# ============================================================================
# Shrinkerr — portable, multi-arch, CPU-encoding image.
#
# Runs on:
#   - linux/amd64  (x86_64 servers, Docker Desktop on Intel/AMD, etc.)
#   - linux/arm64  (Apple Silicon, Raspberry Pi 5, Ampere cloud hosts, …)
#
# Encoding: libx265 on the CPU. This image contains NO CUDA runtime — it's
# deliberately small and portable. If your host has an NVIDIA GPU and you
# want NVENC (hardware) encoding, pull the companion image instead:
#   ghcr.io/<owner>/shrinkerr:nvenc     (built from Dockerfile.nvenc)
# Shrinkerr's runtime capability detection transparently falls back to
# libx265 in this image; the Monitor page shows "Using CPU encoding".
# ============================================================================

# Stage 1: build the frontend bundle.
# Pinning --platform=$BUILDPLATFORM makes sure buildx does the npm step on
# the native architecture of the builder host (the runner, not the target),
# so cross-compilation for arm64 doesn't re-run npm inside QEMU. The output
# is pure JS/CSS, so it's portable across target architectures.
FROM --platform=$BUILDPLATFORM mirror.gcr.io/library/node:20-slim AS frontend-build
WORKDIR /app/frontend
COPY frontend/package.json frontend/package-lock.json* ./
RUN npm ci
COPY frontend/ ./
RUN npm run build

# Stage 2: runtime image.
# python:3.11-slim-bookworm is multi-arch (amd64 + arm64) and much smaller
# than the ubuntu/CUDA image used by the :nvenc variant.
#
# v0.7.4: pulled from Google's mirror.gcr.io instead of docker.io to avoid
# Docker Hub anonymous + authenticated pull rate limits (200/6h on free)
# from cooking the CI matrix (4 variants × 2 archs × multi-stage). The
# mirror is a byte-for-byte proxy of Docker Hub's `library/*` namespace,
# requires no auth, and has no rate limit. Same applies to the node:20-slim
# pull in stage 1 above, and to Dockerfile.nvenc.
FROM mirror.gcr.io/library/python:3.11-slim-bookworm
ARG TARGETARCH

# curl + xz-utils only needed for the ffmpeg download step below; purged at
# the end of that step so they don't bloat the final image layer.
#
# VA-API runtime libraries (~30 MB total) let ffmpeg's hevc_qsv (Intel
# Quick Sync) and hevc_vaapi (Intel + AMD generic VA-API) actually run
# when the host passes /dev/dri through. Harmless on hosts without an
# Intel/AMD GPU — ffmpeg simply doesn't surface those encoders. v0.3.67+.
#
# Cross-arch note (v0.3.71): the Intel iHD + i965 drivers are AMD64-only
# in Debian (Intel iGPUs don't exist on ARM, and there's no upstream arm64
# build of `intel-media-va-driver-non-free`). Without this gate the v0.3.67
# build broke the multi-arch publish for several releases — the arm64 leg
# failed with `Unable to locate package intel-media-va-driver-non-free`.
# The arm64 leg keeps the arch-agnostic packages (libva, mesa-va-drivers,
# vainfo) which are still useful for AMD GPUs reachable on arm64 hosts
# (rare but not impossible — Ampere + Radeon, Pi + USB-C eGPU, etc.).
#
#   libva2 + libva-drm2            → core VA-API runtime (multi-arch)
#   mesa-va-drivers                → AMD radeonsi (multi-arch)
#   vainfo                         → diagnostic (multi-arch)
#   intel-media-va-driver-non-free → Intel iHD (Gen9+: Skylake / Arc) — AMD64 ONLY
#   i965-va-driver                 → Intel legacy (Gen8 and older) — AMD64 ONLY
#
# `intel-media-va-driver-non-free` lives in Debian's `non-free` component;
# enabled below before the conditional install. Source-open driver,
# "non-free" naming is historical from when it shipped as a binary blob.
RUN set -eux; \
    apt-get update; \
    # v0.5.13: pull latest security patches at build time. Halves the
    # High/Medium CVE count Docker Scout reports without changing the
    # base image. Cheap and low-risk — security updates are minor
    # bumps within the bookworm release line.
    apt-get upgrade -y --no-install-recommends; \
    apt-get install -y --no-install-recommends curl xz-utils libarchive-tools libbluray-bin mkvtoolnix \
        tesseract-ocr tesseract-ocr-eng tesseract-ocr-chi-sim tesseract-ocr-chi-tra tesseract-ocr-jpn tesseract-ocr-kor tesseract-ocr-rus tesseract-ocr-ara \
        libgl1 libglib2.0-0; \
    if [ "${TARGETARCH}" = "amd64" ]; then \
        # All VA-API packages (runtime libs + Intel iHD + AMD radeonsi +
        # diagnostic) only on amd64. arm64 builds keep the minimal
        # pre-v0.3.67 install since Intel iGPUs are x86-only and AMD
        # GPUs on arm64 hosts are exceptionally rare.
        #
        # Enable non-free + non-free-firmware components by EDITING the
        # existing DEB822 sources file (python:3.11-slim-bookworm uses
        # `/etc/apt/sources.list.d/debian.sources`) rather than dropping
        # a second `.list`. Adding a parallel `bookworm` repo without a
        # `Signed-By:` directive makes apt fail with
        #   E: Conflicting values set for option Signed-By regarding
        #      source http://deb.debian.org/debian/ bookworm:
        #      /usr/share/keyrings/debian-archive-keyring.gpg !=
        # which is what bit v0.3.67 → v0.3.73. The sed targets both the
        # `bookworm` and `bookworm-security` stanzas in the same file
        # (one substitution per Components line). v0.3.74+.
        sed -i 's|^Components: main$|Components: main contrib non-free non-free-firmware|' \
            /etc/apt/sources.list.d/debian.sources; \
        apt-get update; \
        apt-get install -y --no-install-recommends \
            libva-drm2 \
            mesa-va-drivers \
            vainfo \
            intel-media-va-driver-non-free \
            i965-va-driver \
            libvpl2 libmfx1 \
            build-essential cmake meson ninja-build pkg-config \
            libdrm-dev libigdgmm-dev libpciaccess-dev bzip2; \
            # libvpl2: Intel oneVPL dispatcher. libmfx1: legacy MediaSDK
            # runtime — kept as a fallback for older HW; the modern
            # libmfx-gen runtime built below takes precedence on Gen9+.
            # build-essential + cmake + meson + ninja + dev headers:
            # temporarily installed for the libva and vpl-gpu-rt builds
            # below. Purged at the end of the layer.
        #
        # === libva 2.22 from source (v0.3.88+) ============================
        #
        # The BtbN n7.x ffmpeg static builds are compiled against
        # libva ≥ 2.20 (which introduced `vaMapBuffer2`). Debian
        # bookworm ships libva 2.17 even via backports — every apt-
        # installable libva on bookworm is too old, and the runtime
        # symbol lookup for `vaMapBuffer2` fails the first time
        # hevc_vaapi tries to encode. We replace the system libva with
        # an upstream 2.22.x build. libva 2.x is ABI-stable, so the
        # iHD / i965 / mesa drivers (compiled against 2.17) continue
        # to work against 2.22 without rebuilding. ~30s build.
        LIBVA_VER=2.22.0; \
        curl -fsSL "https://github.com/intel/libva/releases/download/${LIBVA_VER}/libva-${LIBVA_VER}.tar.bz2" -o /tmp/libva.tar.bz2; \
        mkdir -p /tmp/libva-src; \
        tar xjf /tmp/libva.tar.bz2 -C /tmp/libva-src --strip-components=1; \
        cd /tmp/libva-src; \
        meson setup build --prefix=/usr -Dlibdir=lib/x86_64-linux-gnu --buildtype=release; \
        ninja -C build install; \
        cd /; rm -rf /tmp/libva-src /tmp/libva.tar.bz2; \
        ldconfig; \
        #
        # === vpl-gpu-rt (libmfx-gen) from source (v0.3.89+) ===============
        #
        # Intel's modern oneVPL GPU runtime — what Sonarr/Radarr-tier
        # users on current Ubuntu/Arch get from `libmfx-gen1` package.
        # Not packaged for Debian 12 or Ubuntu 22.04. Without this,
        # libvpl2 (dispatcher) falls back to legacy libmfx1, which
        # rejects libva-2.22 VADisplays with `MFX_ERR_INCOMPATIBLE_-
        # VIDEO_PARAM (-17)` — that's what bit users testing v0.3.84
        # → v0.3.88. With libmfx-gen.so.1.2 installed, the dispatcher
        # finds the modern runtime first and QSV works against modern
        # libva + iHD drivers. ~3 min build on x86_64.
        VPL_VER=24.4.4; \
        curl -fsSL "https://github.com/intel/vpl-gpu-rt/archive/refs/tags/intel-onevpl-${VPL_VER}.tar.gz" -o /tmp/vpl.tar.gz; \
        mkdir -p /tmp/vpl-src; \
        tar xzf /tmp/vpl.tar.gz -C /tmp/vpl-src --strip-components=1; \
        cd /tmp/vpl-src; \
        # Memory-conservative configure (v0.3.92+). The default
        # `cmake --build --parallel` uses every core, and a
        # multi-arch buildx build runs both leg's compile/link
        # steps concurrently — easy way to exceed 7 GB on GHA
        # free runners and OOM-kill the runner mid-link
        # (lost-communication errors at the mfx_common_hw stage).
        # Mitigations:
        #   MinSizeRel + IPO=OFF  → smaller object files, less
        #                           template-instantiation RAM
        #   BUILD_TESTS=OFF       → skip test-suite compilation
        #   --parallel 1          → serialize compile + link;
        #                           slower (~10 min vs ~5 min)
        #                           but stays under the budget
        cmake -B build \
            -DCMAKE_BUILD_TYPE=MinSizeRel \
            -DCMAKE_INSTALL_PREFIX=/usr \
            -DCMAKE_INSTALL_LIBDIR=lib/x86_64-linux-gnu \
            -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=OFF \
            -DBUILD_TESTS=OFF; \
        cmake --build build --parallel 1; \
        cmake --install build; \
        cd /; rm -rf /tmp/vpl-src /tmp/vpl.tar.gz; \
        ldconfig; \
        #
        # Purge build toolchain — keep the image lean. The runtime libs
        # (libva-drm2, mesa-va-drivers, libvpl2, libmfx1, …) stay
        # because they were explicitly installed above; apt sees them as
        # user-installed and won't auto-remove them.
        apt-get purge -y build-essential cmake meson ninja-build pkg-config libdrm-dev libigdgmm-dev libpciaccess-dev bzip2; \
        apt-get autoremove -y; \
        #
        # === Intel media driver 25.2.4 (v0.9.160) ==========================
        #
        # Bookworm's iHD driver (23.1) is too old for Arc / Flex cards (DG2,
        # ATS-M): vaInitialize fails with "iHD_drv_video.so init failed"
        # (GitHub issue, Flex 170). Intel's own build from its Ubuntu 22.04
        # repo needs only glibc 2.34, runs on bookworm, is built for libva
        # 2.22 (the one above) and supports Broadwell through Battlemage.
        # Pinned by version and hash; it replaces bookworm's driver + gmmlib.
        INTEL_POOL=https://repositories.intel.com/gpu/ubuntu/pool/unified/i; \
        curl -fsSL --retry 5 --retry-delay 3 -o /tmp/libigdgmm12.deb "${INTEL_POOL}/intel-gmmlib/libigdgmm12_22.7.2-1135~22.04_amd64.deb"; \
        curl -fsSL --retry 5 --retry-delay 3 -o /tmp/intel-media.deb "${INTEL_POOL}/intel-media-driver-non-free/intel-media-va-driver-non-free_25.2.4-1146~22.04_amd64.deb"; \
        printf '%s  %s\n' \
            c8b3dfbc044735e9502fd4b8e9560f9118afd49755f8caa4d173b0a84044638d /tmp/libigdgmm12.deb \
            fa22334f9431985f2b09748c365e61f54ff7b9b2a01a9c6d1cf24c1075a315fc /tmp/intel-media.deb \
            | sha256sum -c -; \
        apt-get install -y --no-install-recommends /tmp/libigdgmm12.deb /tmp/intel-media.deb; \
        rm -f /tmp/libigdgmm12.deb /tmp/intel-media.deb; \
    else \
        echo "Skipping VA-API runtime on ${TARGETARCH} (amd64-only in this image)"; \
    fi; \
    rm -rf /var/lib/apt/lists/*

# Install ffmpeg static build from BtbN (includes libx265, libvmaf, x264).
# BtbN publishes per-architecture assets under the rolling `latest` release;
# asset filenames differ between master and tagged (nX.Y) releases.
#   master: ffmpeg-master-latest-{linux64,linuxarm64}-gpl.tar.xz
#   nX.Y:   ffmpeg-nX.Y-latest-{linux64,linuxarm64}-gpl-X.Y.tar.xz
ARG FFMPEG_BUILD=n7.1
RUN set -e; \
    case "${TARGETARCH}" in \
        amd64) ARCH_TAG="linux64" ;; \
        arm64) ARCH_TAG="linuxarm64" ;; \
        *)     echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 2 ;; \
    esac; \
    case "${FFMPEG_BUILD}" in \
        master) FF_URL="https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-${ARCH_TAG}-gpl.tar.xz" ;; \
        n*)     FF_VER="${FFMPEG_BUILD#n}"; \
                FF_URL="https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-${FFMPEG_BUILD}-latest-${ARCH_TAG}-gpl-${FF_VER}.tar.xz" ;; \
        *)      echo "Unknown FFMPEG_BUILD: ${FFMPEG_BUILD} (expected 'master' or 'nX.Y')" >&2; exit 2 ;; \
    esac; \
    echo "Installing ffmpeg ${FFMPEG_BUILD} for ${TARGETARCH}: ${FF_URL}"; \
    # v0.9.105: download to a file with retries, THEN extract. Piping curl
    # straight into tar can't retry a mid-stream cut (tar has already consumed
    # a partial stream) — that flaked the arm64 leg under slow QEMU emulation.
    curl -fsSL --retry 5 --retry-delay 3 --retry-all-errors "${FF_URL}" -o /tmp/ffmpeg.tar.xz; \
    tar -xJf /tmp/ffmpeg.tar.xz --strip-components=2 -C /usr/local/bin/ --wildcards '*/bin/ffmpeg' '*/bin/ffprobe'; \
    rm -f /tmp/ffmpeg.tar.xz; \
    chmod +x /usr/local/bin/ffmpeg /usr/local/bin/ffprobe; \
    apt-get purge -y curl xz-utils && apt-get autoremove -y; \
    rm -rf /var/lib/apt/lists/*; \
    echo "ffmpeg installed:"; ffmpeg -version 2>&1 | head -1; \
    echo "VMAF filter:"; (ffmpeg -filters 2>&1 | grep libvmaf || echo "NOT FOUND")

# Record lineage so the running backend's Monitor page knows exactly which
# ffmpeg build the image shipped with.
ENV SHRINKERR_FFMPEG_BUILD=${FFMPEG_BUILD}
# This image has no CUDA runtime, so NVENC is structurally unavailable.
# Backend detection (backend/nodes.py) will notice no NVIDIA GPU + no
# nvidia-smi and advertise only libx265. Flag it here too so the UI can
# explain "this image is CPU-only by design" rather than "your driver's
# too old" to users pulling :latest without realising :nvenc exists.
ENV SHRINKERR_CPU_ONLY_IMAGE=1

WORKDIR /app

COPY requirements.txt .
RUN pip3 install --no-cache-dir -r requirements.txt

COPY backend/ backend/
COPY VERSION .
# CHANGELOG is read at runtime by /api/stats/changelog so the Updates
# section in Settings can show release notes without a network call.
COPY CHANGELOG.md .
COPY --from=frontend-build /app/frontend/dist frontend/dist

RUN mkdir -p /app/data

EXPOSE 6680

# Bundled TMDB non-commercial API key — passed in at build time from the
# TMDB_API_KEY GitHub Actions secret so the image ships with a working
# default. User-saved keys in Settings always win (see
# backend/metadata.py::resolve_tmdb_key). Builds without the secret set
# leave this empty and behave as before.
ARG TMDB_API_KEY=""
ENV SHRINKERR_TMDB_API_KEY=${TMDB_API_KEY}

HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
  CMD python3 -c "import urllib.request; urllib.request.urlopen('http://localhost:6680/api/health')" || exit 1

# SHRINKERR_MODE=worker → run as a remote worker node (no server, no UI).
# Default → run the FastAPI server + UI.
CMD ["python3", "-m", "backend.main"]