FROM pspdfkit/ai-assistant:nightly

# Set environment variables
ENV HOME=/home/node \
    PNPM_HOME=/root/.local/share/pnpm \
    PATH=/root/.local/share/pnpm/bin:$PATH \
    POSTGRES_USER=db-user \
    POSTGRES_PASSWORD=password \
    POSTGRES_DB=ai_assistant \
    POSTGRES_INITDB_ARGS=--data-checksums \
    PGDATA=/home/node/pgdata \
    PGUSER=db-user \
    PGPASSWORD=password \
    PGDATABASE=ai_assistant \
    PGHOST=localhost \
    PGPORT=5432 \
    API_AUTH_TOKEN=secret \
    JWT_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2gzhmJ9TDanEzWdP1WG+\n0Ecwbe7f3bv6e5UUpvcT5q68IQJKP47AQdBAnSlFVi4X9SaurbWoXdS6jpmPpk24\nQvitzLNFphHdwjFBelTAOa6taZrSusoFvrtK9x5xsW4zzt/bkpUraNx82Z8MwLwr\nt6HlY7dgO9+xBAabj4t1d2t+0HS8O/ed3CB6T2lj6S8AbLDSEFc9ScO6Uc1XJlSo\nrgyJJSPCpNhSq3AubEZ1wMS1iEtgAzTPRDsQv50qWIbn634HLWxTP/UH6YNJBwzt\n3O6q29kTtjXlMGXCvin37PyX4Jy1IiPFwJm45aWJGKSfVGMDojTJbuUtM+8P9Rrn\nAwIDAQAB\n-----END PUBLIC KEY-----" \
    JWT_ALGORITHM=RS256 \
    DASHBOARD_USERNAME=dashboard \
    DASHBOARD_PASSWORD=secret \
    SECRET_KEY_BASE=secret-key-base

# Install system packages
RUN apk add --no-cache \
    postgresql16 \
    postgresql16-contrib \
    py3-pip \
    python3 \
    py3-virtualenv \
    wget \
    curl \
    unzip \
    nginx \
    procps \
    build-base \
    postgresql16-dev \
    git && \
    mkdir -p /run/postgresql && \
    chown -R node:node /run/postgresql && \
    # Install llamafiler
    mkdir -p /tmp/llamafile && \
    cd /tmp/llamafile && \
    wget --no-check-certificate https://github.com/Mozilla-Ocho/llamafile/releases/download/0.8.17/llamafile-0.8.17.zip && \
    unzip llamafile-0.8.17.zip && \
    cp llamafile-0.8.17/bin/llamafiler /usr/local/bin/ && \
    chmod +x /usr/local/bin/llamafiler && \
    rm -rf /tmp/llamafile && \
    mkdir -p /root/.local/share/pnpm && \
    chmod -R 755 /root/.local/share/pnpm && \
    chown -R node:node /root/.local/share/pnpm && \
    # Ensure prisma is executable from PATH
    ln -s /base/node_modules/.pnpm/prisma@5.11.0/node_modules/prisma/node_modules/.bin/prisma /usr/local/bin/prisma && \
    chmod +x /usr/local/bin/prisma

# Install nginx and set up directories for non-root usage.
RUN mkdir -p /var/cache/nginx \
             /var/log/nginx \
             /var/lib/nginx && \
    touch /var/run/nginx.pid && \
    chown -R node:node /var/cache/nginx \
                      /var/log/nginx \
                      /var/lib/nginx \
                      /var/run/nginx.pid \
                      /run/nginx

# Copy application files to /base BEFORE switching user.
COPY --chown=node:node nginx.conf /etc/nginx/nginx.conf
COPY --chown=node:node start-services.sh /base/app/
COPY --chown=node:node service-config.yml /service-config.yml

USER node
RUN mkdir -p $HOME/models && \
    mkdir -p $HOME/pgdata

# Install pgvector (needs root)
USER root
RUN git clone https://github.com/pgvector/pgvector.git && \
    cd pgvector && \
    make && \
    make install && \
    cd .. && \
    rm -rf pgvector

# Download models as node user
USER node
RUN wget -q https://huggingface.co/bartowski/gemma-2-2b-it-GGUF/resolve/main/gemma-2-2b-it-Q4_K_M.gguf -O $HOME/models/gemma-2b.gguf && \
    wget -q https://huggingface.co/leliuga/all-MiniLM-L6-v2-GGUF/resolve/main/all-MiniLM-L6-v2.F16.gguf -O $HOME/models/embeddings.gguf && \
    chmod +x /base/app/start-services.sh

USER root
# Fix permissions for scripts and pnpm directory.
RUN chmod +x /base/app/start-services.sh && \
    mkdir -p /root/.local/share/pnpm && \
    chmod 755 /root && \
    chmod 755 /root/.local && \
    chmod 755 /root/.local/share && \
    chmod -R 755 /root/.local/share/pnpm && \
    chown -R node:node /root/.local/share/pnpm

# Set up document authoring in a separate directory
WORKDIR /docauth

# Create directory and set permissions
USER root
RUN mkdir -p /docauth && \
    chown -R node:node /docauth && \
    chmod -R 755 /docauth

USER node

# Copy the website that showcases the document authoring library.
COPY --chown=node:node index.html /docauth/index.html
COPY --chown=node:node document-authoring.js /docauth/document-authoring.js
COPY --chown=node:node Sample.docx /docauth/Sample.docx

EXPOSE 7860

USER root

# Fix permissions for the entire pnpm path.
RUN mkdir -p /root/.local/share/pnpm && \
    chmod 755 /root && \
    chmod 755 /root/.local && \
    chmod 755 /root/.local/share && \
    chmod -R 755 /root/.local/share/pnpm && \
    chown -R node:node /root/.local/share/pnpm

USER node
WORKDIR /base
ENTRYPOINT []
CMD ["sh", "-c", "/base/app/start-services.sh"]