# syntax=docker/dockerfile:1.7
# ─────────────────────────────────────────────────────────────────────────────
# Hugging Face Spaces deploy file — PRIVATE GitHub repo clone via build secret.
#
# In the HF Space repository, this file must be named exactly `Dockerfile`.
# Add a Space *secret* named GIT_PAT (fine-grained PAT with Contents: Read for
# Sexlovr/together2api). BuildKit mounts it only for the clone RUN; it never lands
# in an image layer or ENV.
#
# Factory rebuild after each GitHub push: a normal restart may reuse cached layers.
# ─────────────────────────────────────────────────────────────────────────────
FROM node:20-bookworm-slim

# Runtime deps:
#   git + ca-certificates  — clone private repo / HTTPS
#   chromium              — one persistent headless profile per live account
#   chromium's package pulls the required NSS/GTK/GBM/font shared libraries.
# tini reaps Chromium's child processes (prevents zombies on profile eviction).
RUN apt-get update && apt-get install -y --no-install-recommends \
    git ca-certificates chromium tini fonts-liberation \
    && rm -rf /var/lib/apt/lists/*

# Clone the private repo. The PAT is a BuildKit secret, NOT an ARG/ENV, so it is
# absent from `docker history`, the final filesystem, and runtime env.
RUN --mount=type=secret,id=GIT_PAT,required=true \
    PAT="$(cat /run/secrets/GIT_PAT)" \
    && test -n "$PAT" \
    && git clone --depth 1 --single-branch --branch main \
       "https://x-access-token:${PAT}@github.com/Sexlovr/together2api.git" /app \
    && rm -rf /app/.git

WORKDIR /app
RUN npm ci --omit=dev --no-audit --no-fund \
    && mkdir -p /data /home/node/.cache \
    && chown -R node:node /app /data /home/node

# HF Docker Spaces route traffic to 7860. /data is the persistent-disk mount.
# Keep one Chromium live by default on free/small hardware (~250-350 MB each);
# extra accounts are still usable — LRU eviction starts them on demand.
ENV HOME=/home/node \
    PORT=7860 \
    HOST=0.0.0.0 \
    DATA_DIR=/data \
    CHROME_PATH=/usr/bin/chromium \
    HEADLESS=on \
    MAX_LIVE_BROWSERS=1 \
    NODE_ENV=production

USER node
EXPOSE 7860

# Secrets to set in HF Settings (runtime — do NOT bake them here):
#   ADMIN_PASSWORD      — protects /admin/* (empty would leave it open)
#   TOGETHER2API_KEYS   — comma-separated client API keys (empty leaves /v1 open)
# Build-only secret:
#   GIT_PAT             — GitHub PAT used only for the clone above
ENTRYPOINT ["/usr/bin/tini", "--"]
CMD ["node", "index.js"]