# 核心镜像：Node 22 slim
FROM node:22-slim

# 1. 安装系统依赖
RUN apt-get update && apt-get install -y --no-install-recommends \
    git openssh-client build-essential \
    g++ make ca-certificates socat \
    chromium fonts-noto-cjk python3 \
    && rm -rf /var/lib/apt/lists/*

# 2. 构建环境优化
RUN update-ca-certificates && \
    git config --global http.sslVerify false && \
    git config --global url."https://github.com/".insteadOf ssh://git@github.com/

# 3. 全局安装 OpenClaw 最新版
RUN npm install -g openclaw@latest --unsafe-perm

# 4. 环境与权限设置
ENV PORT=7860 \
    HOME=/home/node

RUN mkdir -p /home/node/.openclaw/sessions \
    && mkdir -p /home/node/.openclaw/workspace \
    && mkdir -p /home/node/data \
    && chown -R node:node /home/node

# 5. 容器入口脚本
RUN echo "#!/bin/bash\n\
set -e\n\
\n\
if [ -n \"\$HF_TOKEN\" ] && [ -n \"\$DATASET_REPO\" ]; then\n\
    echo \"🚀 初始化 Git 自动备份...\"\n\
    git config --global user.email \"openclaw-bot@huggingface.co\"\n\
    git config --global user.name \"OpenClaw Bot\"\n\
    cd /home/node/data\n\
    if [ ! -d \".git\" ]; then\n\
        echo \"📥 克隆数据集: \$DATASET_REPO\"\n\
        git clone https://user:\$HF_TOKEN@huggingface.co/datasets/\$DATASET_REPO .\n\
    else\n\
        echo \"📥 拉取最新数据...\"\n\
        git pull origin main\n\
    fi\n\
    if [ \"\$(ls -A /home/node/data)\" ]; then\n\
        echo \"♻️ 正在恢复历史数据...\"\n\
        cp -r /home/node/data/* /home/node/.openclaw/ 2>/dev/null || true\n\
    fi\n\
fi\n\
\n\
# 👇 核心防坑：每次启动前，清理上次浏览器崩溃留下的死锁文件！\n\
echo \"🧹 正在清理可能残留的浏览器死锁文件...\"\n\
find /home/node/.openclaw -name SingletonLock -delete 2>/dev/null || true\n\
\n\
CLEAN_BASE=\$(echo \"\$OPENAI_API_BASE\" | sed \"s|/chat/completions||g\" | sed \"s|/v1/|/v1|g\" | sed \"s|/v1\$|/v1|g\")\n\
\n\
echo \"⚙️ 正在生成 OpenClaw 配置文件...\"\n\
cat > /home/node/.openclaw/openclaw.json <<EOF\n\
{\n\
  \"models\": {\n\
    \"providers\": {\n\
      \"siliconflow\": {\n\
        \"baseUrl\": \"\$CLEAN_BASE\",\n\
        \"apiKey\": \"\$OPENAI_API_KEY\",\n\
        \"api\": \"openai-completions\",\n\
        \"models\": [{ \"id\": \"\$MODEL\", \"name\": \"DeepSeek\", \"contextWindow\": 128000 }]\n\
      }\n\
    }\n\
  },\n\
  \"agents\": { \"defaults\": { \"model\": { \"primary\": \"siliconflow/\$MODEL\" } } },\n\
  \"channels\": {\n\
    \"telegram\": {\n\
      \"enabled\": true,\n\
      \"botToken\": \"\$TELEGRAM_BOT_TOKEN\",\n\
      \"dmPolicy\": \"allowlist\",\n\
      \"allowFrom\": [\"\$TELEGRAM_ADMIN_ID\"]\n\
    }\n\
  },\n\
  \"browser\": {\n\
    \"defaultProfile\": \"openclaw\",\n\
    \"headless\": true,\n\
    \"noSandbox\": true,\n\
    \"executablePath\": \"/usr/bin/chromium\",\n\
    \"args\": [\n\
      \"--disable-dev-shm-usage\",\n\
      \"--disable-gpu\",\n\
      \"--disable-software-rasterizer\",\n\
      \"--disable-setuid-sandbox\"\n\
    ]\n\
  },\n\
  \"gateway\": {\n\
    \"mode\": \"local\",\n\
    \"bind\": \"loopback\",\n\
    \"port\": 25808,\n\
    \"trustedProxies\": [\"127.0.0.1/32\", \"0.0.0.0/0\", \"10.0.0.0/8\", \"172.16.0.0/12\", \"192.168.0.0/16\"],\n\
    \"auth\": { \"mode\": \"token\", \"token\": \"\$OPENCLAW_GATEWAY_PASSWORD\" },\n\
    \"controlUi\": { \n\
      \"allowInsecureAuth\": true,\n\
      \"dangerouslyDisableDeviceAuth\": true\n\
    }\n\
  }\n\
}\n\
EOF\n\
\n\
if [ -n \"\$HF_TOKEN\" ] && [ -n \"\$DATASET_REPO\" ]; then\n\
    (while true; do \n\
        sleep 300;\n\
        cp -r /home/node/.openclaw/sessions /home/node/data/ 2>/dev/null || true;\n\
        cp -r /home/node/.openclaw/workspace /home/node/data/ 2>/dev/null || true;\n\
        rm -rf /home/node/data/workspace/.git 2>/dev/null || true;\n\
        cd /home/node/data;\n\
        if [[ \$(git status --porcelain) ]]; then\n\
            echo \"💾 [自动同步] 发现数据变动，正在上传...\"\n\
            git add .;\n\
            git commit -m \"Auto sync: \$(date)\";\n\
            git push https://user:\$HF_TOKEN@huggingface.co/datasets/\$DATASET_REPO main > /dev/null 2>&1;\n\
        fi;\n\
    done) &\n\
fi\n\
\n\
cd /home/node/.openclaw\n\
echo \"🔌 启动端口转发引擎...\"\n\
socat TCP4-LISTEN:7860,fork,reuseaddr TCP4:127.0.0.1:25808 &\n\
\n\
echo \"🚀 启动 OpenClaw Gateway...\"\n\
exec openclaw gateway run --port 25808 --allow-unconfigured\n\
" > /usr/local/bin/start-openclaw && chmod +x /usr/local/bin/start-openclaw

# 6. 切换到普通用户运行
USER node
WORKDIR /home/node
EXPOSE 7860
CMD ["/usr/local/bin/start-openclaw"]