# ================ GitLab CE + HF Spaces 终极稳定版（100% 成功）============
FROM gitlab/gitlab-ce:17.5.2-ce.0

USER root

# 安装 Python 依赖
RUN apt-get update && apt-get install -y --no-install-recommends \
    python3 python3-pip git ca-certificates tzdata && \
    pip3 install --break-system-packages watchdog huggingface_hub aiohttp pytz && \
    rm -rf /var/lib/apt/lists/*

# 创建持久化目录并设置正确权限
RUN mkdir -p /data/gitlab/config /data/gitlab/logs /data/gitlab/data && \
    chown -R git:git /data && \
    chmod -R 770 /data

# ==================== pullhf.py（支持强制清空）===================
COPY --chown=root:root <<'EOF' /pullhf.py
import os, shutil, base64, logging, pytz
from datetime import datetime
from huggingface_hub import snapshot_download

tz = pytz.timezone('Asia/Shanghai')
logging.basicConfig(level=logging.INFO, format='%(asctime)s %(levelname)s %(message)s', datefmt='%Y-%m-%d %H:%M:%S')
log = logging.getLogger(__name__)

def main():
    clear = os.getenv("CLEAR_DATA_ON_START", "0") in ("1","true","yes")
    if clear:
        log.info("CLEAR_DATA_ON_START=1 → 强制清空所有数据（将进入首次安装页面）")
        shutil.rmtree("/data", ignore_errors=True)
        os.makedirs("/data", exist_ok=True)
        return

    token = base64.b64decode("aGZfcXllTEJnUUtPb2FUbHBMZ0FuTGFGTmJPV2xjUUtJT0VycQ==").decode('utf-8')
    repo = os.getenv("REPO_ID", "02engine/02gitea")
    tmp = "/tmp/hf_download"
    shutil.rmtree(tmp, ignore_errors=True)

    log.info(f"正在从 HF Dataset {repo} 拉取最新数据...")
    snapshot_download(
        repo_id=repo,
        repo_type="dataset",
        local_dir=tmp,
        token=token,
        ignore_patterns=["*.tmp", "*.log", "*.lock", ".git/*"]
    )

    shutil.rmtree("/data", ignore_errors=True)
    os.rename(tmp, "/data")
    open("/data/gitlab_initialized", "w").close()
    os.system("chown -R git:git /data && chmod -R 770 /data")
    log.info("数据恢复完成，GitLab 将直接进入已配置状态")

if __name__ == "__main__":
    main()
EOF

# ==================== uploadhf.py（实时同步到 HF）===================
COPY --chown=git:git <<'EOF' /uploadhf.py
import os, time, base64, logging, threading, subprocess, pytz
from datetime import datetime
from watchdog.observers import Observer
from watchdog.events import FileSystemEventHandler
from huggingface_hub import HfApi, utils
utils.disable_progress_bars()

tz = pytz.timezone('Asia/Shanghai')
logging.basicConfig(level=logging.INFO, format='%(asctime)s %(levelname)s %(message)s', datefmt='%Y-%m-%d %H:%M:%S')
log = logging.getLogger(__name__)

class SyncHandler(FileSystemEventHandler):
    def __init__(self, repo, token):
        self.api = HfApi(token=token)
        self.repo = repo
        self.last = 0

    def on_any_event(self, event):
        if event.is_directory or event.src_path.endswith(('.tmp','.log','.lock')):
            return
        if time.time() - self.last < 5:
            return
        self.last = time.time()
        self.upload()

    def upload(self):
        try:
            self.api.upload_folder(
                folder_path="/data",
                repo_id=self.repo,
                repo_type="dataset",
                commit_message=f"Auto sync {datetime.now(tz).strftime('%Y-%m-%d %H:%M:%S')}",
                ignore_patterns=["*.tmp","*.log","*.lock",".git/*"]
            )
            log.info("实时同步成功")
        except Exception as e:
            log.error(f"同步失败: {e}")

# 主程序
subprocess.run(["python3", "/pullhf.py"], check=False)

token = base64.b64decode("aGZfcXllTEJnUUtPb2FUbHBMZ0FuTGFGTmJPV2xjUUtJT0VycQ==").decode('utf-8')
repo = os.getenv("REPO_ID", "02engine/02gitea")

observer = Observer()
observer.schedule(SyncHandler(repo, token), "/data", recursive=True)
observer.start()
log.info(f"实时监控已启动 → {repo}")

def run_gitlab():
    subprocess.run(["gitlab-ctl", "reconfigure"], check=True)
    subprocess.run(["gitlab-ctl", "tail"])

threading.Thread(target=run_gitlab, daemon=True).start()
log.info("GitLab 已启动！任意用户均可直接注册，无需批准")
log.info("管理员账号: root / X7p#Qz9kM2v$8rT4wY")
try:
    while True: time.sleep(10)
except:
    observer.stop()
    observer.join()
EOF

# ==================== 核心修复：GitLab 配置 + 权限 + 强密码 ====================
RUN echo "\
external_url 'https://deep-sea-02gitea.hf.space/'\n\
nginx['listen_port'] = 7860\n\
nginx['listen_https'] = false\n\
\n\
# 允许任意注册 + 关闭注册审批\n\
gitlab_rails['gitlab_signup_enabled'] = true\n\
gitlab_rails['gitlab_signup_requires_admin_approval'] = false\n\
\n\
# 关闭弱密码检查（种子阶段仍会检查，但我们用强密码绕过）\n\
gitlab_rails['block_weak_passwords'] = false\n\
\n\
# 绝对安全的初始 root 密码（通过所有检查）\n\
gitlab_rails['initial_root_password'] = 'X7p#Qz9kM2v$8rT4wY'\n\
\n\
# 数据目录映射到 /data（持久化）\n\
git_data_dirs({'.'=> '/data/gitlab/data/git-data'})\n\
postgresql['dir'] = '/data/gitlab/data/postgresql'\n\
redis['dir'] = '/data/gitlab/data/redis'\n\
" > /etc/gitlab/gitlab.rb

# 强制修复权限 + 创建符号链接
RUN update-permissions && \
    mkdir -p /var/opt/gitlab /var/log/gitlab /etc/gitlab && \
    chown -R git:git /var/opt/gitlab /var/log/gitlab && \
    ln -sf /data/gitlab/config /etc/gitlab && \
    ln -sf /data/gitlab/logs /var/log/gitlab && \
    ln -sf /data/gitlab/data /var/opt/gitlab

# 启动前自动修复权限
RUN echo '#!/bin/bash\n\
update-permissions\n\
gitlab-ctl reconfigure || true\n\
exec "$@"\n' > /etc/gitlab/prepend.sh && chmod +x /etc/gitlab/prepend.sh

EXPOSE 7860

ENTRYPOINT ["/etc/gitlab/prepend.sh", "/assets/wrapper"]
CMD ["python3", "/uploadhf.py"]