Upload Dockerfile

Dockerfile

@@ -1,16 +1,20 @@
+# syntax=docker/dockerfile:1
 # DEPTH Risk Map -- Hugging Face Docker Space
 # Base ships R + sf/GDAL/GEOS/PROJ (the slowest deps to build).
+# The `# syntax` line above enables BuildKit features (RUN --mount=type=secret).
 FROM rocker/geospatial:4.4
 
 # DuckDB lives on the edgarodriguez/depth_alpha dataset (public); baked in at
 # build. Override with: docker build --build-arg DDB_URL=... -t depth-hf .
 ARG DDB_URL=https://huggingface.co/datasets/edgarodriguez/depth_alpha/resolve/main/depth_mexico.duckdb
 
-# RAG index (corpus chunk text + local embeddings) for the AI assistant. The
-# corpus is copyright-derived, so it lives on a PRIVATE dataset and is pulled
-# with a BuildKit secret (id=hf_token) -- never from a public source. If the
-# secret/dataset are absent the build still succeeds; the assistant just stays
-# offline until rag_chunks.parquet is present.
+# RAG index (corpus chunks + local embeddings) for the AI assistant. The corpus
+# is copyright-derived, so it lives on a PRIVATE dataset and is pulled with a
+# BuildKit secret (id=hf_token) -- never from a public source. Configure the
+# secret in the Space: Settings -> Variables and secrets -> New secret, name it
+# exactly `hf_token`, value = an HF access token with read access to the dataset.
+# If the secret/dataset are absent the build still succeeds; the assistant just
+# stays offline until rag_chunks.parquet is present.
 ARG RAG_URL=https://huggingface.co/datasets/edgarodriguez/depth_rag/resolve/main/rag_chunks.parquet
 
 # Small local models served in-container by Ollama (no external inference).
@@ -56,15 +60,16 @@ RUN curl -fL "${DDB_URL}" -o /app/depth_mexico.duckdb \
  && test -s /app/depth_mexico.duckdb \
  && ls -lh /app/depth_mexico.duckdb
 
-# Bake the private RAG index (best-effort; never fails the build).
+# Bake the private RAG index via the hf_token secret (best-effort; never fails
+# the build). The secret is mounted only for this RUN, at /run/secrets/hf_token.
 RUN --mount=type=secret,id=hf_token \
-    if [ -f /run/secrets/hf_token ]; then \
+    if [ -s /run/secrets/hf_token ]; then \
       ( curl -fL -H "Authorization: Bearer $(cat /run/secrets/hf_token)" "${RAG_URL}" -o /app/rag_chunks.parquet \
         && test -s /app/rag_chunks.parquet \
         && echo "[build] RAG index baked: $(ls -lh /app/rag_chunks.parquet | awk '{print $5}')" ) \
-      || echo "[build] RAG fetch failed -> assistant offline until rag_chunks.parquet is provided"; \
+      || echo "[build] RAG fetch failed (token lacks access or URL wrong) -> assistant offline" ; \
     else \
-      echo "[build] no hf_token secret -> assistant offline until rag_chunks.parquet is provided"; \
+      echo "[build] no hf_token secret -> assistant offline until rag_chunks.parquet is provided" ; \
     fi
 
 # HF Spaces runs the container as a non-root user -- make /app world-readable,