FROM debian:13.4

# 1. 设置环境变量
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PORT=7860 \
    HOME=/home/user \
    VIRTUAL_ENV=/home/user/venv \
    HERMES_HOME=/home/user/data \
    INSTALL_DIR=/home/user/app \
    REAL_APP_PORT=8088 

ENV PATH="$VIRTUAL_ENV/bin:$HOME/.local/bin:$PATH"

# 2. 安装系统依赖（增加了 nginx 和 apache2-utils）
USER root
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        build-essential \
        python3 \
        python3-pip \
        python3-dev \
        nodejs \
        npm \
        ripgrep \
        ffmpeg \
        gcc \
        libffi-dev \
        procps \
        curl \
        ca-certificates \
        git \
        nginx \
        apache2-utils \
        libnss3 libatk-bridge2.0-0 libxcomposite1 libxdamage1 libxrandr2 libgbm1 libasound2 && \
    # --- 手动下载 ttyd ---
    curl -Lo /usr/local/bin/ttyd https://github.com/tsl0922/ttyd/releases/download/1.7.7/ttyd.x86_64 && \
    chmod +x /usr/local/bin/ttyd && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# 3. 创建用户并配置 Nginx 目录权限
RUN useradd -m -u 1000 user && \
    chown -R user:user /var/lib/nginx /var/log/nginx /etc/nginx/sites-available /etc/nginx/sites-enabled && \
    touch /run/nginx.pid && chown user:user /run/nginx.pid

USER user
WORKDIR $INSTALL_DIR

# 4. 拷贝项目代码
COPY --chown=user:user . .

# 5. 安装依赖
RUN pip install --no-cache-dir uv --break-system-packages && \
    uv venv $VIRTUAL_ENV && \
    uv pip install --no-cache -e ".[all]" fastapi uvicorn lark-oapi && \
    npm install --prefer-offline --no-audit && \
    npx playwright install chromium && \
    cd scripts/whatsapp-bridge && \
    npm install --prefer-offline --no-audit && \
    npm cache clean --force

# 6. 配置权限
RUN mkdir -p $HERMES_HOME && chmod +x docker/entrypoint.sh

# 7. 启动
EXPOSE 7860

# 覆盖原本的 ENTRYPOINT，先由 shell 处理环境变量
ENTRYPOINT [ "/bin/sh", "-c", "htpasswd -b -c /home/user/.htpasswd admin $APP_PASSWORD && \
    printf \"server {\\n  listen 7860;\\n  location / {\\n    auth_basic 'Restricted';\\n    auth_basic_user_file /home/user/.htpasswd;\\n    proxy_pass http://127.0.0.1:8088;\\n    proxy_set_header Host \\$host;\\n    proxy_set_header Upgrade \\$http_upgrade;\\n    proxy_set_header Connection 'upgrade';\\n  }\\n}\" > /etc/nginx/sites-enabled/default && \
    nginx -g 'daemon on;' && \
    PORT=8088 /bin/sh docker/entrypoint.sh" ]