FROM python:3.11-slim

ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 DEBIAN_FRONTEND=noninteractive \
    TZ=Asia/Ho_Chi_Minh

RUN apt-get update && apt-get install -y --no-install-recommends \
    aria2 unzip curl ca-certificates tzdata \
    && ln -fs /usr/share/zoneinfo/Asia/Ho_Chi_Minh /etc/localtime \
    && dpkg-reconfigure -f noninteractive tzdata \
    && rm -rf /var/lib/apt/lists/*

RUN useradd -m -u 1000 user
USER user
ENV HOME=/home/user \
    PATH=/home/user/.local/bin:$PATH

WORKDIR $HOME/app

RUN pip install --no-cache-dir \
    fastapi \
    "uvicorn[standard]" \
    python-multipart \
    pydantic \
    requests

# Entrypoint: decrypt app.zip then start
RUN printf '#!/bin/bash\n\
if [ -f "app.zip" ]; then\n\
  echo "--- Dang giai ma ma nguon ---"\n\
  if [ -z "$ZIP_PASSWORD" ]; then\n\
    echo "LOI: Chua thiet lap HF Space Secret ZIP_PASSWORD. Khong co mat khau fallback."\n\
    exit 1\n\
  fi\n\
  unzip -P "$ZIP_PASSWORD" -o app.zip\n\
  if [ $? -eq 0 ]; then\n\
    echo "Giai ma thanh cong."\n\
    rm app.zip\n\
  else\n\
    echo "LOI: Giai ma that bai!"\n\
    exit 1\n\
  fi\n\
else\n\
  echo "CANH BAO: Khong tim thay app.zip"\n\
fi\n\
echo "--- Dang khoi dong ung dung ---"\n\
exec "$@"\n' > entrypoint.sh && chmod +x entrypoint.sh

COPY --chown=user app.zip .

RUN mkdir -p $HOME/app/data

EXPOSE 7860

ENTRYPOINT ["./entrypoint.sh"]
CMD ["uvicorn", "fshare_getlink_free_client:app", "--host", "0.0.0.0", "--port", "7860", "--workers", "1", "--no-access-log"]