FROM python:3.12-slim

RUN pip install --no-cache-dir retalk

# Hugging Face runs the container as uid 1000, so write the DB under its home.
RUN useradd -m -u 1000 user
USER user

ENV HOME=/home/user \
    PATH=/home/user/.local/bin:$PATH \
    RETALK_SERVER_HOST=0.0.0.0 \
    RETALK_SERVER_PORT=7860 \
    RETALK_SERVER_DB=/home/user/server.db

WORKDIR /home/user
EXPOSE 7860

# RETALK_SERVER_AUDIENCE must equal the Space's public URL; set it as a Space variable.
# Fail loudly if it's missing rather than break every client signature.
CMD ["sh", "-c", ": \"${RETALK_SERVER_AUDIENCE:?set the RETALK_SERVER_AUDIENCE Space variable to https://<owner>-<space>.hf.space}\"; echo \"retalk audience: $RETALK_SERVER_AUDIENCE\"; exec retalk-server --audience \"$RETALK_SERVER_AUDIENCE\""]