AIngramdocs
Running a server

Install AIngram

These steps install AIngram on Ubuntu, run it as its own locked-down user, and start it whenever the server starts. Run them over SSH as a user that can use sudo.

1. Install, as its own user

AIngram runs as a user called aingram that can write its own database and nothing else. The code is owned by root, so the service can't change itself.

sudo apt update
sudo apt install -y git python3-venv
sudo useradd --system --home-dir /var/lib/aingram --shell /usr/sbin/nologin aingram
sudo install -d -m 0700 -o aingram -g aingram /var/lib/aingram
sudo git clone https://github.com/TheFeloniousMonk/AIngram.git /opt/aingram
sudo python3 -m venv /opt/aingram/.venv
sudo /opt/aingram/.venv/bin/pip install -r /opt/aingram/requirements.txt

2. Settings

Settings live in one file that only root can read. Copy the example and open it:

sudo install -d -m 0755 /etc/aingram
sudo install -m 0600 /opt/aingram/.env.example /etc/aingram/aingram.env
sudo nano /etc/aingram/aingram.env

Set these three; leave the rest as they are:

AINGRAM_DB=/var/lib/aingram/aingram.db
AINGRAM_ADMIN_ADDRESS=0x…your admin wallet address…
AINGRAM_PUBLIC_URL=https://memory.example.com
!
Get these right first time

Approvals are tied to the admin address and the web address. Changing either later switches memory off until the admin approves the policy again. Nothing is lost, but it's an extra step.

3. Run it as a service

Create /etc/systemd/system/aingram.service with sudo nano:

[Unit]
Description=AIngram memory server
After=network.target

[Service]
User=aingram
Group=aingram
WorkingDirectory=/opt/aingram
EnvironmentFile=/etc/aingram/aingram.env
ExecStart=/opt/aingram/.venv/bin/python aingram_server.py
Restart=on-failure
UMask=0077
PrivateTmp=yes
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/aingram

[Install]
WantedBy=multi-user.target

Then start it, and check it answers:

sudo systemctl daemon-reload
sudo systemctl enable --now aingram
curl http://127.0.0.1:8787/healthz

If curl answers, AIngram is running. It only listens on the server itself for now; the next step puts it on your web address. If not, sudo journalctl -u aingram -n 50 shows why.

Updating later

sudo git -C /opt/aingram pull
sudo /opt/aingram/.venv/bin/pip install -r /opt/aingram/requirements.txt
sudo systemctl restart aingram

Database changes apply themselves when the service restarts. If an update needs a new policy setting, the server starts with memory off and the admin page shows what to fix; nothing is lost.

Every setting, and how each part works, is in the README.