compose/ai/Dockerfile

# 1. On récupère la version la plus récente d'UV
FROM ghcr.io/astral-sh/uv:latest AS uv_source

# 2. Image de base stable
FROM debian:stable-slim

# Disable Python stdout buffering to ensure logs are printed immediately
ENV PYTHONUNBUFFERED=1

# Install system dependencies in one layer, clear APT cache
# tini reaps orphaned zombie processes (MCP stdio subprocesses, git, bun, etc.)
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        build-essential python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
        curl poppler-utils imagemagick \
        texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \
        qemu-user-static binfmt-support qemu-user-binfmt \
        emacs-nox \
        libportaudio2 && \
    rm -rf /var/lib/apt/lists/*

# Création de l'utilisateur 'hermes' directement avec les bons accès
RUN useradd -u 10000 -m -d /opt/data hermes

# Copie d'uv (dernière version)
COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/

WORKDIR /opt/hermes

# On donne la propriété du dossier de travail à l'utilisateur hermes
RUN chown hermes:hermes /opt/hermes

# ---------- Hermes venv ----------
# Passer immédiatement sous l'utilisateur hermes pour tout le reste du build
USER hermes

# ---------- Source code ----------
# On copie tout le projet d'un coup sans assumer la présence de fichiers de lock spécifiques
COPY --chown=hermes:hermes . .

# ---------- Python virtualenv ----------
RUN uv venv && \
    uv pip install --no-cache-dir sounddevice numpy faster-whisper

# ---------- Patch tts_tool.py to add Coqui provider ----------
RUN /opt/hermes/.venv/bin/python3 -c "
tts_path = '/opt/hermes/.venv/lib/python3.13/site-packages/tools/tts_tool.py'
with open(tts_path) as f:
    code = f.read()
coqui_block = '''
        elif provider == \"coqui\":
            logger.info(\"Generating speech with Coqui TTS (GPU, local)...\")
            import subprocess
            coqui_python = \"/opt/coqui-tts/bin/python3\"
            coqui_script = \"/opt/coqui-tts/bin/coqui_synth.py\"
            coqui_config = tts_config.get(\"coqui\", {})
            model = coqui_config.get(\"model\", \"tts_models/en/vctk/vits\")
            use_gpu = coqui_config.get(\"use_gpu\", True)
            speaker = coqui_config.get(\"speaker\", \"\")
            cmd = [
                coqui_python, coqui_script,
                \"--text\", text,
                \"--out\", file_str,
                \"--model\", model,
            ]
            if use_gpu:
                cmd.append(\"--gpu\")
            if speaker:
                cmd.extend([\"--speaker\", speaker])
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
            if result.returncode != 0:
                stderr = result.stderr.strip()
                raise RuntimeError(f\"Coqui TTS failed: {stderr or 'unknown error'}\")
            logger.info(\"Coqui TTS audio saved: %s\", file_str)
'''
code = code.replace(
    '        else:\n            # Default: Edge TTS (free), with NeuTTS as local fallback',
    coqui_block + '        else:\n            # Default: Edge TTS (free), with NeuTTS as local fallback'
)
with open(tts_path, 'w') as f:
    f.write(code)
"

# ---------- Runtime ----------
ENV HERMES_HOME=/opt/data
ENV PATH="/opt/data/.local/bin:${PATH}"

VOLUME [ "/opt/data" ]

# Le conteneur tourne de manière ultra-sécurisée sous l'utilisateur hermes dès le départ
ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/docker/entrypoint.sh" ]