# =============================================================================
# OpenClaw Gateway - Hugging Face Spaces Dockerfile (DISABLE AUTH)
# =============================================================================

FROM node:22-bookworm

ARG OPENCLAW_REPO=https://github.com/openclaw/openclaw.git
ARG OPENCLAW_REF=main

RUN apt-get update && \
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        git ca-certificates curl procps openssl \
    && apt-get clean && rm -rf /var/lib/apt/lists/*

RUN curl -fsSL https://bun.sh/install | bash
ENV PATH="/root/.bun/bin:${PATH}"
RUN corepack enable

WORKDIR /app

RUN git clone --depth 1 --branch "${OPENCLAW_REF}" "${OPENCLAW_REPO}" .
ENV NODE_OPTIONS="--max_old_space_size=4096"
RUN pnpm install --frozen-lockfile
ENV OPENCLAW_PREFER_PNPM=1
RUN pnpm build && pnpm ui:build

ENV NODE_ENV=production
ENV OPENCLAW_BUNDLED_PLUGINS_DIR=/app/extensions
EXPOSE 7860

# -----------------------------------------------------------------------------
# Configuration Creation (DISABLE AUTH COMPLETELY)
# -----------------------------------------------------------------------------
# Để tắt Auth, ta không set key "auth" hoặc set token rỗng tùy version.
# Với version mới của OpenClaw, việc không set auth block sẽ disable token check.
# Hoặc ta có thể thử set DISABLE_AUTH env var nếu code hỗ trợ.
# An toàn nhất là set token rỗng trong cấu trúc mới.
RUN mkdir -p /app/config && \
    echo '{\n\
  "gateway": {\n\
    "bind": "lan",\n\
    "port": 7860,\n\
    "trustedProxies": ["0.0.0.0/0"],\n\
    "controlUi": {\n\
      "dangerouslyAllowHostHeaderOriginFallback": true\n\
    }\n\
  }\n\
}' > /app/config/openclaw.json

RUN printf '%s\n' \
    '#!/bin/sh' \
    'set -e' \
    'export OPENCLAW_HOME=/data' \
    'mkdir -p /data/.openclaw' \
    'cp /app/config/openclaw.json /data/.openclaw/openclaw.json' \
    'export OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLYALLOWHOSTHEADERORIGINFALLBACK=true' \
    '# Clear token env to ensure no auth expected' \
    'unset OPENCLAW_GATEWAY_AUTH_TOKEN' \
    'exec node /app/openclaw.mjs gateway --allow-unconfigured --bind lan --port 7860 "$@"' \
    > /app/entrypoint.sh && chmod +x /app/entrypoint.sh

RUN chown -R node:node /app && mkdir -p /data && chown -R node:node /data
USER node

HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD curl -f http://localhost:7860/healthz || exit 1

ENTRYPOINT ["/app/entrypoint.sh"]