# syntax=docker/dockerfile:1

# qwen-gate — OpenAI-compatible Qwen API gateway with browser-based auth.
#
# Runs via tsx rather than a compiled dist/: the dashboard serves its static
# assets from src/routes/dashboard/public and reads src/models.json at runtime,
# and tsx relies on tsconfig.json for the hono/jsx runtime — so the source tree
# ships in the image.
#
# Debian (glibc) base is required: cloakbrowser downloads a patched, glibc-based
# stealth Chromium — it will not run on Alpine/musl.
FROM node:22-bookworm-slim

# Shared-library + font runtime dependencies for cloakbrowser's stealth Chromium.
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates wget fonts-liberation fonts-noto-color-emoji \
      libnss3 libnspr4 libdbus-1-3 libatk1.0-0 libatk-bridge2.0-0 libcups2 \
      libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
      libgbm1 libpango-1.0-0 libcairo2 libasound2 libatspi2.0-0 libx11-6 \
      libxcb1 libxext6 libxi6 libxtst6 libglib2.0-0 libxshmfence1 libvulkan1 \
      xdg-utils \
  && rm -rf /var/lib/apt/lists/*

# Cache the patched Chromium at a fixed path and bake it into the image (NOT a
# volume), so the container never downloads ~150 MB on first request.
ENV CLOAKBROWSER_CACHE_DIR=/home/node/.cloakbrowser

WORKDIR /app

# Install production deps first for layer caching.
# --ignore-scripts skips the interactive setup postinstall and Playwright's
# unused browser download; cloakbrowser's Chromium is fetched explicitly below.
COPY package.json package-lock.json ./
RUN npm ci --omit=dev --ignore-scripts

# Pre-download the stealth Chromium into the image cache.
RUN npx cloakbrowser install

# Application source (dashboard assets + models.json + tsconfig read at runtime).
COPY . .

# Bind to all interfaces inside the container; run unprivileged.
ENV HOST=0.0.0.0 \
    PORT=26405 \
    NODE_ENV=production

# Pre-create the persisted dirs owned by node so named volumes inherit node
# ownership (Docker seeds an empty named volume from the image path + perms).
RUN mkdir -p /app/.qwen /app/logs \
 && chown -R node:node /app /home/node/.cloakbrowser
USER node

EXPOSE 26405

# Login state (accounts.json + browser profiles) and logs.
VOLUME ["/app/.qwen", "/app/logs"]

CMD ["node", "--import", "tsx", "src/index.tsx"]
