FROM ghcr.io/astral-sh/uv:0.11.6-python3.13-trixie@sha256:b3c543b6c4f23a5f2df22866bd7857e5d304b67a564f4feab6ac22044dde719b AS uv_source
FROM tianon/gosu:1.19-trixie@sha256:3b176695959c71e123eb390d427efc665eeb561b1540e82679c15e992006b8b9 AS gosu_source
FROM node:23-bookworm-slim

# Disable Python stdout buffering to ensure logs are printed immediately
ENV PYTHONUNBUFFERED=1
ENV TZ=Asia/Bangkok

# Store Playwright browsers outside the volume mount so the build-time
# install survives the /opt/data volume overlay at runtime.
ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright

# Install system dependencies in one layer, clear APT cache
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        build-essential ca-certificates ripgrep ffmpeg gcc libffi-dev procps git git-lfs zip unzip \
        tzdata python3 python3-venv python3-pip python3-dev python3-setuptools python3-wheel curl wget git \
        libasound2 libportaudio2 portaudio19-dev && \
    ln -fs /usr/share/zoneinfo/$TZ /etc/localtime && \
    dpkg-reconfigure -f noninteractive tzdata && \
    rm -rf /var/lib/apt/lists/*

# Non-root user for runtime; UID can be overridden via HERMES_UID at runtime
RUN useradd -u 10000 -m -d /opt/data hermes

COPY --chmod=0755 --from=gosu_source /gosu /usr/local/bin/
COPY --chmod=0755 --from=uv_source /usr/local/bin/uv /usr/local/bin/uvx /usr/local/bin/

WORKDIR /opt

ARG HERMES_WEB_UI_VERSION=latest

COPY . /opt/hermes

WORKDIR /opt/hermes

# Install Node dependencies and Playwright as root (--with-deps needs apt)
RUN npm install --prefer-offline --no-audit && \
    npm install -g --no-audit "hermes-web-ui@${HERMES_WEB_UI_VERSION}" && \
    mkdir -p /usr/local/lib/node_modules/hermes-web-ui/dist/data && \
    chown -R hermes:hermes /usr/local/lib/node_modules/hermes-web-ui && \
    npx playwright install --with-deps chromium --only-shell && \
    cd /opt/hermes/scripts/whatsapp-bridge && \
    npm install --prefer-offline --no-audit && \
    npm cache clean --force

# Hand ownership to hermes user, then install Python deps in a virtualenv
RUN chown -R hermes:hermes /opt/hermes
USER hermes

RUN uv venv && \
    uv pip install --no-cache-dir -e ".[all]" "huggingface_hub[cli]" && \
    mv /opt/hermes/.venv/bin/hermes /opt/hermes/.venv/bin/hermes-upstream && \
    printf '%s\n' '#!/bin/sh' 'exec /opt/hermes/.venv/bin/python -m hermes_cli.space_update_wrapper "$@"' > /opt/hermes/.venv/bin/hermes && \
    chmod +x /opt/hermes/.venv/bin/hermes

ENV PATH="/opt/hermes/.venv/bin:${PATH}"

USER root
RUN sed -i 's/\r$//' /opt/hermes/docker/entrypoint.sh /opt/hermes/hermes /opt/hermes/scripts/hermes-gateway && \
    chmod +x /opt/hermes/docker/entrypoint.sh /opt/hermes/hermes /opt/hermes/scripts/hermes-gateway

ENV HERMES_HOME=/opt/data
VOLUME [ "/opt/data" ]
ENTRYPOINT [ "/opt/hermes/docker/entrypoint.sh" ]