# syntax=docker/dockerfile:1.6
# =============================================================================
# HuggingFace Spaces — Single-Container Deployment (with dashboard + tunnel)
# =============================================================================

# ─── Stage 1: Python — install hermes-agent ────────────────────────────────
FROM python:3.12-slim-bookworm AS agent-install

RUN apt-get update && apt-get install -y --no-install-recommends \
      build-essential curl ca-certificates git \
    && rm -rf /var/lib/apt/lists/*

# Install hermes-agent with all web/dashboard dependencies
RUN pip install --no-cache-dir \
      hermes-agent \
      aiohttp \
      aiohttp-cors \
      uvloop \
      fastapi \
      uvicorn[standard]

# ─── Stage 2: Node.js — build Hermes Workspace from GitHub ─────────────────
FROM node:22-slim AS workspace-build

RUN corepack enable && \
    apt-get update && \
    apt-get install -y --no-install-recommends ca-certificates git && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /app

RUN git clone --depth 1 https://github.com/outsourc-e/hermes-workspace.git /tmp/hermes-workspace
RUN cp -r /tmp/hermes-workspace/* /app/ && rm -rf /tmp/hermes-workspace

RUN pnpm install --frozen-lockfile 2>/dev/null || pnpm install
RUN pnpm build

# ─── Stage 3: Runtime ──────────────────────────────────────────────────────
FROM python:3.12-slim-bookworm

RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl gnupg tini python3 \
    && mkdir -p /etc/apt/keyrings \
    && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
       | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
    && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" \
       > /etc/apt/sources.list.d/nodesource.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends nodejs \
    && rm -rf /var/lib/apt/lists/* \
    && corepack enable \
    && groupadd -r workspace && useradd -r -g workspace -u 1001 -m workspace

# Copy Python packages from Stage 1
COPY --from=agent-install /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY --from=agent-install /usr/local/bin /usr/local/bin

# Copy workspace build from Stage 2
WORKDIR /app
COPY --from=workspace-build --chown=workspace:workspace /app/dist ./dist
COPY --from=workspace-build --chown=workspace:workspace /app/node_modules ./node_modules
COPY --from=workspace-build --chown=workspace:workspace /app/package.json ./package.json
COPY --from=workspace-build --chown=workspace:workspace /app/server-entry.js ./server-entry.js
COPY --from=workspace-build --chown=workspace:workspace /app/scripts ./scripts

# Copy startup script
COPY --chown=workspace:workspace start.sh /usr/local/bin/start.sh
RUN chmod +x /usr/local/bin/start.sh

# Create hermes config dir
RUN mkdir -p /home/workspace/.hermes && chown -R workspace:workspace /home/workspace/.hermes

# Environment
ENV NODE_ENV=production \
    HERMES_API_URL=http://127.0.0.1:8642 \
    PORT=7860 \
    HOST=0.0.0.0 \
    API_SERVER_ENABLED=true \
    API_SERVER_HOST=0.0.0.0 \
    API_SERVER_PORT=8642 \
    PYTHONUNBUFFERED=1 \
    HERMES_HOME=/home/workspace/.hermes

EXPOSE 7860

HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
  CMD curl -fsS http://127.0.0.1:7860/ >/dev/null || exit 1

USER workspace

ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/start.sh"]