FROM python:3.11-slim

# build-essential is needed because pkuseg has no wheel past cp37 and compiles from source.
RUN apt-get update && apt-get install -y --no-install-recommends ffmpeg git build-essential \
    && rm -rf /var/lib/apt/lists/*

# HF Spaces runs as uid 1000; HF_HOME must be writable for model downloads.
RUN useradd -m -u 1000 user
# PATH: pip installs to ~/.local as non-root, so its bin dir must be on PATH.
ENV HOME=/home/user HF_HOME=/home/user/.cache/huggingface OUT_DIR=/home/user/audio \
    PATH=/home/user/.local/bin:$PATH
USER user
# Pre-create as `user` so a mounted cache volume inherits this ownership, not root's.
RUN mkdir -p $HF_HOME $OUT_DIR
WORKDIR /home/user/app

COPY --chown=user requirements.txt .
# pkuseg 0.0.25 has no wheel past cp37 and its sdist won't build as-is on modern Python:
#   1. setup.py imports numpy at build time, which pip's build isolation hides.
#   2. it ships a Cython-0.28-era inference.cpp (uses the removed tp_print) and skips
#      cythonizing when that file exists -- so delete it and let the .pyx regenerate.
RUN pip install --no-cache-dir "numpy<2" "cython<3" setuptools wheel \
    && pip download --no-binary :all: --no-deps --no-build-isolation pkuseg==0.0.25 -d /tmp/pk \
    && tar -xzf /tmp/pk/pkuseg-0.0.25.tar.gz -C /tmp/pk \
    && rm /tmp/pk/pkuseg-0.0.25/pkuseg/inference.cpp \
    && pip install --no-cache-dir --no-build-isolation /tmp/pk/pkuseg-0.0.25 \
    && rm -rf /tmp/pk \
    && pip install --no-cache-dir -r requirements.txt

COPY --chown=user app.py .

EXPOSE 7860
# forwarded-allow-ips: trust the Spaces proxy so request.base_url yields https, not http.
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860", "--forwarded-allow-ips", "*"]