# ============================================================================
# Wolf Host — Hugging Face Space (Docker SDK)
# ----------------------------------------------------------------------------
# The heavy half of the panel: processes, pip installs, file manager, console.
# It is NOT the public entry point. Every request reaches it through the
# Cloudflare gateway (wolf-gateway) with an HMAC signature, so the Space URL
# being public does not expose the panel.
#
# Port 7860 is the port HF Spaces expect a Docker Space to listen on, and it is
# also the port the platform's startup probe uses.
# ============================================================================
FROM python:3.11-slim-bookworm

LABEL maintainer="White Wolf <https://t.me/j49_c>"
LABEL description="Wolf Host panel backend (Docker Space, behind the Cloudflare gateway)"

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    SERVER_PORT=7860 \
    ALLOW_REGISTRATION=0 \
    PANEL_SYNC_EVERY=60 \
    TMPDIR=/tmp

WORKDIR /app

# ---- build deps kept separate so the runtime layer stays small -------------
RUN apt-get update \
    && apt-get install -y --no-install-recommends gcc libffi-dev \
       php-cli php-mbstring php-xml php-curl php-zip php-sqlite3 \
       php-intl php-bcmath php-gd php-opcache \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# ---- application -----------------------------------------------------------
COPY app.py gwclient.py gunicorn.conf.py ./
COPY proxy/ ./proxy/
COPY index.html login.html admin.html create.html docs.html logo.png ./

# Runtime data (restored from D1 on every boot by gw_reconcile()).
RUN mkdir -p /app/DATA /app/USERS && chmod -R 777 /app/DATA /app/USERS

EXPOSE 7860

# Secrets (GATEWAY_URL, PANEL_SERVICE_SECRET) are set in the Space settings —
# never in this file, never in the image layers.
# Bounded WSGI server instead of the Flask dev server (which spawned one
# thread per connection and exhausted the container's thread limit).
CMD ["gunicorn", "-c", "gunicorn.conf.py", "app:app"]