Update Dockerfile

Dockerfile

@@ -1,24 +1,52 @@
 # syntax=docker/dockerfile:1
 # =============================================================================
-# Rochester-restricted Bluesky PDS - single Dockerfile, built for HF Spaces.
+# Rochester-restricted Bluesky PDS + full Bluesky web app - single Dockerfile.
 #
-# Listens on port 7860 (HF forwards the public Space URL to it automatically).
-#
-# On first boot it generates JWT/admin secrets, persists them in /app/data,
-# and prints the admin password to the Space's container logs.
+# Stage 1 builds this repo's web client (the bsky.app React Native Web SPA).
+# Stage 2 is the official PDS image, patched at boot to (a) restrict
+# registration to @rochesterschools.org and (b) serve the web app at / with an
+# SPA fallback. One container serves both the app UI and the AT Protocol API.
 #
-# Registration is restricted to emails at PDS_EMAIL_ALLOWED_DOMAINS
-# (default: rochesterschools.org). No SMTP configured - email verification
-# is skipped entirely; the domain check is the only gate.
-#
-# NOTE: HF Spaces have ephemeral storage unless you enable persistent storage
-# in the Space settings. /app/data holds the SQLite db + generated secrets.
+# Listens on port 7860 (HF forwards the public Space URL to it automatically).
 # =============================================================================
 
+# ---------------------------------------------------------------- build stage
+FROM node:22-bookworm-slim AS webapp
+
+RUN corepack enable
+WORKDIR /build
+
+# Copy the whole repo (needed by the Expo/webpack build)
+COPY . .
+
+# pnpm install with build scripts allowed (better-sqlite3 etc. are not needed
+# for web, but the lockfile requires the steps to run or be skipped)
+RUN pnpm install --frozen-lockfile || pnpm install --no-frozen-lockfile
+
+# Compile i18n catalogs (required by the build; normally done by CI)
+RUN pnpm intl:build || pnpm intl:compile || true
+
+# Build the static web app with this PDS baked in as the default service,
+# so sign-in/sign-up default to this server (users can still pick another).
+# On HF Spaces, set a Space variable PDS_HOSTNAME and rebuild so this matches.
+ARG PDS_HOSTNAME=hf.space
+ENV EXPO_PUBLIC_DEFAULT_SERVICE=https://${PDS_HOSTNAME}
+ENV EXPO_PUBLIC_BUNDLE_IDENTIFIER=rochester-pds
+ENV NODE_ENV=production
+RUN pnpm build-web || (npx expo export:web && node ./scripts/post-web-build.js)
+
+# post-web-build copies assets into bskyweb/static; for static hosting we serve
+# web-build directly, so just make sure it exists
+RUN test -d web-build
+
+# --------------------------------------------------------------- server stage
 FROM ghcr.io/bluesky-social/pds:0.4
 
 USER root
 
+# Web app bundle
+COPY --from=webapp /build/web-build /app/web
+
 # Write the email-allowlist patcher into the image.
 RUN <<'PATCH'
 cat > /app/allowlist-patch.cjs <<'EOF'
@@ -163,6 +191,71 @@ echo "================================================================"
 
 node allowlist-patch.cjs
 
+# Serve the bundled Bluesky web app at / with an SPA fallback. Patched into
+# basic-routes.js so the middleware is registered before the '/' banner route;
+# the fallback skips API paths (/xrpc, /.well-known, /tls-check, files with
+# extensions) so the PDS API keeps working. Idempotent.
+node - <<'WEBAPP'
+const fs = require('node:fs')
+const path = require('node:path')
+const MARKER = '__ROCHESTER_WEB_APP__'
+function findBasicRoutes(dir) {
+  try {
+    for (const entry of fs.readdirSync(dir, {withFileTypes: true})) {
+      const full = path.join(dir, entry.name)
+      if (entry.isDirectory()) {
+        const found = findBasicRoutes(full)
+        if (found) return found
+      } else if (entry.name === 'basic-routes.js') {
+        return full
+      }
+    }
+  } catch {}
+  return null
+}
+const target = findBasicRoutes('/app/node_modules') || findBasicRoutes('/app/node_modules/.pnpm')
+if (!target) {
+  console.error('[webapp] could not locate basic-routes.js')
+  process.exit(1)
+}
+let src = fs.readFileSync(target, 'utf8')
+if (src.includes(MARKER)) {
+  console.log('[webapp] already patched, skipping')
+  process.exit(0)
+}
+const anchor = 'const router = Router()'
+if (!src.includes(anchor)) {
+  console.error('[webapp] injection point not found in basic-routes.js')
+  process.exit(1)
+}
+if (!src.includes("from 'express'") || !src.includes("import { Router }")) {
+  console.error('[webapp] unexpected imports in basic-routes.js')
+  process.exit(1)
+}
+const injection = [
+  anchor,
+  '  // ' + MARKER + ' start',
+  "  const webDir = '/app/web'",
+  '  router.use(express.static(webDir, {index: \'index.html\', maxAge: \'1h\'}))',
+  '  router.get(\'*\', function (req, res, next) {',
+  "    if (req.path.startsWith('/xrpc/') || req.path.startsWith('/.') || req.path.startsWith('/tls-check')) return next()",
+  '    if (path.extname(req.path)) return next()',
+  "    res.sendFile(path.join(webDir, 'index.html'))",
+  '  })',
+  '  // ' + MARKER + ' end',
+].join('\n')
+src = src.replace(anchor, injection)
+if (!src.match(/^import path\b/m)) {
+  src = "import path from 'node:path'\n" + src
+}
+// express.static needs the default export; basic-routes only imports {Router}
+if (!src.match(/^import express\b/m)) {
+  src = "import express from 'express'\n" + src
+}
+fs.writeFileSync(target, src)
+console.log('[webapp] web app serving patched into ' + target)
+WEBAPP
+
 exec node --enable-source-maps index.ts
 EOF
 chmod +x /usr/local/bin/entrypoint.sh
@@ -201,8 +294,8 @@ ENV PDS_EMAIL_DISABLE_CONFIRMATION_LINK=true
 # variable named PDS_HOSTNAME) so the PDS advertises the right endpoint:
 #   https://<owner>-<space>.hf.space
 # Users' handles will be <name>.<that hostname>.
-ENV PDS_HOSTNAME=https://cloudunity-gemma-api1.hf.space
+ENV PDS_HOSTNAME=cloudunity-gemma-api1.hf.space
 
 EXPOSE 7860
 
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]