# syntax=docker/dockerfile:1

# WeChat-AI (iLink + Redis + LINUX DO OAuth)

#

# Prefer host wrappers (bump + OTA pack + docker):

# pnpm docker:build -- -- docker build -t your-dockerhub-user/wechat-ai:latest .

# pnpm docker:up

# Publish channel: /admin → 上传通道包 (dist/release/<ver>/files.json)

# Plain `docker build` does NOT bump or pack.

#

# 必填环境变量见 .env.example / docs/docker.md

FROM node:22-bookworm-slim

LABEL org.opencontainers.image.title="wechat-ai" \

org.opencontainers.image.description="WeChat roleplay bots via iLink, Redis, LINUX DO OAuth"

# Keep corepack/pnpm under /pnpm so the non-root runtime user can use them

# without writing to /home/appuser/.cache (which caused EACCES).

ENV PNPM_HOME=/pnpm \

COREPACK_HOME=/pnpm/corepack \

PATH=/pnpm:$PATH \

NODE_ENV=production \

WECHAT_AI_HOST=0.0.0.0 \

WECHAT_AI_PORT=8787 \

COREPACK_ENABLE_DOWNLOAD_PROMPT=0

RUN corepack enable \

&& corepack prepare pnpm@11.15.0 --activate \

&& apt-get update \

&& apt-get install -y --no-install-recommends ca-certificates \

&& rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Install deps first (better layer cache)

COPY package.json pnpm-workspace.yaml pnpm-lock.yaml tsconfig.base.json ./

COPY apps/api/package.json ./apps/api/

COPY packages/core/package.json ./packages/core/

COPY packages/db/package.json ./packages/db/

COPY packages/ilink/package.json ./packages/ilink/

COPY packages/llm/package.json ./packages/llm/

# tsx is a runtime dependency of @wechat-ai/api; install all workspace packages

RUN pnpm install --frozen-lockfile

# Application source (TypeScript run via tsx)

COPY apps/api ./apps/api

COPY packages ./packages

COPY scripts ./scripts

# Non-root user + writable home for tools

RUN mkdir -p /home/appuser \

&& groupadd --system --gid 1001 nodejs \

&& useradd --system --uid 1001 --gid nodejs --home-dir /home/appuser --no-create-home appuser \

&& chown -R appuser:nodejs /app /pnpm /home/appuser

USER appuser

EXPOSE 8787

# scrypt (login + provider-secret KDF) runs on the libuv pool; the default 4

# threads let a login burst queue behind itself.

ENV UV_THREADPOOL_SIZE=16

HEALTHCHECK --interval=30s --timeout=8s --start-period=50s --retries=3 \

CMD node -e "fetch('http://127.0.0.1:'+(process.env.WECHAT_AI_PORT||8787)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

# Run node as PID 1 so SIGTERM reaches the process and the graceful shutdown

# in index.ts actually runs (releasing bot leases). `sh -c` swallowed it, so

# every deploy left up to LEASE_TTL_SEC of bots that no node was polling.

# The separate seed step is gone — index.ts already calls seedPersonas().

# WORKDIR is apps/api because tsx is linked under apps/api/node_modules;

# resolveRepoRoot() still walks up to /app for .env and OTA paths.

WORKDIR /app/apps/api

CMD ["node", "--import", "tsx", "src/index.ts"]