Update Dockerfile

Dockerfile

@@ -1,58 +1,180 @@
-FROM python:3.12-slim
-
-ENV DEBIAN_FRONTEND=noninteractive
-ENV PYTHONUNBUFFERED=1
-ENV PIP_NO_CACHE_DIR=1
-ENV LD_LIBRARY_PATH=/opt/llama
-
-WORKDIR /app
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    cmake \
-    build-essential \
-    curl \
-    ca-certificates \
-    libgomp1 \
-    && rm -rf /var/lib/apt/lists/*
-
-RUN git clone --depth 1 https://github.com/ggml-org/llama.cpp.git /tmp/llama.cpp \
-    && cmake -S /tmp/llama.cpp -B /tmp/llama.cpp/build \
-        -DGGML_NATIVE=OFF \
-        -DGGML_OPENMP=ON \
-        -DLLAMA_BUILD_SERVER=ON \
-        -DLLAMA_BUILD_TESTS=OFF \
-        -DLLAMA_BUILD_EXAMPLES=ON \
-    && cmake --build /tmp/llama.cpp/build \
-        --config Release \
-        --target llama-server \
-        -j2 \
-    && mkdir -p /opt/llama \
-    && cp /tmp/llama.cpp/build/bin/llama-server /opt/llama/ \
-    && cp /tmp/llama.cpp/build/bin/*.so* /opt/llama/ \
-    && rm -rf /tmp/llama.cpp
-
-RUN pip install huggingface_hub
-
-RUN python3 -c "\
-from huggingface_hub import hf_hub_download; \
-hf_hub_download( \
-    repo_id='LiquidAI/LFM2.5-2.6B-GGUF', \
-    filename='LFM2.5-2.6B-QAD-Q4_0.gguf', \
-    local_dir='/app/models' \
-)"
+# syntax=docker/dockerfile:1
+# =============================================================================
+# Rochester-restricted Bluesky PDS - single Dockerfile, built for HF Spaces.
+#
+# Listens on port 7860 (HF forwards the public Space URL to it automatically).
+#
+# On first boot it generates JWT/admin secrets, persists them in /app/data,
+# and prints the admin password to the Space's container logs.
+#
+# Registration is restricted to emails at PDS_EMAIL_ALLOWED_DOMAINS
+# (default: rochesterschools.org). No SMTP configured - email verification
+# is skipped entirely; the domain check is the only gate.
+#
+# NOTE: HF Spaces have ephemeral storage unless you enable persistent storage
+# in the Space settings. /app/data holds the SQLite db + generated secrets.
+# =============================================================================
+
+FROM ghcr.io/bluesky-social/pds:0.4
+
+USER root
+
+# Write the email-allowlist patcher into the image.
+RUN <<'PATCH'
+cat > /app/allowlist-patch.cjs <<'EOF'
+/*
+ * Patches the bundled @atproto/pds dist to enforce an email-domain allowlist
+ * on com.atproto.server.createAccount. Idempotent; fails fast if upstream
+ * code layout changes so the container never runs with open registration.
+ */
+const fs = require('node:fs')
+const path = require('node:path')
+
+const pdsDist = path.join(__dirname, 'node_modules', '@atproto', 'pds', 'dist')
+
+const domains = (process.env.PDS_EMAIL_ALLOWED_DOMAINS || '')
+  .split(',')
+  .map((d) => d.trim().toLowerCase().replace(/^\./, ''))
+  .filter(Boolean)
+
+if (domains.length === 0) {
+  console.error('[allowlist] PDS_EMAIL_ALLOWED_DOMAINS is not set; refusing to patch (open registration is not allowed)')
+  process.exit(1)
+}
+
+function findTarget(dir) {
+  for (const entry of fs.readdirSync(dir, {withFileTypes: true})) {
+    const full = path.join(dir, entry.name)
+    if (entry.isDirectory()) {
+      const found = findTarget(full)
+      if (found) return found
+    } else if (
+      entry.name === 'createAccount.js' &&
+      fs.readFileSync(full, 'utf8').includes('validateInputsForLocalPds') &&
+      fs.readFileSync(full, 'utf8').includes('isDisposableEmail')
+    ) {
+      return full
+    }
+  }
+  return null
+}
+
+const target = findTarget(pdsDist)
+if (!target) {
+  console.error('[allowlist] could not locate createAccount.js under ' + pdsDist)
+  process.exit(1)
+}
+
+let source = fs.readFileSync(target, 'utf8')
+
+if (source.includes('__ROCHESTER_EMAIL_ALLOWLIST__')) {
+  console.log('[allowlist] already patched, skipping')
+  process.exit(0)
+}
+
+const conditionOld = '!isEmailValid(email) || isDisposableEmail(email)'
+const conditionNew = conditionOld + ' || !__rochesterEmailAllowed(email)'
+if (!source.includes(conditionOld)) {
+  console.error('[allowlist] email validity condition not found; upstream layout changed')
+  process.exit(1)
+}
+source = source.replace(conditionOld, conditionNew)
+
+const messageOld = "'This email address is not supported, please use a different email.'"
+const messageNew = "'Registration is restricted to " + domains.join(', ') + " email addresses.'"
+if (!source.includes(messageOld)) {
+  console.error('[allowlist] error message anchor not found; upstream layout changed')
+  process.exit(1)
+}
+source = source.replace(messageOld, messageNew)
+
+const helper = [
+  '',
+  '// __ROCHESTER_EMAIL_ALLOWLIST__ start',
+  'function __rochesterEmailAllowed(email) {',
+  "  const domain = String(email || '').split('@')[1]?.toLowerCase()",
+  '  return ' + JSON.stringify(domains) + '.includes(domain)',
+  '}',
+  '// __ROCHESTER_EMAIL_ALLOWLIST__ end',
+  '',
+].join('\n')
+const helperAnchor = 'export default function (server, ctx)'
+if (!source.includes(helperAnchor)) {
+  console.error('[allowlist] helper injection point not found; upstream layout changed')
+  process.exit(1)
+}
+source = source.replace(helperAnchor, helper + '\n' + helperAnchor)
+
+fs.writeFileSync(target, source)
+console.log('[allowlist] patched ' + target + ' (domains: ' + domains.join(', ') + ')')
+EOF
+PATCH
+
+# Write the entrypoint: generate secrets on first boot, patch, start.
+RUN <<'ENTRY'
+cat > /usr/local/bin/entrypoint.sh <<'EOF'
+#!/bin/sh
+set -e
+cd /app
+
+SECRETS_FILE=/app/data/generated-secrets.env
+mkdir -p /app/data
+
+# Generate persistent secrets on first boot so restarts keep sessions valid.
+if [ ! -f "$SECRETS_FILE" ]; then
+  echo "[entrypoint] first boot - generating secrets"
+  {
+    echo "PDS_JWT_SECRET=$(node -e 'console.log(require("crypto").randomBytes(16).toString("hex"))')"
+    echo "PDS_ADMIN_PASSWORD=$(node -e 'console.log(require("crypto").randomBytes(16).toString("hex"))')"
+    echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(node -e 'const k=require("@atproto/crypto");k.Secp256k1Keypair.create({exportable:true}).then(kp=>kp.export()).then(j=>console.log(Buffer.from(Object.values(j)).toString("hex")))')"
+  } > "$SECRETS_FILE"
+  chmod 600 "$SECRETS_FILE" || true
+fi
+. "$SECRETS_FILE"
+export PDS_JWT_SECRET PDS_ADMIN_PASSWORD PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX
+
+echo "================================================================"
+echo " Generated secrets (saved in $SECRETS_FILE):"
+echo "   PDS_ADMIN_PASSWORD: $PDS_ADMIN_PASSWORD"
+echo "================================================================"
+
+node allowlist-patch.cjs
+
+exec node --enable-source-maps index.ts
+EOF
+chmod +x /usr/local/bin/entrypoint.sh
+ENTRY
+
+# Data directory (SQLite + blobs). Enable persistent storage in the Space
+# settings to keep it across restarts.
+RUN mkdir -p /app/data \
+  && chown -R 1000:1000 /app \
+  && chown 1000:1000 /usr/local/bin/entrypoint.sh
+
+# HF Spaces runs containers as uid 1000; the runtime patch needs write access
+# to node_modules, hence the chown above.
+USER 1000
+
+ENV PDS_DATA_DIRECTORY=/app/data
+
+# HF Spaces route to port 7860
+ENV PDS_PORT=7860
+
+# Registration allowlist (comma-separated domains). The email domain check is
+# the only registration gate - no invite codes, no SMTP verification.
+ENV PDS_EMAIL_ALLOWED_DOMAINS=rochesterschools.org
+ENV PDS_INVITE_REQUIRED=false
+ENV PDS_EMAIL_SMTP_URL=
+ENV PDS_EMAIL_FROM_ADDRESS=
+# Skip email confirmation flow entirely (no SMTP on HF)
+ENV PDS_EMAIL_DISABLE_CONFIRMATION_LINK=true
+
+# Public hostname. Set this to your Space's public URL (as a Space secret or
+# variable named PDS_HOSTNAME) so the PDS advertises the right endpoint:
+#   https://<owner>-<space>.hf.space
+# Users' handles will be <name>.<that hostname>.
+ENV PDS_HOSTNAME=https://cloudunity-gemma-api1.hf.space
 
 EXPOSE 7860
 
-CMD ["/opt/llama/llama-server", \
-     "--model", "/app/models/LFM2.5-2.6B-QAD-Q4_0.gguf", \
-     "--host", "0.0.0.0", \
-     "--port", "7860", \
-     "--alias", "LFM2.5-2.6B", \
-     "--threads", "2", \
-     "--ctx-size", "32768", \
-     "--cache-type-k", "q8_0", \
-     "--cache-type-v", "q8_0", \
-     "--parallel", "1", \
-     "--cont-batching", \
-     "--flash-attn", "auto"]
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]