Update Dockerfile

Dockerfile

@@ -1,294 +1,37 @@
-# syntax=docker/dockerfile:1
-# =============================================================================
-# Rochester-restricted Bluesky PDS + full Bluesky web app - single Dockerfile.
-#
-# The web client (bsky.app React Native Web SPA) is prebuilt by GitHub Actions
-# (workflow: .github/workflows/prebuild-web.yml) and force-pushed to the
-# `prebuilt-web` branch. This image simply copies that static bundle into the
-# official PDS image and patches it at boot to (a) restrict registration to
-# @rochesterschools.org and (b) serve the web app at / with an SPA fallback.
-#
-# No Node build happens here - so this builds fast and fits in low-memory
-# builders like HF Spaces free tier.
-#
-# Listens on port 7860 (HF forwards the public Space URL to it automatically).
-# =============================================================================
+FROM python:3.11-slim
 
-FROM node:24-bookworm-slim AS webapp
+# Install system dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends gcc libc6-dev && rm -rf /var/lib/apt/lists/*
 
-RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
 
-WORKDIR /bundle
+# Install Python dependencies
+RUN pip install --no-cache-dir flask flask-cors Pillow litert-lm huggingface_hub
 
-# The prebuilt bundle lives on the `prebuilt-web` branch (pushed by
-# prebuild-web.yml). Update SOURCE_REF to the commit of that branch whenever
-# the web app changes and the workflow has run.
-ARG SOURCE_REPO=https://github.com/CloudCompile/social-app.git
-ARG SOURCE_REF=prebuilt-web
-RUN git init . \
- && git remote add origin ${SOURCE_REPO} \
- && git fetch --depth 1 origin ${SOURCE_REF} \
- && git checkout FETCH_HEAD
+# Create dummy Vulkan library to satisfy litert-lm on CPU
+RUN printf 'void vkGetInstanceProcAddr(){}\nvoid vkCreateInstance(){}\nvoid vkDestroyInstance(){}\nvoid vkEnumeratePhysicalDevices(){}\nvoid vkGetDeviceProcAddr(){}' > /tmp/vk.c \
+    && gcc -shared -fPIC -o /app/libvulkan.so.1 /tmp/vk.c \
+    && rm /tmp/vk.c
 
-RUN test -f index.html || { echo "prebuilt-web branch has no index.html - run the prebuild-web workflow first"; exit 1; }
+# Create model directory
+RUN mkdir -p /app/models/gemma
 
-# --------------------------------------------------------------- server stage
-FROM ghcr.io/bluesky-social/pds:0.4
+# --- KEY FIX: Updated 'hf download' to fetch the 12B model ---
+RUN hf download litert-community/gemma-4-E2B-it-litert-lm gemma-4-E2B-it.litertlm --local-dir /app/models/gemma
+# Copy the server code
+COPY server.py .
 
-USER root
+# Setup permissions for Hugging Face Spaces (requires user 1000)
+RUN useradd -m -u 1000 user
+RUN chown -R user:user /app
+USER user
 
-# Web app bundle
-COPY --from=webapp /bundle /app/web
-
-# Write the email-allowlist patcher into the image.
-RUN <<'PATCH'
-cat > /app/allowlist-patch.cjs <<'EOF'
-/*
- * Patches the bundled @atproto/pds dist to enforce an email-domain allowlist
- * on com.atproto.server.createAccount. Idempotent; fails fast if upstream
- * code layout changes so the container never runs with open registration.
- */
-const fs = require('node:fs')
-const path = require('node:path')
-
-const pdsDist = path.join(__dirname, 'node_modules', '@atproto', 'pds', 'dist')
-
-const domains = (process.env.PDS_EMAIL_ALLOWED_DOMAINS || '')
-  .split(',')
-  .map((d) => d.trim().toLowerCase().replace(/^\./, ''))
-  .filter(Boolean)
-
-if (domains.length === 0) {
-  console.error('[allowlist] PDS_EMAIL_ALLOWED_DOMAINS is not set; refusing to patch (open registration is not allowed)')
-  process.exit(1)
-}
-
-function findTarget(dir) {
-  for (const entry of fs.readdirSync(dir, {withFileTypes: true})) {
-    const full = path.join(dir, entry.name)
-    if (entry.isDirectory()) {
-      const found = findTarget(full)
-      if (found) return found
-    } else if (
-      entry.name === 'createAccount.js' &&
-      fs.readFileSync(full, 'utf8').includes('validateInputsForLocalPds') &&
-      fs.readFileSync(full, 'utf8').includes('isDisposableEmail')
-    ) {
-      return full
-    }
-  }
-  return null
-}
-
-const target = findTarget(pdsDist)
-if (!target) {
-  console.error('[allowlist] could not locate createAccount.js under ' + pdsDist)
-  process.exit(1)
-}
-
-let source = fs.readFileSync(target, 'utf8')
-
-if (source.includes('__ROCHESTER_EMAIL_ALLOWLIST__')) {
-  console.log('[allowlist] already patched, skipping')
-  process.exit(0)
-}
-
-const conditionOld = '!isEmailValid(email) || isDisposableEmail(email)'
-const conditionNew = conditionOld + ' || !__rochesterEmailAllowed(email)'
-if (!source.includes(conditionOld)) {
-  console.error('[allowlist] email validity condition not found; upstream layout changed')
-  process.exit(1)
-}
-source = source.replace(conditionOld, conditionNew)
-
-const messageOld = "'This email address is not supported, please use a different email.'"
-const messageNew = "'Registration is restricted to " + domains.join(', ') + " email addresses.'"
-if (!source.includes(messageOld)) {
-  console.error('[allowlist] error message anchor not found; upstream layout changed')
-  process.exit(1)
-}
-source = source.replace(messageOld, messageNew)
-
-const helper = [
-  '',
-  '// __ROCHESTER_EMAIL_ALLOWLIST__ start',
-  'function __rochesterEmailAllowed(email) {',
-  "  const domain = String(email || '').split('@')[1]?.toLowerCase()",
-  '  return ' + JSON.stringify(domains) + '.includes(domain)',
-  '}',
-  '// __ROCHESTER_EMAIL_ALLOWLIST__ end',
-  '',
-].join('\n')
-const helperAnchor = 'export default function (server, ctx)'
-if (!source.includes(helperAnchor)) {
-  console.error('[allowlist] helper injection point not found; upstream layout changed')
-  process.exit(1)
-}
-source = source.replace(helperAnchor, helper + '\n' + helperAnchor)
-
-fs.writeFileSync(target, source)
-console.log('[allowlist] patched ' + target + ' (domains: ' + domains.join(', ') + ')')
-EOF
-PATCH
-
-# Write the entrypoint: generate secrets on first boot, patch, start.
-RUN <<'ENTRY'
-cat > /usr/local/bin/entrypoint.sh <<'EOF'
-#!/bin/sh
-set -e
-cd /app
-
-SECRETS_FILE=/app/data/generated-secrets.env
-mkdir -p /app/data
-
-# Generate persistent secrets on first boot so restarts keep sessions valid.
-# NOTE: a secp256k1 (K256) private key is just 32 random bytes, so no
-# @atproto/crypto import is needed (it is not resolvable under pnpm layout).
-if [ ! -f "$SECRETS_FILE" ]; then
-  echo "[entrypoint] first boot - generating secrets"
-  : > "$SECRETS_FILE"
-fi
-
-# Backfill any missing secret individually (covers files created by older
-# image versions that crashed mid-generation).
-. "$SECRETS_FILE" || true
-
-if [ -z "${PDS_JWT_SECRET:-}" ]; then
-  PDS_JWT_SECRET=$(node -e 'console.log(require("crypto").randomBytes(16).toString("hex"))')
-  echo "PDS_JWT_SECRET=$PDS_JWT_SECRET" >> "$SECRETS_FILE"
-fi
-if [ -z "${PDS_ADMIN_PASSWORD:-}" ]; then
-  PDS_ADMIN_PASSWORD=$(node -e 'console.log(require("crypto").randomBytes(16).toString("hex"))')
-  echo "PDS_ADMIN_PASSWORD=$PDS_ADMIN_PASSWORD" >> "$SECRETS_FILE"
-fi
-if [ -z "${PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX:-}" ]; then
-  PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(node -e 'console.log(require("crypto").randomBytes(32).toString("hex"))')
-  echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX" >> "$SECRETS_FILE"
-fi
-chmod 600 "$SECRETS_FILE" || true
-export PDS_JWT_SECRET PDS_ADMIN_PASSWORD PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX
-
-# PDS_HOSTNAME must be a bare hostname (no scheme, no trailing slash).
-# did:web is built from it; normalize common full-URL mistakes.
-PDS_HOSTNAME=$(node -e '
-  let h = process.env.PDS_HOSTNAME || ""
-  h = h.trim().replace(/^https?:\/\//, "").replace(/\/+$/, "").replace(/:.*$/, "")
-  console.log(h)
-')
-export PDS_HOSTNAME
-
-echo "================================================================"
-echo " Generated secrets (saved in $SECRETS_FILE):"
-echo "   PDS_ADMIN_PASSWORD: $PDS_ADMIN_PASSWORD"
-echo "================================================================"
-
-node allowlist-patch.cjs
-
-# Serve the bundled Bluesky web app at / with an SPA fallback. Patched into
-# basic-routes.js so the middleware is registered before the '/' banner route;
-# the fallback skips API paths (/xrpc, /.well-known, /tls-check, files with
-# extensions) so the PDS API keeps working. Idempotent.
-node - <<'WEBAPP'
-const fs = require('node:fs')
-const path = require('node:path')
-const MARKER = '__ROCHESTER_WEB_APP__'
-function findBasicRoutes(dir) {
-  try {
-    for (const entry of fs.readdirSync(dir, {withFileTypes: true})) {
-      const full = path.join(dir, entry.name)
-      if (entry.isDirectory()) {
-        const found = findBasicRoutes(full)
-        if (found) return found
-      } else if (entry.name === 'basic-routes.js') {
-        return full
-      }
-    }
-  } catch {}
-  return null
-}
-const target = findBasicRoutes('/app/node_modules') || findBasicRoutes('/app/node_modules/.pnpm')
-if (!target) {
-  console.error('[webapp] could not locate basic-routes.js')
-  process.exit(1)
-}
-let src = fs.readFileSync(target, 'utf8')
-if (src.includes(MARKER)) {
-  console.log('[webapp] already patched, skipping')
-  process.exit(0)
-}
-const anchor = 'const router = Router()'
-if (!src.includes(anchor)) {
-  console.error('[webapp] injection point not found in basic-routes.js')
-  process.exit(1)
-}
-if (!src.includes("from 'express'") || !src.includes("import { Router }")) {
-  console.error('[webapp] unexpected imports in basic-routes.js')
-  process.exit(1)
-}
-const injection = [
-  anchor,
-  '  // ' + MARKER + ' start',
-  "  const webDir = '/app/web'",
-  '  router.use(express.static(webDir, {index: \'index.html\', maxAge: \'1h\'}))',
-  '  router.get(\'*\', function (req, res, next) {',
-  "    if (req.path.startsWith('/xrpc/') || req.path.startsWith('/.') || req.path.startsWith('/tls-check')) return next()",
-  '    if (path.extname(req.path)) return next()',
-  "    res.sendFile(path.join(webDir, 'index.html'))",
-  '  })',
-  '  // ' + MARKER + ' end',
-].join('\n')
-src = src.replace(anchor, injection)
-if (!src.match(/^import path\b/m)) {
-  src = "import path from 'node:path'\n" + src
-}
-// express.static needs the default export; basic-routes only imports {Router}
-if (!src.match(/^import express\b/m)) {
-  src = "import express from 'express'\n" + src
-}
-fs.writeFileSync(target, src)
-console.log('[webapp] web app serving patched into ' + target)
-WEBAPP
-
-exec node --enable-source-maps index.ts
-EOF
-chmod +x /usr/local/bin/entrypoint.sh
-ENTRY
-
-# Data directory (SQLite + blobs). Enable persistent storage in the Space
-# settings to keep it across restarts.
-RUN mkdir -p /app/data \
-  && chown -R 1000:1000 /app \
-  && chown 1000:1000 /usr/local/bin/entrypoint.sh
-
-# HF Spaces runs containers as uid 1000; the runtime patch needs write access
-# to node_modules, hence the chown above.
-USER 1000
-
-ENV PDS_DATA_DIRECTORY=/app/data
-
-# Disk blobstore - stores uploaded images/videos under /app/data (alongside
-# the SQLite db) so everything lives in the persistent volume.
-ENV PDS_BLOBSTORE_DISK_LOCATION=/app/data/blobs
-ENV PDS_BLOBSTORE_DISK_TMP_LOCATION=/app/data/blobs/tmp
-
-# HF Spaces route to port 7860
-ENV PDS_PORT=7860
-
-# Registration allowlist (comma-separated domains). The email domain check is
-# the only registration gate - no invite codes, no SMTP verification.
-ENV PDS_EMAIL_ALLOWED_DOMAINS=rochesterschools.org
-ENV PDS_INVITE_REQUIRED=false
-ENV PDS_EMAIL_SMTP_URL=
-ENV PDS_EMAIL_FROM_ADDRESS=
-# Skip email confirmation flow entirely (no SMTP on HF)
-ENV PDS_EMAIL_DISABLE_CONFIRMATION_LINK=true
-
-# Public hostname. Set this to your Space's public URL (as a Space secret or
-# variable named PDS_HOSTNAME) so the PDS advertises the right endpoint:
-#   https://<owner>-<space>.hf.space
-# Users' handles will be <name>.<that hostname>.
-ENV PDS_HOSTNAME=cloudunity-gemma-api1.hf.space
+# Set environment variables
+ENV PORT=7860
+ENV LD_LIBRARY_PATH=/app
 
+# --- KEY FIX: Updated path to point to the 12B model file ---
+ENV GEMMA_MODEL_PATH=/app/models/gemma/gemma-4-E2B-it.litertlm
 EXPOSE 7860
 
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["python3", "server.py"]