Dockerfile

# syntax=docker/dockerfile:1.6

# ── Build stage ─────────────────────────────────────────────────────────
FROM node:20-alpine AS builder
WORKDIR /app

COPY package.json package-lock.json tsconfig.base.json tsconfig.app.json vite.config.ts ./
COPY packages ./packages
RUN npm ci

COPY index.html ./
COPY src ./src
COPY content ./content
COPY public ./public
RUN npm run build

# ── Serve stage ─────────────────────────────────────────────────────────
FROM nginx:1.27-alpine AS runtime

# HF Spaces runs the container as UID 1000; nginx needs writable pid + tmp
# paths, and our entrypoint script mutates index.html.
RUN mkdir -p /var/cache/nginx /var/run/nginx /tmp/nginx \
 && chown -R 1000:1000 /var/cache/nginx /var/run/nginx /tmp/nginx /usr/share/nginx/html

COPY nginx.conf /etc/nginx/nginx.conf
COPY --from=builder --chown=1000:1000 /app/dist /usr/share/nginx/html

# nginx:alpine runs every executable script in /docker-entrypoint.d before
# starting the server — that's how we patch index.html with the OAuth
# variables HF injects at container runtime.
COPY docker-entrypoint.d/10-inject-hf-vars.sh /docker-entrypoint.d/10-inject-hf-vars.sh
RUN chmod +x /docker-entrypoint.d/10-inject-hf-vars.sh

USER 1000
EXPOSE 7860

CMD ["nginx", "-g", "daemon off;"]