTTPS load balancer; the server VM sits in a private subnet and provisions one Container-Optimized OS VM per workspace from Terraform templates, whose coder agent dials back to the access URL (editable source: `docs/assets/coder_architecture.svg`).*

**Control plane** (`coder/deploy/`): Terraform creates a dedicated VPC with a private subnet for the Coder server VM (no public IP), a Cloud Router and NAT for outbound traffic, and a global external HTTPS load balancer with a Google-managed certificate for `platform.vectorinstitute.ai` and its wildcard app subdomains. `startup.sh` installs Docker and Coder, and configures GitHub OAuth sign-in (restricted to allowed orgs) and GitHub App external auth through a systemd override. The `Deploy Coder to GCP` workflow runs `terraform plan` and `apply` with state in a GCS bucket.

**Workspaces** (`coder/templates/`): when a participant starts a workspace, the server runs the template's Terraform to create a GCE VM and a persistent SSD mounted at `/home/coder`. The VM runs a container image from `coder/docker/` (pulled from Artifact Registry) that starts the coder agent, which authenticates with Google instance identity and connects out to the server, so SSH, VS Code Web, JupyterLab and Streamlit are tunnelled through the server. Stopping a workspace deletes the VM and keeps the data disk. `bootcamp_gpu` adds an NVIDIA T4 on an n1 machine type.

**Operations**: templates are published with `coder templates push`, images are built with `gcloud builds submit`, and the `Collect Coder Analytics` workflow snapshots workspace usage to GCS every 6 hours for the analytics dashboard on Cloud Run.

### Usage

1. **Provision Coder on GCP** - Follow the steps in [`coder/deploy/README.md`](coder/deploy/README.md)
2. **Build and Push Docker Images** - See [`coder/docker/README.md`](coder/docker/README.md)
3. **Push Workspace Templates** - See [`coder/templates/README.md`](coder/templates/README.md)

---

## 2. Participant Onboarding System

Automated API key distribution for bootcamp participants using GCP Secret Manager and workload identity.

- Secrets never written to disk — exported into the shell via `eval "$(onboard ...)"`
- Workspace VMs authenticate directly to Secret Manager via workload identity (no Firebase, no token service)
- Per-participant JSON secrets named `{bootcamp-name}-env-{github-handle}`
- Firestore tracks participant records and onboarded status

### Architecture

```
Admin Phase
  1. onboard admin setup-participants  →  participants and teams in Firestore
  2. Optional: set-global-keys (shared values), upload-langfuse-keys (per team)
  3. Create one gateway key per team in the gateway dashboard
  4. onboard admin provision-bootcamp --team-keys-csv  →  per-participant
     Secret Manager secrets, readable by the workspace service account
  5. Add users to GitHub org

Participant Phase
  1. eval "$(onboard --bootcamp-name <name>)"  in Coder workspace
  2. Fetches env vars from Secret Manager via workload identity
  3. Runs integration tests (env vars injected, nothing written to disk)
  4. Marks participant as onboarded in Firestore
```

---
