Editing Openai/694ab010-3e7c-8000-b0e8-b98c22b7a063 (section)

=== ## ===

In ECR:
# Create repository ml-chatbot-ui
# Create repository ml-chatbot-api

You will build/push both from your EC2 builder instance as before (using ECR “View push commands” in console and pasting into EC2 shell).

==== ### ====
* Container port: 8000
* Secrets: OPENAI_API_KEY from Secrets Manager
* CloudWatch logs enabled

===== - Container port: 8501 =====
* No OpenAI key needed (UI shouldn’t hold secrets)
* It only needs an environment variable like: - API_BASE_URL = https://<your-api-gateway>/prod

==== You can do either: ====
'' One ALB with two target groups + path routing - / → Streamlit target group (8501) - /api/'' → FastAPI target group (8000)
* Or two ALBs (cleaner separation, more cost)

Given you explicitly want API Gateway, the most common is:
* ALB #1 for Streamlit (public)
* ALB #2 for FastAPI (public or internal depending on design), but API Gateway will call it

For simplicity and clarity:
* Use one ALB with two target groups: - TG-UI (8501) - TG-API (8000)

Then configure API Gateway integration to route to:
'' http://ALB_DNS_NAME/api/... (ALB listener rule forwards /api/'' to FastAPI TG)

==== In API Gateway (HTTP API): ====
# Integration: HTTP → http://ALB_DNS_NAME
# Routes: - ANY /api/{proxy+} → that integration
# Stage: prod

Now the API URL becomes:
https://...execute-api.../prod/api/...

==== Your Streamlit code should call: ====
API_BASE_URL = https://...execute-api.../prod

And when user chats:
* Streamlit sends request to POST {API_BASE_URL}/api/chat
* FastAPI returns response JSON
* Streamlit renders it

This keeps:
* Secrets in backend only
* API gateway where it belongs
* UI stable