From 719bc4ccf79f90a1e0c4a8684e5bd8e2881d6ea5 Mon Sep 17 00:00:00 2001
From: Mikei386 <44135113+Mikei386@users.noreply.github.com>
Date: Sun, 13 Sep 2026 22:28:56 +0200
Subject: [PATCH] Support secure external LTX OAuth

---
 platform/ltx2-studio/Dockerfile   | 4 +++-
 platform/ltx2-studio/README.md    | 6 ++++++
 platform/ltx2-studio/compose.yaml | 6 ++++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/platform/ltx2-studio/Dockerfile b/platform/ltx2-studio/Dockerfile
index 35c223a..2b5d836 100644
--- a/platform/ltx2-studio/Dockerfile
+++ b/platform/ltx2-studio/Dockerfile
@@ -17,6 +17,8 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-ins
     && chmod +x /tmp/ltx-desktop.AppImage \
     && cd /opt/ltx-desktop \
     && /tmp/ltx-desktop.AppImage --appimage-extract >/dev/null \
+    && sed -i 's/host="127.0.0.1", port=port/host=os.environ.get("LTX_HOST", "127.0.0.1"), port=port/' \
+      /opt/ltx-desktop/squashfs-root/resources/backend/ltx2_server.py \
     && rm /tmp/ltx-desktop.AppImage \
     && ln -s /usr/share/novnc/vnc.html /usr/share/novnc/index.html
 
@@ -31,5 +33,5 @@ ENV DISPLAY=:0 \
     XDG_CACHE_HOME=/data/cache \
     NO_AT_BRIDGE=1
 
-EXPOSE 8015
+EXPOSE 8015 41955
 ENTRYPOINT ["/usr/local/bin/ltx-desktop-entrypoint"]
diff --git a/platform/ltx2-studio/README.md b/platform/ltx2-studio/README.md
index 453d853..6f8aa14 100644
--- a/platform/ltx2-studio/README.md
+++ b/platform/ltx2-studio/README.md
@@ -18,3 +18,9 @@ to Hugging Face in the application.
 The image installs a narrow `tar` wrapper that ignores uid/gid metadata in the
 official first-run Python archive. This keeps `cap_drop: [ALL]` intact while
 allowing the archive, whose entries belong to build user 1001, to be extracted.
+
+The backend uses stable port `41955`. Hugging Face OAuth can therefore run in a
+normal client browser through a local SSH tunnel to the container instead of
+requiring a browser or storing login credentials inside the VNC desktop.
+The container port is published only on Athena's `127.0.0.1`; it is not exposed
+on Athena's LAN or WireGuard interfaces.
diff --git a/platform/ltx2-studio/compose.yaml b/platform/ltx2-studio/compose.yaml
index 2b031f5..11842d9 100644
--- a/platform/ltx2-studio/compose.yaml
+++ b/platform/ltx2-studio/compose.yaml
@@ -23,6 +23,12 @@ services:
       NVIDIA_VISIBLE_DEVICES: ${LTX2_GPU_UUID:-GPU-8ad38c6c-5a01-9d8e-1dfa-ed662ad78fbe}
       NVIDIA_DRIVER_CAPABILITIES: compute,utility,graphics
       CUDA_VISIBLE_DEVICES: "0"
+      # Stable and intentionally different from the default local macOS app
+      # port, so OAuth can return through an SSH tunnel without a collision.
+      LTX_PORT: "41955"
+      LTX_HOST: 0.0.0.0
+    ports:
+      - 127.0.0.1:41955:41955
     volumes:
       - /data/video/ltx-desktop:/data
     networks: