FROM nvidia/cuda:12.6.3-devel-ubuntu22.04

# Create non-root user
RUN useradd -m -u 1000 user

# Set environment variables
ENV HOME=/home/user \
    PATH=/home/user/.local/bin:$PATH \
    API_AUTH_TOKEN=secret \
    JWT_ALGORITHM=RS256 \
    DASHBOARD_USERNAME=dashboard \
    DASHBOARD_PASSWORD=secret \
    SECRET_KEY_BASE=secret-key-base \
    JWT_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2gzhmJ9TDanEzWdP1WG+\n0Ecwbe7f3bv6e5UUpvcT5q68IQJKP47AQdBAnSlFVi4X9SaurbWoXdS6jpmPpk24\nQvitzLNFphHdwjFBelTAOa6taZrSusoFvrtK9x5xsW4zzt/bkpUraNx82Z8MwLwr\nt6HlY7dgO9+xBAabj4t1d2t+0HS8O/ed3CB6T2lj6S8AbLDSEFc9ScO6Uc1XJlSo\nrgyJJSPCpNhSq3AubEZ1wMS1iEtgAzTPRDsQv50qWIbn634HLWxTP/UH6YNJBwzt\n3O6q29kTtjXlMGXCvin37PyX4Jy1IiPFwJm45aWJGKSfVGMDojTJbuUtM+8P9Rrn\nAwIDAQAB\n-----END PUBLIC KEY-----"

# Install minimal dependencies
RUN apt-get update && apt-get install -y \
    wget \
    curl \
    unzip \
    clang \
    cuda-toolkit \
    nginx \
    build-essential \
    cmake \
    git \
    libcurl4-openssl-dev \
    && rm -rf /var/lib/apt/lists/*

# Copy llama.cpp server files from official image
COPY --from=ghcr.io/ggerganov/llama.cpp:server-cuda /app/llama-server $HOME/app/llama-server
COPY --from=ghcr.io/ggerganov/llama.cpp:server-cuda /app/*.so* $HOME/app/
RUN chmod +x $HOME/app/llama-server

# Install Node.js and pnpm
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
    apt-get update && \
    apt-get install -y nodejs && \
    npm install -g corepack && \
    rm -rf /var/lib/apt/lists/*

# Enable pnpm
RUN corepack enable && corepack prepare pnpm@latest --activate

# Create directories and set permissions
RUN mkdir -p /tmp/llamacpp && \
    mkdir -p $HOME/models && \
    mkdir -p $HOME/app && \
    mkdir -p $HOME/app/docauth && \
    mkdir -p $HOME/app/aia && \
    mkdir -p /var/cache/nginx && \
    mkdir -p /var/log/nginx && \
    mkdir -p /var/lib/nginx && \
    mkdir -p /run/nginx && \
    touch /var/run/nginx.pid && \
    chown -R user:user $HOME && \
    chown -R user:user /var/cache/nginx && \
    chown -R user:user /var/log/nginx && \
    chown -R user:user /var/lib/nginx && \
    chown -R user:user /var/run/nginx.pid && \
    chown -R user:user /run/nginx

# Copy AI Assistant app
COPY --from=pspdfkit/ai-assistant:nightly /base $HOME/app/aia
COPY --chown=node:node service-config.yml /service-config.yml
RUN chown -R user:user $HOME/app/aia

# Copy nginx configuration and replace license key
COPY nginx.conf /etc/nginx/nginx.conf
RUN --mount=type=secret,id=DOCAUTH_LICENSE_KEY,mode=0444,required=true \
    sed -i "s/\$DOCAUTH_LICENSE_KEY/$(cat /run/secrets/DOCAUTH_LICENSE_KEY)/g" /etc/nginx/nginx.conf

# Copy web files
COPY --chown=user:user index.html $HOME/app/docauth/
COPY --chown=user:user document-authoring.js $HOME/app/docauth/
COPY --chown=user:user Sample.docx $HOME/app/docauth/

# Copy start script
COPY --chown=user:user start-services.sh $HOME/app/
RUN chmod +x $HOME/app/start-services.sh

# Switch to non-root user
USER user
WORKDIR $HOME/app

# Download models
RUN wget -q https://huggingface.co/bartowski/gemma-2-2b-it-GGUF/resolve/main/gemma-2-2b-it-Q8_0.gguf -O $HOME/models/gemma-2b.gguf && \
    wget -q https://huggingface.co/leliuga/all-MiniLM-L6-v2-GGUF/resolve/main/all-MiniLM-L6-v2.F16.gguf -O $HOME/models/embeddings.gguf

# Expose (7860, for Hugging Face, 4000 for AI Assistant)
EXPOSE 7860

CMD ["./start-services.sh"]