FROM python:3.11-slim

# 1. 安装 Node.js 及 Nginx 防盗门依赖组件
RUN apt-get update && apt-get install -y git curl nginx apache2-utils && \
    curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
    apt-get install -y nodejs && \
    rm -rf /var/lib/apt/lists/*

COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

WORKDIR /app
ENV UPDATE_CACHE_BUSTER="2026-06-11"
RUN git clone https://github.com/nousresearch/hermes-agent.git .

# 2. 编译 Web 界面并安装后端
RUN cd web && npm install && npm run build
RUN uv pip install --system -e ".[all]"
RUN uv pip install --system huggingface_hub

# =================================================================
# 核心环境变量与 CPU 环境优化
# =================================================================
ENV HOST=0.0.0.0
ENV PORT=7860
ENV HERMES_PORT=8000
ENV HERMES_GATEWAY_PLATFORM=feishu
ENV GATEWAY_ALLOW_ALL_USERS=true
# 强制禁用 GPU 探测，优化纯 CPU 环境下的进程调度与内存占用
ENV CUDA_VISIBLE_DEVICES="-1"
ENV OMP_NUM_THREADS=4 

# =================================================================
# 3. 完美容灾、云端备份与防篡改启动脚本
# =================================================================
RUN cat <<'EOF' > /start.sh
#!/bin/bash
mkdir -p /root/.hermes

# --- 步骤 A: 开机自动从云端 Dataset 恢复数据 (带try-except终极防卡死补丁) ---
if [ -n "$HF_DATASET" ] && [ -n "$HF_TOKEN" ]; then
    echo ">>> 探测到云端备份配置，正在尝试恢复数据..."
    python3 -c "
import os, shutil
from huggingface_hub import snapshot_download
try:
    snapshot_download(repo_id=\"$HF_DATASET\", repo_type=\"dataset\", local_dir=\"/root/.hermes\", token=\"$HF_TOKEN\")
    print('>>> 云端数据同步成功。')
except Exception as e:
    print('>>> [警告] 云端历史数据存在大小不匹配或损坏，已自动跳过并执行干净启动。')
"
else
    echo ">>> 未完全配置 HF_DATASET 或 HF_TOKEN，跳过恢复。"
fi

# --- 步骤 B: 原有的防篡改与初始配置保底逻辑 ---
if [ ! -f /root/.hermes/config.yaml ]; then
    echo ">>> 未发现本地配置，生成默认 Gemini 配置文件..."
    cat << 'CONF' > /root/.hermes/config.yaml
provider: gemini
model: gemini-2.5-flash
auxiliary:
  title_generation:
    provider: gemini
    model: gemini-2.5-flash
  compression:
    provider: gemini
    model: gemini-2.5-flash
  session_search:
    provider: gemini
    model: gemini-2.5-flash
CONF
fi

# --- 步骤 C: 定义优雅退出的 Trap 机制 (防止被杀时丢数据) ---
cleanup() {
    echo ">>> 接收到终止信号 (SIGTERM)！准备冻结状态并执行紧急备份..."
    service nginx stop
    kill -SIGTERM $GATEWAY_PID $DASHBOARD_PID 2>/dev/null
    wait $GATEWAY_PID $DASHBOARD_PID 2>/dev/null
    
    if [ -n "$HF_DATASET" ] && [ -n "$HF_TOKEN" ]; then
        echo ">>> 执行终极数据持久化 (隔离运行锁)..."
        # 隔离可能导致 I/O 错误的锁文件
        mv /root/.hermes/gateway.lock /tmp/gateway.lock.bak 2>/dev/null
        mv /root/.hermes/gateway.log /tmp/gateway.log.bak 2>/dev/null
        
        python3 -c "from huggingface_hub import HfApi; api=HfApi(); api.upload_folder(folder_path=\"/root/.hermes\", repo_id=\"$HF_DATASET\", repo_type=\"dataset\", ignore_patterns=[\"*.db-wal\", \"*.db-shm\", \"*.db-journal\", \"pairing*\", \"*.tmp\", \"*.mp4\", \"*.avi\", \"*.mov\", \"*.mkv\", \"*.wav\", \"*.mp3\", \"*.lock\"], commit_message=\"Emergency backup on exit\", token=\"$HF_TOKEN\")"
    fi
    echo ">>> 备份完成，容器安全退出。"
    exit 0
}
trap cleanup SIGTERM SIGINT

# --- 步骤 D: 启动后台定时备份 (每15分钟 - 完美闭合版) ---
(while true; do
    sleep 900
    if [ -n "$HF_DATASET" ] && [ -n "$HF_TOKEN" ]; then
        echo ">>> 触发每15分钟定时增量同步 (物理隔离锁文件)..."
        # 1. 移走文件，避开扫描
        mv /root/.hermes/gateway.lock /tmp/gateway.lock.bak 2>/dev/null
        mv /root/.hermes/gateway.log /tmp/gateway.log.bak 2>/dev/null
        
        # 2. 执行上传
        python3 -c "from huggingface_hub import HfApi; api=HfApi(); api.upload_folder(folder_path=\"/root/.hermes\", repo_id=\"$HF_DATASET\", repo_type=\"dataset\", ignore_patterns=[\"*.db-wal\", \"*.db-shm\", \"*.db-journal\", \"pairing*\", \"*.tmp\", \"*.mp4\", \"*.avi\", \"*.mov\", \"*.mkv\", \"*.wav\", \"*.mp3\", \"*.lock\"], commit_message=\"Auto routine backup\", token=\"$HF_TOKEN\")"
        
        # 3. 还原文件
        mv /tmp/gateway.lock.bak /root/.hermes/gateway.lock 2>/dev/null
        mv /tmp/gateway.log.bak /root/.hermes/gateway.log 2>/dev/null
    fi
done) &
SYNC_PID=$!

# --- 步骤 E: 配置并启动 Nginx 防盗门 ---
echo ">>> 配置 Nginx 访问拦截策略..."
cat << 'NGINX' > /etc/nginx/sites-available/default
server {
    listen 7860;
    location / {
        auth_basic "Restricted Access - Please Login";
        auth_basic_user_file /etc/nginx/.htpasswd;
        proxy_pass http://127.0.0.1:7861;
        proxy_http_version 1.1;
        
        # 维持 WebSocket 长连接
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        
        # 核心修复：彻底欺骗后端，伪装成本地请求，绕过所有 Host 和 Origin 跨域拦截
        proxy_set_header Host 127.0.0.1;
        proxy_set_header Origin "http://127.0.0.1:7861";
        
        # 关闭缓冲，让 SSE 实时日志和打字机效果秒级透传
        proxy_buffering off;
        proxy_cache off;
        chunked_transfer_encoding on;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # 保持超长等待时间，防止大模型思考过久断开
        proxy_read_timeout 3600;
        proxy_send_timeout 3600;
    }
}
NGINX

if [ -n "$WEB_USER" ] && [ -n "$WEB_PASS" ]; then
    htpasswd -bc /etc/nginx/.htpasswd "$WEB_USER" "$WEB_PASS"
    echo ">>> 已设置自定义 Web 登录密码。"
else
    RANDOM_PASS=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 16)
    htpasswd -bc /etc/nginx/.htpasswd admin "$RANDOM_PASS"
    echo "================================================================="
    echo "⚠️ 警告: 未检测到 WEB_USER 或 WEB_PASS 环境变量！"
    echo "已触发安全保护机制，自动生成临时随机密码 (每次重启都会更换)。"
    echo "默认账号: admin"
    echo "随机密码: $RANDOM_PASS"
    echo "================================================================="
fi
service nginx start

# --- 步骤 F: 启动核心业务进程 ---
echo ">>> 启动飞书 Gateway 守护进程..."
env PORT=8000 HERMES_PORT=8000 hermes gateway > /root/.hermes/gateway.log 2>&1 &
GATEWAY_PID=$!

echo ">>> 启动 Dashboard 面板 (绑定本地隐藏端口 7861)..."
hermes dashboard --port 7861 --host 127.0.0.1 --insecure &
DASHBOARD_PID=$!

# 双进程看守，任何一个崩溃即触发全面紧急备份退出
wait $DASHBOARD_PID $GATEWAY_PID
EOF

RUN chmod +x /start.sh

# 封装快捷一键手动备份口令（供未来飞书或Web终端直接调用）
# 封装快捷一键手动备份口令（供未来飞书或Web终端直接调用）
RUN echo '#!/bin/bash\nmv /root/.hermes/gateway.lock /tmp/gateway.lock.bak 2>/dev/null\nmv /root/.hermes/gateway.log /tmp/gateway.log.bak 2>/dev/null\npython3 -c "from huggingface_hub import HfApi; api=HfApi(); api.upload_folder(folder_path=\"/root/.hermes\", repo_id=\"$HF_DATASET\", repo_type=\"dataset\", ignore_patterns=[\"*.db-wal\", \"*.db-shm\", \"*.db-journal\", \"pairing*\", \"*.tmp\", \"*.mp4\", \"*.avi\", \"*.mov\", \"*.mkv\", \"*.wav\", \"*.mp3\", \"*.lock\"], commit_message=\"Manual backup via Feishu\", token=\"$HF_TOKEN\")"\nmv /tmp/gateway.lock.bak /root/.hermes/gateway.lock 2>/dev/null\nmv /tmp/gateway.log.bak /root/.hermes/gateway.log 2>/dev/null' > /usr/local/bin/force-backup && chmod +x /usr/local/bin/force-backup

EXPOSE 7860
CMD ["/start.sh"]