Fix Phase 1 server validation defects

ansible/roles/cezen-backend/files/cezen-api.service

@@ -9,6 +9,7 @@ User=cezen
 WorkingDirectory=/opt/cezen/backend
 Environment="CEZEN_DATA=/opt/cezen/data"
 Environment="OLLAMA_URL=http://localhost:11434"
+Environment="CHROMA_URL=http://localhost:8100"
 Environment="PATH=/opt/cezen/backend/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin"
 ExecStart=/opt/cezen/backend/venv/bin/uvicorn main:app --host 0.0.0.0 --port 8080 --workers 2
 Restart=always

ansible/roles/cezen-backend/files/main.py

@@ -2412,6 +2412,11 @@ def _ollama_embed(texts: list[str], model: str = OLLAMA_EMBED) -> list[list[floa
                 log_context=f"_ollama_embed(model={model})", log_exc=e)
     return embeddings
 
+def _chroma_collection_id(name: str) -> str:
+    """Resolve a stable Chroma collection name to the UUID required by data routes."""
+    collection = _chroma_req("GET", f"/api/v1/collections/{name}")
+    return collection["id"]
+
 # Collections
 @app.get("/api/rag/collections")
 async def list_collections(admin: dict = Depends(admin_only)):
@@ -2554,7 +2559,8 @@ async def delete_document(cid: int, doc_id: int, admin: dict = Depends(admin_onl
     # Remove chunks from ChromaDB
     if col:
         try:
-            _chroma_req("POST", f"/api/v1/collections/{col['chroma_name']}/delete",
+            chroma_id = _chroma_collection_id(col["chroma_name"])
+            _chroma_req("POST", f"/api/v1/collections/{chroma_id}/delete",
                         body={"where": {"doc_id": {"$eq": doc_id}}})
         except Exception:
             pass
@@ -2598,7 +2604,8 @@ async def rag_query(body: dict, user: dict = Depends(current_user)):
         raise HTTPException(status_code=503, detail="Failed to embed query")
 
     # Query ChromaDB
-    result = _chroma_req("POST", f"/api/v1/collections/{col['chroma_name']}/query", body={
+    chroma_id = _chroma_collection_id(col["chroma_name"])
+    result = _chroma_req("POST", f"/api/v1/collections/{chroma_id}/query", body={
         "query_embeddings": embed,
         "n_results": n_results,
         "include": ["documents", "metadatas", "distances"]

ansible/roles/cezen-backend/files/rag_ingest.py

@@ -162,9 +162,9 @@ def chunk_text(text: str, chunk_size: int = CHUNK_SIZE, overlap: int = CHUNK_OVE
                     chunk = chunk[:idx + len(sep)]
                     break
         chunks.append(chunk.strip())
-        start += len(chunk) - overlap
-        if start >= len(text):
+        if end >= len(text):
             break
+        start += max(1, len(chunk) - overlap)
     return [c for c in chunks if c]
 
 # ── Embedding ─────────────────────────────────────────────────────────────────
@@ -197,8 +197,10 @@ def chroma_upsert(ids, embeddings, documents, metadatas):
         "documents":  documents,
         "metadatas":  metadatas,
     }).encode()
+    with urllib.request.urlopen(f"{args.chroma_url}/api/v1/collections/{args.collection}", timeout=30) as response:
+        collection_id = json.loads(response.read().decode())["id"]
     req = urllib.request.Request(
-        f"{args.chroma_url}/api/v1/collections/{args.collection}/upsert",
+        f"{args.chroma_url}/api/v1/collections/{collection_id}/upsert",
         data=body, method="POST"
     )
     req.add_header("Content-Type", "application/json")

ansible/roles/cezen-ttyd/files/cezen-ttyd.service

@@ -7,7 +7,6 @@ After=network.target
 ExecStart=/usr/bin/ttyd \
     --port 7681 \
     --interface 127.0.0.1 \
-    --writable \
     login -f cezen-console
 Restart=always
 RestartSec=5

ansible/roles/cezen-ttyd/tasks/main.yml

@@ -7,6 +7,13 @@
     state: present
     update_cache: yes
 
+- name: Disable distribution ttyd service to reserve the portal console port
+  systemd:
+    name: ttyd
+    enabled: no
+    state: stopped
+  failed_when: false
+
 - name: Create cezen-console restricted user
   user:
     name: cezen-console

ansible/roles/chromadb/tasks/main.yml

@@ -1,9 +1,14 @@
 ---
 # ChromaDB — vector database for RAG pipelines
-- name: Install ChromaDB in cezen conda env
-  become_user: cezen
-  shell: |
-    /opt/cezen/miniconda/bin/conda run -n cezen pip install chromadb
+- name: Create isolated ChromaDB virtual environment
+  command: /usr/bin/python3 -m venv /opt/cezen/chromadb-venv
+  args:
+    creates: /opt/cezen/chromadb-venv/bin/python
+
+- name: Install pinned ChromaDB in its isolated environment
+  pip:
+    name: chromadb==0.5.23
+    virtualenv: /opt/cezen/chromadb-venv
   retries: 3
   delay: 10
 
@@ -27,13 +32,13 @@
       User=cezen
       Group=cezen
       WorkingDirectory=/opt/cezen/data/chromadb
-      ExecStart=/opt/cezen/miniconda/envs/cezen/bin/chroma run \
+      ExecStart=/opt/cezen/chromadb-venv/bin/chroma run \
         --host 0.0.0.0 \
         --port 8100 \
         --path /opt/cezen/data/chromadb
       Restart=always
       RestartSec=5
-      Environment="PATH=/opt/cezen/miniconda/envs/cezen/bin:/usr/local/bin:/usr/bin:/bin"
+      Environment="PATH=/opt/cezen/chromadb-venv/bin:/usr/local/bin:/usr/bin:/bin"
 
       [Install]
       WantedBy=multi-user.target

ansible/roles/vllm/tasks/main.yml

@@ -22,7 +22,7 @@
   when: gpu_check.stdout == "" or gpu_check.rc != 0
 
 - name: Pull vLLM Docker image
-  shell: docker pull vllm/vllm-openai:latest
+  shell: docker pull vllm/vllm-openai:v0.10.2
   retries: 3
   delay: 15
   when: gpu_check.stdout != "" and gpu_check.rc == 0
@@ -53,12 +53,11 @@
         -p 8000:8000 \
         -v /opt/cezen/models:/root/.cache/huggingface \
         -e HF_HOME=/root/.cache/huggingface \
-        vllm/vllm-openai:latest \
+        vllm/vllm-openai:v0.10.2 \
         --model {{ vllm_model }} \
         --gpu-memory-utilization {{ vllm_gpu_memory_util }} \
         --max-model-len {{ vllm_max_model_len }} \
-        --tensor-parallel-size {{ vllm_tensor_parallel }} \
-        {{ vllm_quant_flag }}
+        --tensor-parallel-size {{ vllm_tensor_parallel }}{{ ' ' + vllm_quant_flag if vllm_quant_flag else '' }}
       ExecStop=/usr/bin/docker stop vllm
       TimeoutStartSec=300
 
@@ -92,5 +91,6 @@
   systemd:
     name: vllm
     enabled: true
+    state: started
     daemon_reload: true
   when: gpu_check.stdout != "" and gpu_check.rc == 0

ansible/starter.yml

@@ -32,7 +32,7 @@
     vllm_tensor_parallel: 1
     vllm_gpu_memory_util: "0.85"
     vllm_max_model_len: 4096
-    vllm_quantization: "awq"
+    vllm_quantization: ""          # Phi-3 source model is not AWQ-quantized
 
     # ── Ollama — lightweight models ───────────────
     ollama_default_model: "phi3:mini"