## Building Fidesplus NLP image

Below are the high-level steps for building a Fidesplus image that supports the integrated NLP masking strategy:

1. Retrieve and publish (on our private Dockerhub repo) the base `deid` image that provides the NLP service. Update the `Dockerfile` to reference the new `deid` image accordingly.

- This step is only needed if the most up-to-date version of the `deid` image is NOT already published on our dockerhub

2. Set necessary secrets in local environment
3. Build and push the Fidesplus NLP image

If only Fidesplus code has been updated since the image was last built and published, then step 1 can be skipped, i.e. step 1 is only needed to pull in an updated base `deid` image.

## Step details

### 1. Retrieve and publish base `deid` image

**_NOTE:_** this step is only needed if there is an updated base `deid` image that is needed for your Fidesplus build. If only Fidesplus code has been changed since the last build, you can skip this step.

1. retrieve the `.tar.gpg` image file of the desired PrivateAI version, as provided by PrivateAI. Store it somewhere on your local filesystem (_not_ in version control).
2. decrypt the image tar:

 ```sh
 gpg private_ai_<version_tag>.tar.gpg
 ```

- you'll need to enter a password, which can be found in 1password

3. load the image into your local docker image repo from the tar archive:

 ```sh
 docker load -i private_ai_<version_tag>.tar
 ```

4. tag the image so that it can be pushed to our private `ethyca/deid` dockerhub repo:

 ```sh
 docker tag deid:<version_tag> ethyca/deid:<version_tag>
 ```

5. push the tagged image to our private `ethyca/deid` dockerhub repo:

 ```sh
 docker push ethyca/deid:<version_tag>
 ```

- your CLI session must be authenticated to push to our dockerhub repo, likely as the `ethycaci` user

6. update the `FROM` clause in the `Dockerfile` in this subdirectory to point to the updated image tag used in steps 4 and 5, i.e. `ethyca/deid:<version_tag>`

### 2. Set necessary secrets in local environment

As needed for local development (and as stated in the root-level `README`), define an `FIDESPLUS__NLP__API_KEY` environment variable that has the PrivateAI API key we use (which can be found in 1password)

```sh
export FIDESPLUS__NLP__API_KEY={{ REDACTED }}
```

### 3. Build and push the Fidesplus NLP image

1. Build the Fidesplus NLP image. Make sure to tag the image appropriately with an `-nlp` suffix in the version tag, to differentiate the image from a standard Fidesplus image.

- A sample `make` command for building the integrated fidesplus image with NLP masking strategy support, run from the repo root:

  ```sh
  make build-nlp
  ```

2. Push the NLP image built in the step above to our private `ethyca/fidesplus` repo:

- If you followed the sample command above, the image is already tagged locally with the `ethyca/` prefix, which will allow it to be pushed to our private dockerhub repo by default.
- A sample `make` command:

  ```sh
  make publish-nlp
  ```

- your CLI session must be authenticated to push to our dockerhub repo, likely as the `ethycaci` user
