Dockerfile.app.local

# syntax=docker/dockerfile:1
# 运行镜像：从 base 提取产物到精简运行时（国内镜像源版本）
# 构建命令: docker build -f Dockerfile.app.local -t aether-app:latest .
# 用于本地/国内服务器部署

FROM aether-base:latest AS builder

WORKDIR /app

# 复制前端源码并构建
COPY frontend/ ./frontend/
RUN cd frontend && npm run build

# ==================== 运行时镜像 ====================
FROM python:3.13-slim

WORKDIR /app

ARG HUB_RELEASE_REPO=fawney19/Aether
ARG HUB_TAG
ARG TARGETARCH
ARG GITHUB_TOKEN
# GitHub 下载镜像前缀，国内构建时传入可用的镜像加速地址
# 用法: --build-arg GITHUB_MIRROR=https://ghfast.top
#   或: --build-arg GITHUB_MIRROR=https://gh-proxy.com
#   或: --build-arg GITHUB_MIRROR=https://mirror.ghproxy.com
ARG GITHUB_MIRROR

# 运行时依赖（使用清华镜像源 + BuildKit 缓存加速）
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    sed -i 's/deb.debian.org/mirrors.tuna.tsinghua.edu.cn/g' /etc/apt/sources.list.d/debian.sources && \
    apt-get update && apt-get install -y --no-install-recommends \
    nginx \
    supervisor \
    libpq5 \
    curl \
    libjemalloc2
RUN set -eux; \
    jemalloc_path="$(find /usr/lib -type f -name 'libjemalloc.so.2' | head -n1)"; \
    [ -n "$jemalloc_path" ]; \
    ln -sf "$jemalloc_path" /usr/local/lib/libjemalloc.so.2

# 从 base 镜像复制 Python 包
COPY --from=builder /usr/local/lib/python3.13/site-packages /usr/local/lib/python3.13/site-packages

# 只复制需要的 Python 可执行文件
COPY --from=builder /usr/local/bin/gunicorn /usr/local/bin/
COPY --from=builder /usr/local/bin/uvicorn /usr/local/bin/
COPY --from=builder /usr/local/bin/alembic /usr/local/bin/

# Hub 预编译二进制
# 国内构建: --build-arg GITHUB_MIRROR=https://ghfast.top 即可走镜像下载
# GITHUB_TOKEN 可选：未认证 API 限流 60 次/小时，认证后 5000 次/小时
RUN set -eux; \
    arch="${TARGETARCH:-}"; \
    if [ -z "$arch" ]; then \
        arch="$(dpkg --print-architecture)"; \
    fi; \
    case "$arch" in \
        amd64|arm64) ;; \
        x86_64) arch="amd64" ;; \
        aarch64) arch="arm64" ;; \
        *) echo "Unsupported architecture: $arch"; exit 1 ;; \
    esac; \
    auth_header=""; \
    if [ -n "${GITHUB_TOKEN:-}" ]; then \
        auth_header="Authorization: token ${GITHUB_TOKEN}"; \
    fi; \
    tag="${HUB_TAG:-}"; \
    if [ -z "$tag" ]; then \
        tag="$(curl -sL ${auth_header:+-H "$auth_header"} "https://api.github.com/repos/${HUB_RELEASE_REPO}/releases" | python3 -c "import json,sys;print(next((r['tag_name'] for r in json.load(sys.stdin) if r.get('tag_name','').startswith('hub-v') and not r.get('draft') and not r.get('prerelease')),''))")"; \
    fi; \
    if [ -z "$tag" ]; then \
        echo "Failed to resolve hub release tag"; \
        exit 1; \
    fi; \
    echo "Using Hub release tag: $tag"; \
    origin_url="https://github.com/${HUB_RELEASE_REPO}/releases/download/${tag}/aether-hub-linux-${arch}.tar.gz"; \
    if [ -n "${GITHUB_MIRROR:-}" ]; then \
        url="${GITHUB_MIRROR}/https://github.com/${HUB_RELEASE_REPO}/releases/download/${tag}/aether-hub-linux-${arch}.tar.gz"; \
        echo "Using mirror: ${GITHUB_MIRROR}"; \
    else \
        url="$origin_url"; \
    fi; \
    curl -L --fail -o /tmp/aether-hub.tar.gz "$url"; \
    tar xzf /tmp/aether-hub.tar.gz -C /usr/local/bin; \
    chmod +x /usr/local/bin/aether-hub; \
    rm -f /tmp/aether-hub.tar.gz

# 从 builder 阶段复制前端构建产物
COPY --from=builder /app/frontend/dist /usr/share/nginx/html
RUN chmod -R 755 /usr/share/nginx/html

# 复制后端代码
COPY src/ ./src/
COPY alembic.ini ./
COPY alembic/ ./alembic/
COPY gunicorn_conf.py ./

# Nginx 配置模板
# 策略：白名单后端路由 → 后端代理，其余全部 → 前端 SPA（index.html）
# 智能处理 IP：有外层代理头就透传，没有就用直连 IP
RUN printf '%s\n' \
    'map $http_x_real_ip $real_ip {' \
    '    default $http_x_real_ip;' \
    '    ""      $remote_addr;' \
    '}' \
    '' \
    'map $http_x_forwarded_for $forwarded_for {' \
    '    default $http_x_forwarded_for;' \
    '    ""      $remote_addr;' \
    '}' \
    '' \
    'server {' \
    '    listen 80;' \
    '    server_name _;' \
    '    root /usr/share/nginx/html;' \
    '    index index.html;' \
    '    client_max_body_size 100M;' \
    '' \
    '    # gzip 压缩配置（对 base64 图片等非流式响应有效）' \
    '    gzip on;' \
    '    gzip_min_length 256;' \
    '    gzip_comp_level 5;' \
    '    gzip_vary on;' \
    '    gzip_proxied any;' \
    '    gzip_types application/json text/plain text/css text/javascript application/javascript application/octet-stream;' \
    '    gzip_disable "msie6";' \
    '' \
    '    # 静态资源：长期缓存' \
    '    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {' \
    '        expires 1y;' \
    '        add_header Cache-Control "public, no-transform";' \
    '        try_files $uri =404;' \
    '    }' \
    '' \
    '    # 安全：阻止访问源码目录' \
    '    location ~ ^/(src|node_modules)/ {' \
    '        deny all;' \
    '        return 404;' \
    '    }' \
    '' \
    '    # WebSocket 隧道端点（aether-proxy tunnel 模式）' \
    '    location = /api/internal/proxy-tunnel {' \
    '        proxy_pass http://127.0.0.1:8085/proxy;' \
    '        proxy_http_version 1.1;' \
    '        proxy_set_header Host $host;' \
    '        proxy_set_header X-Real-IP $real_ip;' \
    '        proxy_set_header X-Forwarded-For $forwarded_for;' \
    '        proxy_set_header X-Forwarded-Proto $scheme;' \
    '        proxy_set_header Upgrade $http_upgrade;' \
    '        proxy_set_header Connection "upgrade";' \
    '        # 剥离 CF 头，防止泄露给上游或返回给客户端' \
    '        proxy_hide_header CF-Connecting-IP;' \
    '        proxy_hide_header CF-IPCountry;' \
    '        proxy_hide_header CF-Ray;' \
    '        proxy_hide_header CF-Visitor;' \
    '        proxy_hide_header CDN-Loop;' \
    '        proxy_hide_header True-Client-IP;' \
    '        proxy_hide_header CF-Worker;' \
    '        proxy_hide_header CF-EW-Via;' \
    '        proxy_hide_header CF-Warp-Tag-ID;' \
    '        proxy_set_header CF-Connecting-IP "";' \
    '        proxy_set_header CF-IPCountry "";' \
    '        proxy_set_header CF-Ray "";' \
    '        proxy_set_header CF-Visitor "";' \
    '        proxy_set_header CDN-Loop "";' \
    '        proxy_set_header True-Client-IP "";' \
    '        proxy_set_header CF-Worker "";' \
    '        proxy_set_header CF-EW-Via "";' \
    '        proxy_set_header CF-Warp-Tag-ID "";' \
    '        proxy_read_timeout 86400s;' \
    '        proxy_send_timeout 86400s;' \
    '    }' \
    '' \
    '    # 后端 API 路由（白名单）→ 代理到后端' \
    '    location ~ ^/(api|v1|v1beta|upload|health)(/|$) {' \
    '        proxy_pass http://127.0.0.1:PORT_PLACEHOLDER;' \
    '        proxy_http_version 1.1;' \
    '        proxy_set_header Host $host;' \
    '        proxy_set_header X-Real-IP $real_ip;' \
    '        proxy_set_header X-Forwarded-For $forwarded_for;' \
    '        proxy_set_header X-Forwarded-Proto $scheme;' \
    '        proxy_set_header Connection "";' \
    '        proxy_set_header Accept $http_accept;' \
    '        proxy_set_header Content-Type $content_type;' \
    '        proxy_set_header Authorization $http_authorization;' \
    '        proxy_set_header X-Api-Key $http_x_api_key;' \
    '        # 剥离 CF 头，防止泄露给上游或返回给客户端' \
    '        proxy_hide_header CF-Connecting-IP;' \
    '        proxy_hide_header CF-IPCountry;' \
    '        proxy_hide_header CF-Ray;' \
    '        proxy_hide_header CF-Visitor;' \
    '        proxy_hide_header CDN-Loop;' \
    '        proxy_hide_header True-Client-IP;' \
    '        proxy_hide_header CF-Worker;' \
    '        proxy_hide_header CF-EW-Via;' \
    '        proxy_hide_header CF-Warp-Tag-ID;' \
    '        proxy_set_header CF-Connecting-IP "";' \
    '        proxy_set_header CF-IPCountry "";' \
    '        proxy_set_header CF-Ray "";' \
    '        proxy_set_header CF-Visitor "";' \
    '        proxy_set_header CDN-Loop "";' \
    '        proxy_set_header True-Client-IP "";' \
    '        proxy_set_header CF-Worker "";' \
    '        proxy_set_header CF-EW-Via "";' \
    '        proxy_set_header CF-Warp-Tag-ID "";' \
    '        proxy_buffering off;' \
    '        proxy_cache off;' \
    '        proxy_request_buffering off;' \
    '        chunked_transfer_encoding on;' \
    '        gzip off;' \
    '        add_header X-Accel-Buffering no;' \
    '        proxy_connect_timeout 60s;' \
    '        proxy_send_timeout 3600s;' \
    '        proxy_read_timeout 3600s;' \
    '    }' \
    '' \
    '    # API 文档路由 → 代理到后端' \
    '    location ~ ^/(docs|redoc|openapi\\.json)$ {' \
    '        proxy_pass http://127.0.0.1:PORT_PLACEHOLDER;' \
    '        proxy_http_version 1.1;' \
    '        proxy_set_header Host $host;' \
    '        proxy_set_header X-Real-IP $real_ip;' \
    '        proxy_set_header X-Forwarded-For $forwarded_for;' \
    '        proxy_set_header X-Forwarded-Proto $scheme;' \
    '        # 剥离 CF 头，防止泄露给上游或返回给客户端' \
    '        proxy_hide_header CF-Connecting-IP;' \
    '        proxy_hide_header CF-IPCountry;' \
    '        proxy_hide_header CF-Ray;' \
    '        proxy_hide_header CF-Visitor;' \
    '        proxy_hide_header CDN-Loop;' \
    '        proxy_hide_header True-Client-IP;' \
    '        proxy_hide_header CF-Worker;' \
    '        proxy_hide_header CF-EW-Via;' \
    '        proxy_hide_header CF-Warp-Tag-ID;' \
    '        proxy_set_header CF-Connecting-IP "";' \
    '        proxy_set_header CF-IPCountry "";' \
    '        proxy_set_header CF-Ray "";' \
    '        proxy_set_header CF-Visitor "";' \
    '        proxy_set_header CDN-Loop "";' \
    '        proxy_set_header True-Client-IP "";' \
    '        proxy_set_header CF-Worker "";' \
    '        proxy_set_header CF-EW-Via "";' \
    '        proxy_set_header CF-Warp-Tag-ID "";' \
    '    }' \
    '' \
    '    # 所有其他路由 → 前端 SPA（先尝试静态文件，再回退到 index.html）' \
    '    location / {' \
    '        try_files $uri $uri/ /index.html;' \
    '    }' \
    '}' > /etc/nginx/sites-available/default.template

# Supervisor 配置
RUN printf '%s\n' \
    '[supervisord]' \
    'nodaemon=true' \
    'logfile=/var/log/supervisor/supervisord.log' \
    'pidfile=/var/run/supervisord.pid' \
    '' \
    '[program:nginx]' \
    'command=/bin/bash -c "sed \"s/PORT_PLACEHOLDER/${PORT:-8084}/g\" /etc/nginx/sites-available/default.template > /etc/nginx/sites-available/default && /usr/sbin/nginx -g \"daemon off;\""' \
    'autostart=true' \
    'autorestart=true' \
    'stdout_logfile=/var/log/nginx/access.log' \
    'stderr_logfile=/var/log/nginx/error.log' \
    '' \
    '[program:app]' \
    'command=/bin/bash -c "MAX_REQUESTS_JITTER=$((${MAX_REQUESTS:-50000}/20)); exec gunicorn src.main:app -c gunicorn_conf.py --preload -w %(ENV_GUNICORN_WORKERS)s -k uvicorn.workers.UvicornWorker --bind 0.0.0.0:%(ENV_PORT)s --max-requests ${MAX_REQUESTS:-50000} --max-requests-jitter $MAX_REQUESTS_JITTER --access-logfile - --error-logfile - --log-level info"' \
    'directory=/app' \
    'autostart=true' \
    'autorestart=true' \
    'stdout_logfile=/dev/stdout' \
    'stdout_logfile_maxbytes=0' \
    'stderr_logfile=/dev/stderr' \
    'stderr_logfile_maxbytes=0' \
    'environment=PYTHONUNBUFFERED=1,PYTHONIOENCODING=utf-8,LANG=C.UTF-8,LC_ALL=C.UTF-8,DOCKER_CONTAINER=true,LD_PRELOAD=/usr/local/lib/libjemalloc.so.2,MALLOC_CONF="background_thread:true,dirty_decay_ms:5000,muzzy_decay_ms:5000"' \
    '' \
    '[program:tunnel-hub]' \
    'command=/usr/local/bin/aether-hub --bind 0.0.0.0:8085' \
    'autostart=true' \
    'autorestart=true' \
    'stdout_logfile=/dev/stdout' \
    'stdout_logfile_maxbytes=0' \
    'stderr_logfile=/dev/stderr' \
    'stderr_logfile_maxbytes=0' > /etc/supervisor/conf.d/supervisord.conf

# 创建目录
RUN mkdir -p /var/log/supervisor /app/logs /app/data

# 入口脚本（启动前执行迁移）
COPY entrypoint.sh /entrypoint.sh
RUN sed -i 's/\r$//' /entrypoint.sh && chmod +x /entrypoint.sh

# 环境变量
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONIOENCODING=utf-8 \
    LANG=C.UTF-8 \
    LC_ALL=C.UTF-8 \
    LD_PRELOAD=/usr/local/lib/libjemalloc.so.2 \
    MALLOC_CONF=background_thread:true,dirty_decay_ms:5000,muzzy_decay_ms:5000 \
    PORT=8084 \
    GUNICORN_WORKERS=2 \
    MAX_REQUESTS=4000

EXPOSE 80

HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD curl -f http://localhost/health || exit 1

ENTRYPOINT ["/entrypoint.sh"]
CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]