Dockerfile

# syntax=docker/dockerfile:1
# Hugging Face Spaces: sdk: docker, default port 7860 (override with PORT).
# Build from repo root (directory that contains web/ and assets/).

FROM node:20-bookworm-slim AS frontend-build
WORKDIR /app/web/frontend
COPY web/frontend/package.json web/frontend/package-lock.json ./
RUN npm ci
COPY web/frontend/ ./
RUN npm run build

FROM python:3.12-slim-bookworm
WORKDIR /app

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONPATH=/app

RUN apt-get update \
    && apt-get install -y --no-install-recommends ffmpeg \
    && rm -rf /var/lib/apt/lists/*

COPY web/requirements.txt /app/web/requirements.txt
RUN pip install --no-cache-dir -r /app/web/requirements.txt

COPY web /app/web
COPY assets /app/assets

COPY --from=frontend-build /app/web/backend/static /app/web/backend/static

EXPOSE 7860

# Trust reverse-proxy headers (X-Forwarded-Proto). Default allow-list is 127.0.0.1 only;
# HF Spaces sits behind a proxy — without this, the app thinks the request is HTTP and
# session cookies often fail, so login loops.
CMD ["sh", "-c", "exec uvicorn web.backend.main:app --host 0.0.0.0 --port ${PORT:-7860} --forwarded-allow-ips='*'"]