Upload Dockerfile with huggingface_hub

Dockerfile

@@ -1,41 +1,60 @@
-# syntax=docker/dockerfile:1.4
+# All-in-one Tatva deployment for a SINGLE Hugging Face Space.
 #
-# HF Spaces shim: clones private GitHub source at build time using
-# a Space secret (GITHUB_TOKEN) and runs from there. This keeps the
-# actual source code private on GitHub while the Space runs publicly.
+# Clones the private monorepo with a GitHub PAT (build secret GITHUB_TOKEN),
+# builds the Next.js dashboard, installs the MCP server + FastAPI control plane,
+# and runs all of them behind nginx on port 7860 via supervisord.
 #
-# Required HF Space secret:
-#   GITHUB_TOKEN = a GitHub PAT with read access to
-#                  github.com/rockerritesh/sumit-mcp-server (private)
+# This file is self-contained (it clones rather than COPYs) so it can be the
+# root Dockerfile of a thin HF Space — the same pattern as `sumit-server`.
 #
-# See: https://huggingface.co/docs/hub/en/spaces-sdks-docker#buildtime
+# Build (local):
+#   echo -n "$GITHUB_PAT" | docker build -f deploy/Dockerfile \
+#     --secret id=GITHUB_TOKEN,src=/dev/stdin -t tatva-aio .
+# HF Space: add a Space secret GITHUB_TOKEN; HF passes it as a build secret.
 
-FROM python:3.13-slim
+ARG REPO=github.com/rockerritesh/sumit-mcp-server.git
+
+# ---------- stage 1: build the Next.js dashboard ----------
+FROM node:20-slim AS web
+ARG REPO
+RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+RUN --mount=type=secret,id=GITHUB_TOKEN \
+    git clone https://x-access-token:$(cat /run/secrets/GITHUB_TOKEN)@${REPO} .
+WORKDIR /src/portal/web
+RUN npm install --legacy-peer-deps && npm run build
 
-# Install uv + git
+# ---------- stage 2: runtime (python + node + nginx + supervisor) ----------
+FROM python:3.13-slim
+ARG REPO
+RUN apt-get update \
+    && apt-get install -y git nginx supervisor curl ca-certificates \
+    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y nodejs \
+    && rm -rf /var/lib/apt/lists/*
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends git ca-certificates && \
-    rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
+RUN --mount=type=secret,id=GITHUB_TOKEN \
+    git clone https://x-access-token:$(cat /run/secrets/GITHUB_TOKEN)@${REPO} .
 
-# Clone private source using HF build-time secret
-RUN --mount=type=secret,id=GITHUB_TOKEN,required=true \
-    GITHUB_TOKEN=$(cat /run/secrets/GITHUB_TOKEN) && \
-    git clone --depth=1 --branch=main \
-        "https://x-access-token:${GITHUB_TOKEN}@github.com/rockerritesh/sumit-mcp-server.git" \
-        . && \
-    git log -1 --pretty=format:"source: %H %s%n" > /app/BUILD_INFO
+# MCP server deps (repo root) + control-plane deps (portal/api)
+ENV UV_CACHE_DIR=/app/.cache/uv
+RUN uv sync --no-dev \
+    && cd portal/api && uv sync --no-dev
 
-# Install dependencies from the cloned project (locked)
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked
+# Next.js standalone server from the build stage (tracing root pinned to web/,
+# so server.js + node_modules sit at .next/standalone/).
+COPY --from=web /src/portal/web/.next/standalone/ /app/portal/web/
+COPY --from=web /src/portal/web/.next/static /app/portal/web/.next/static
+COPY --from=web /src/portal/web/public /app/portal/web/public
 
-# HF Spaces runtime expectations
-EXPOSE 7860
-ENV PORT=7860
-ENV UV_CACHE_DIR=/app/.cache/uv
-RUN mkdir -p /app/.cache/uv && chmod -R 777 /app/.cache
+# Process + proxy config (from the cloned repo)
+RUN cp deploy/nginx.conf /etc/nginx/nginx.conf \
+    && cp deploy/supervisord.conf /etc/supervisor/conf.d/tatva.conf \
+    && mkdir -p /app/.cache && chmod -R 777 /app/.cache
 
-CMD ["uv", "run", "sumit-mcp-server"]
+# Control-plane + MCP read all other config (MONGO_URI, JWT_SECRET, QDRANT_*,
+# PLATFORM_ADMINS, STRIPE_*) from Space secrets injected as env vars at runtime.
+EXPOSE 7860
+CMD ["supervisord", "-c", "/etc/supervisor/conf.d/tatva.conf"]