Upload 18 files

Dockerfile

@@ -4,6 +4,7 @@ RUN apt-get update \
     && apt-get install -y --no-install-recommends \
        ca-certificates \
        fonts-dejavu-core \
+       gosu \
        python3 \
        python3-pil \
        tini \
@@ -12,17 +13,21 @@ RUN apt-get update \
 WORKDIR /app
 COPY --chown=node:node . /app
 
-RUN mkdir -p /data/logs /data/dispatcher-data/generated \
+RUN chmod 755 /app/docker-entrypoint.sh \
+    && mkdir -p /data/logs /data/dispatcher-data/generated \
     && chown -R node:node /app /data
 
 ENV NODE_ENV=production \
+    NODE_OPTIONS=--dns-result-order=ipv4first \
     PORT=7860 \
     DATA_DIR=/data \
     TIMEZONE=Africa/Casablanca \
     COUNTRY_CODE=MAR
 
-USER node
+# The entrypoint starts as root only long enough to update resolv.conf,
+# then immediately drops privileges to the node user with gosu.
+USER root
 EXPOSE 7860
 
-ENTRYPOINT ["/usr/bin/tini", "--"]
+ENTRYPOINT ["/usr/bin/tini", "--", "/app/docker-entrypoint.sh"]
 CMD ["node", "app.js"]

README.md

@@ -106,3 +106,20 @@ curl -X POST \
 The first live poll creates a score baseline. Generic goal alerts begin with the next score change. If the first poll happens during half-time or after full-time, the corresponding HT or FT post can still be sent.
 
 Set `SCHEDULE_ONLY_MODE=false` only to restore the old per-match detailed watchers. That mode may remain stuck when FotMob requests browser verification.
+
+## Hugging Face Facebook DNS workaround
+
+This build starts as root only long enough to replace `/etc/resolv.conf` with Cloudflare and Google public DNS, runs DNS/HTTPS diagnostics for `graph.facebook.com`, and then starts the app as the unprivileged `node` user.
+
+Expected startup diagnostics:
+
+```text
+== DNS after ==
+nameserver 1.1.1.1
+nameserver 8.8.8.8
+...
+== Facebook HTTPS test ==
+Facebook HTTPS reachable: HTTP 400
+```
+
+Any HTTP status proves that the TCP/TLS connection reached Facebook. A timeout means the selected route is still inaccessible.

docker-entrypoint.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+set -eu
+
+echo "== DNS before =="
+cat /etc/resolv.conf || true
+
+# Hugging Face's resolver can return an unreachable Facebook edge.
+# Prefer public resolvers when the platform permits replacing resolv.conf.
+if [ -w /etc/resolv.conf ]; then
+  printf '%s\n' \
+    'nameserver 1.1.1.1' \
+    'nameserver 8.8.8.8' \
+    'options timeout:2 attempts:2 rotate' > /etc/resolv.conf || true
+else
+  echo "Warning: /etc/resolv.conf is not writable; keeping platform DNS."
+fi
+
+echo "== DNS after =="
+cat /etc/resolv.conf || true
+
+echo "== Facebook DNS test =="
+getent ahostsv4 graph.facebook.com || true
+
+echo "== Facebook HTTPS test =="
+node -e '
+const signal = AbortSignal.timeout(10000);
+fetch("https://graph.facebook.com/", { signal })
+  .then((response) => console.log(`Facebook HTTPS reachable: HTTP ${response.status}`))
+  .catch((error) => {
+    const detail = error?.cause?.message || error?.message || String(error);
+    console.log(`Facebook HTTPS test failed: ${detail}`);
+  });
+' || true
+
+# Start the application as the unprivileged node user.
+exec gosu node "$@"

strip-metadata.py

@@ -17,4 +17,4 @@ def main() -> None:
 
 
 if __name__ == "__main__":
-    main()
+    main()