Self-host the automations on your own box (no gcloud/Cloud Run/GCS)

[krMaynard]

What & why

Picks up the merged availability-sync feature (#34) and makes it runnable on an always-on box without gcloud/Cloud Run, per the request to "use my box as the server."

The deploy migration (#35) is red because CI hard-fails the paid Gemini eval tests without a GEMINI_API_KEY secret, and the Cloud Run deploy also needs WIF/vars that aren't configured. Self-hosting sidesteps all of that: main.py already uses file-based OAuth when GOOGLE_CREDENTIALS_FILE is set, and /availability-sync only touches the Calendar API (no GCS, no Gemini).

Changes

• deploy/selfhost/ — assistant.service (Flask server), availability-sync.service + .timer (local Cloud Scheduler, every 30 min), env.example, and a step-by-step guide.
• mint_token.py — one-time OAuth consent → token.json; the service refreshes silently afterward and never opens a browser (key for a headless box).
• README — "Run it on your own box" section.

No changes to app code — this is purely the run/operate path.

Verified on the host (km-tc)

• .venv built on Python 3.14; pip install -r requirements.txt clean.
• python -m pytest tests/ → 19 passed, 8 skipped (the availability suite is fully green; the Gemini evals skip without a key locally).
• assistant.service active on :8080; availability-sync.timer enabled, next run scheduled; the timer→curl→endpoint chain fires and returns the designed 400 (AVAILABILITY_CALENDAR_ID not configured) — no hang.

Remaining (owner-only, documented in the guide)

1. Create a Desktop-app OAuth client → credentials.json; run mint_token.py (or reuse the existing token from the GCS bucket).
2. Create an "Availability" calendar, share it read-only, set AVAILABILITY_CALENDAR_ID in .env.

Then the 30-min sync goes green automatically.

🤖 Generated with Claude Code

[krMaynard]

Self-review

Checked

• pyflakes-equivalent: python -c "import main" and import mint_token both clean; no unused imports added.
• mint_token.py reuses the existing assistant.auth.get_google_credentials rather than duplicating the flow, and pre-checks the client-secret path with a clear error.
• systemd units use %h (portable), EnvironmentFile=.env (gitignored), and Restart=on-failure. Timer uses OnUnitActiveSec=30min + Persistent=true.
• No secrets committed — .env, token.json, credentials.json are already in .gitignore; git status confirms only README/deploy/mint_token staged.
• Tests: 19 passed, 8 skipped locally.

Known rough edge (documented, not a blocker)

• Until AVAILABILITY_CALENDAR_ID + creds are set, each 30-min timer run logs a curl (22) 400 "failed" line. That's intentional (curl -f surfaces real errors later); it self-clears once config is filled. Happy to switch the probe to tolerate the pre-config 400 if you'd prefer a clean journal in the meantime.
• Footgun guarded by docs: a headless service would hang on the interactive consent flow if AVAILABILITY_CALENDAR_ID is set but token.json is missing — the guide sequences token-minting before enabling the timer. Could add a route-level "no token → 503" guard in a follow-up if you want defense-in-depth.

[gemini-code-assist]

Code Review

This pull request introduces self-hosting capabilities, allowing the automation tool to run locally using systemd units and file-based OAuth instead of relying on Google Cloud Run and Cloud Scheduler. The feedback focuses on improving the portability, robustness, and security of this self-hosted setup. Key recommendations include using relative paths in the environment template to avoid hardcoded home directories, dynamically referencing the configured port in the systemd sync service with added curl retries, making the systemd environment file optional, and securing OAuth token files with restricted permissions.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[krMaynard]

Self-review (round 2 — local state + email timer)

Checked

• Imports are side-effect-free (import main, mint_token, assistant.auth, assistant.state clean; mint_token guarded under __main__).
• GCS-free proof: reloaded assistant.state with google.cloud.* imports blocked — LocalStateStore round-trips processed_ids + user_context fine. So google-cloud-storage is genuinely optional locally.
• Non-breaking: get_state_store() returns GcsStateStore whenever GCS_BUCKET_NAME is set, so Cloud Run behavior is identical; main.py's only remaining GCS_BUCKET_NAME ref is the credentials fallback, which local mode skips.
• No-hang proof: POST / with no token returned 500 (OAUTH_NONINTERACTIVE) in <1s, not a hang; server log shows the explicit RuntimeError.
• Atomic local writes (temp + os.replace), dir auto-created, corrupt files degrade to empty. state/ gitignored; no secrets committed.
• Tests: 27 passed, 8 skipped.

Notes / follow-ups

• GEMINI_MODEL=gemini-2.0-flash-lite is the cheap default for analyze_email (it's the model already used for the context call). If classification quality dips on tricky mail, bump to gemini-3.5-flash — it's a one-line env change.
• Standup is intentionally out of scope; its route + local backend still work if you enable a timer later.
• Pre-config timer runs log expected non-zero curl exits (400/500) until creds are in place — self-clears once configured.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[krMaynard]

Codex review

Found and fixed one self-hosting configuration bug: systemd EnvironmentFile syntax only ignores lines that start with #; trailing comment text is preserved inside an unquoted value. The copied sample would therefore corrupt GEMINI_API_KEY and CALENDAR_ID. Commit 047c53d moves those explanations to standalone comment lines.

Validation: full offline suite — 27 passed, 8 skipped; no remaining inline-comment assignments; git diff --check passed. The state backend uses atomic owner-only temporary files, the OAuth token is chmod 0600, headless OAuth fails instead of hanging, and all prior review threads are resolved.