Dockerfile.demo

# SPDX-FileCopyrightText: © 2025 StreamKit Contributors
#
# SPDX-License-Identifier: MPL-2.0

# Demo image: CPU-only with all core plugins (including Pocket TTS, Supertonic, and Slint) and sample pipelines
# syntax=docker/dockerfile:1

# Stage 1: Build Rust dependencies
FROM rust:1.95-slim-bookworm AS rust-deps

WORKDIR /build

# Install build dependencies (includes all deps needed by workspace plugins)
RUN apt-get update && apt-get install -y \
    pkg-config \
    libssl-dev \
    g++ \
    cmake \
    nasm \
    libopus-dev \
    libvpx-dev \
    libclang-dev \
    clang \
    curl \
    git \
    && rm -rf /var/lib/apt/lists/*

# Copy workspace files to build dependencies (plugins are now excluded)
COPY Cargo.toml Cargo.lock ./
COPY apps ./apps
COPY crates ./crates
COPY sdks ./sdks
COPY wit ./wit

# Create dummy ui/dist directory so server's RustEmbed doesn't fail
# (will be replaced with real UI in Stage 3)
RUN mkdir -p ui/dist && echo '<!DOCTYPE html><html><body>Building...</body></html>' > ui/dist/index.html

# Build dependencies with cache mount (plugins are excluded from workspace)
# NOTE: -fuse-ld=bfd overrides rust-lld with the system linker (ld.bfd).
# rust-lld (default since Rust 1.85 on x86_64-linux) ignores
# --whole-archive for native static archives under thin LTO,
# causing undefined SVT-AV1 symbols.
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    --mount=type=cache,target=/build/target \
    RUSTFLAGS="-C link-arg=-fuse-ld=bfd" \
    cargo build --locked --profile release-lto -p streamkit-server --bin skit --features "moq,svt_av1_static" && \
    # Copy compiled artifacts out of cache mount so they persist in the layer
    mkdir -p /build/target-out && \
    cp -r /build/target/release-lto /build/target-out/

# Stage 2: Build UI
FROM oven/bun:1.3.5-alpine AS ui-builder

WORKDIR /build/ui

# Install UI dependencies
COPY ui/package.json ui/bun.lock* ./
RUN --mount=type=cache,target=/root/.bun/install/cache \
    bun install --frozen-lockfile

# Copy UI source and build
COPY ui/ ./
RUN bun run build

# Stage 3: Build final server binary with UI embedded
FROM rust:1.95-slim-bookworm AS rust-builder

WORKDIR /build

# Install build dependencies (same as stage 1, includes all deps needed by workspace)
RUN apt-get update && apt-get install -y \
    pkg-config \
    libssl-dev \
    g++ \
    cmake \
    nasm \
    libopus-dev \
    libvpx-dev \
    libclang-dev \
    clang \
    curl \
    git \
    && rm -rf /var/lib/apt/lists/*

# Copy workspace files (plugins are excluded from workspace)
COPY Cargo.toml Cargo.lock ./
COPY apps ./apps
COPY crates ./crates
COPY sdks ./sdks
COPY wit ./wit

# Copy built UI from stage 2
COPY --from=ui-builder /build/ui/dist ./ui/dist

# Remove the server binary from the previous stage to force rebuild with new UI
# We'll use cache mount with artifacts from stage 1
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    --mount=type=cache,target=/build/target \
    --mount=type=bind,from=rust-deps,source=/build/target-out/release-lto,target=/build/target-init \
    bash -c '\
      # Copy pre-built dependencies if target is empty (first build) \
      if [ ! -d "/build/target/release-lto/deps" ]; then \
        echo "Initializing target from cache..."; \
        mkdir -p /build/target/release-lto; \
        cp -r /build/target-init/* /build/target/release-lto/ || true; \
      fi; \
      # Remove server binary to force rebuild with new UI \
      rm -rf /build/target/release-lto/skit \
        /build/target/release-lto/skit.d \
        /build/target/release-lto/deps/streamkit_server-* \
        /build/target/release-lto/.fingerprint/streamkit-server-*; \
      # Build only the server binary (-fuse-ld=bfd: see note above) \
      RUSTFLAGS="-C link-arg=-fuse-ld=bfd" \
      cargo build --locked --profile release-lto --features "moq,svt_av1_static" --bin skit; \
      # Copy final binary out of cache mount \
      mkdir -p /build/bin && cp /build/target/release-lto/skit /build/bin/skit \
    '

# ---------------------------------------------------------------
# Marketplace plugin bundles
#
# Plugins are pulled as signed prebuilt CPU bundles from the same
# marketplace users install from, so the demo validates the artifacts
# users actually receive. Each sherpa-backed bundle is self-contained
# (vendors its own libsherpa-onnx-c-api.so + libonnxruntime.so with
# RUNPATH=$ORIGIN), so the demo needs no system sherpa-onnx libs.
#
# When bumping a plugin, update its `<ID>_PLUGIN_VERSION` and
# `<ID>_BUNDLE_SHA256` ARGs together from
# `docs/public/registry/plugins/<id>/<version>/manifest.json`; model HF
# SHAs come from the same manifest's `models[*].sha256` /
# `models[*].file_checksums` fields. Each sha256 pin is the trust
# boundary, matching the model the registry's signed manifest pins.
# ---------------------------------------------------------------

# Shared base for all bundle-fetch stages -- one apt-get cached across all.
FROM debian:bookworm-slim AS bundle-deps
RUN apt-get update && apt-get install -y --no-install-recommends \
        curl ca-certificates zstd tar bzip2 \
    && rm -rf /var/lib/apt/lists/*

# ---------------------------------------------------------------
# Stage: whisper bundle + tiny multilingual model + Silero VAD.
# The demo deliberately ships the tiny *multilingual* ggml model
# (ggml-tiny-q5_1.bin from ggerganov/whisper.cpp), which is not one of
# the registry's manifest models (those are tiny.en/base.en/base) -- the
# sample pipelines below are rewritten to reference it.
# ---------------------------------------------------------------
FROM bundle-deps AS whisper-bundle
ARG WHISPER_PLUGIN_VERSION=0.3.0
ARG WHISPER_BUNDLE_SHA256=79212cfa57376ebfcb955fd12522ecf36164071cdc94cf3bf964122837e8f4d2
ARG WHISPER_GGML_SHA256=818710568da3ca15689e31a743197b520007872ff9576237bda97bd1b469c3d7
ARG SILERO_VAD_SHA256=1a153a22f4509e292a94e67d6f9b85e8deb25b4988682b7e174c65279d8788e3

WORKDIR /bundle
RUN set -eux; \
    url="https://github.com/streamer45/streamkit/releases/download/plugin-whisper-v${WHISPER_PLUGIN_VERSION}/whisper-${WHISPER_PLUGIN_VERSION}-bundle.tar.zst"; \
    curl --proto '=https' --tlsv1.2 -fsSL -o whisper-bundle.tar.zst "$url"; \
    echo "${WHISPER_BUNDLE_SHA256}  whisper-bundle.tar.zst" | sha256sum -c -; \
    mkdir -p extracted; \
    tar --zstd -xf whisper-bundle.tar.zst -C extracted; \
    test -f extracted/libwhisper.so

WORKDIR /models
RUN set -eux; \
    curl --proto '=https' --tlsv1.2 -fsSL -o ggml-tiny-q5_1.bin \
      "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-tiny-q5_1.bin"; \
    echo "${WHISPER_GGML_SHA256}  ggml-tiny-q5_1.bin" | sha256sum -c -; \
    curl --proto '=https' --tlsv1.2 -fsSL -o silero_vad.onnx \
      "https://huggingface.co/streamkit/whisper-models/resolve/main/silero_vad.onnx"; \
    echo "${SILERO_VAD_SHA256}  silero_vad.onnx" | sha256sum -c -

# ---------------------------------------------------------------
# Stage: kokoro bundle + Kokoro multi-lang v1.1 models.
# ---------------------------------------------------------------
FROM bundle-deps AS kokoro-bundle
ARG KOKORO_PLUGIN_VERSION=0.3.0
ARG KOKORO_BUNDLE_SHA256=0458c130b47a860428431427c26d9c2c80f21a371c7c565138fc351b2d0f652c
ARG KOKORO_MODELS_SHA256=a3f4c73d043860e3fd2e5b06f36795eb81de0fc8e8de6df703245edddd87dbad

WORKDIR /bundle
RUN set -eux; \
    url="https://github.com/streamer45/streamkit/releases/download/plugin-kokoro-v${KOKORO_PLUGIN_VERSION}/kokoro-${KOKORO_PLUGIN_VERSION}-bundle.tar.zst"; \
    curl --proto '=https' --tlsv1.2 -fsSL -o kokoro-bundle.tar.zst "$url"; \
    echo "${KOKORO_BUNDLE_SHA256}  kokoro-bundle.tar.zst" | sha256sum -c -; \
    mkdir -p extracted; \
    tar --zstd -xf kokoro-bundle.tar.zst -C extracted; \
    test -f extracted/libkokoro.so

WORKDIR /models
RUN set -eux; \
    curl --proto '=https' --tlsv1.2 -fsSL -o kokoro-multi-lang-v1_1.tar.bz2 \
      "https://huggingface.co/streamkit/kokoro-models/resolve/main/kokoro-multi-lang-v1_1.tar.bz2"; \
    echo "${KOKORO_MODELS_SHA256}  kokoro-multi-lang-v1_1.tar.bz2" | sha256sum -c -; \
    tar xf kokoro-multi-lang-v1_1.tar.bz2; \
    rm kokoro-multi-lang-v1_1.tar.bz2; \
    test -d kokoro-multi-lang-v1_1

# ---------------------------------------------------------------
# Stage: piper bundle + en_US / es_MX voices.
# ---------------------------------------------------------------
FROM bundle-deps AS piper-bundle
ARG PIPER_PLUGIN_VERSION=0.3.0
ARG PIPER_BUNDLE_SHA256=28186b6fcff6af6048fb34576a96afe3b49ce5e640d9335a1999f2cd935c2a64
ARG PIPER_MODEL_EN_SHA256=78c137daa7eddaf57190cf05c020efd6e593015f62c82ee999ef570fc2dff496
ARG PIPER_MODEL_ES_SHA256=ec33fb689c248fe64810aab564cba97babf0f506672cfd404928d46e751a4721

WORKDIR /bundle
RUN set -eux; \
    url="https://github.com/streamer45/streamkit/releases/download/plugin-piper-v${PIPER_PLUGIN_VERSION}/piper-${PIPER_PLUGIN_VERSION}-bundle.tar.zst"; \
    curl --proto '=https' --tlsv1.2 -fsSL -o piper-bundle.tar.zst "$url"; \
    echo "${PIPER_BUNDLE_SHA256}  piper-bundle.tar.zst" | sha256sum -c -; \
    mkdir -p extracted; \
    tar --zstd -xf piper-bundle.tar.zst -C extracted; \
    test -f extracted/libpiper.so

WORKDIR /models
RUN set -eux; \
    curl --proto '=https' --tlsv1.2 -fsSL -o vits-piper-en_US-libritts_r-medium.tar.bz2 \
      "https://huggingface.co/streamkit/piper-models/resolve/main/vits-piper-en_US-libritts_r-medium.tar.bz2"; \
    echo "${PIPER_MODEL_EN_SHA256}  vits-piper-en_US-libritts_r-medium.tar.bz2" | sha256sum -c -; \
    tar xf vits-piper-en_US-libritts_r-medium.tar.bz2; \
    rm vits-piper-en_US-libritts_r-medium.tar.bz2; \
    if [ ! -f vits-piper-en_US-libritts_r-medium/model.onnx ] && [ -f vits-piper-en_US-libritts_r-medium/en_US-libritts_r-medium.onnx ]; then \
      ln -sf en_US-libritts_r-medium.onnx vits-piper-en_US-libritts_r-medium/model.onnx; \
    fi; \
    curl --proto '=https' --tlsv1.2 -fsSL -o vits-piper-es_MX-claude-high.tar.bz2 \
      "https://huggingface.co/streamkit/piper-models/resolve/main/vits-piper-es_MX-claude-high.tar.bz2"; \
    echo "${PIPER_MODEL_ES_SHA256}  vits-piper-es_MX-claude-high.tar.bz2" | sha256sum -c -; \
    tar xf vits-piper-es_MX-claude-high.tar.bz2; \
    rm vits-piper-es_MX-claude-high.tar.bz2; \
    if [ ! -f vits-piper-es_MX-claude-high/model.onnx ] && [ -f vits-piper-es_MX-claude-high/es_MX-claude-high.onnx ]; then \
      ln -sf es_MX-claude-high.onnx vits-piper-es_MX-claude-high/model.onnx; \
    fi

# ---------------------------------------------------------------
# Stage: sensevoice bundle + SenseVoice int8 model + Silero VAD.
# ---------------------------------------------------------------
FROM bundle-deps AS sensevoice-bundle
ARG SENSEVOICE_PLUGIN_VERSION=0.3.0
ARG SENSEVOICE_BUNDLE_SHA256=eeb8b7f8505e7f7d212a9180b8e6449e76a72112395579ace7a87e263b4a26ce
ARG SENSEVOICE_MODEL_SHA256=7305f7905bfcf77fa0b39388a313f3da35c68d971661a65475b56fb2162c8e63

WORKDIR /bundle
RUN set -eux; \
    url="https://github.com/streamer45/streamkit/releases/download/plugin-sensevoice-v${SENSEVOICE_PLUGIN_VERSION}/sensevoice-${SENSEVOICE_PLUGIN_VERSION}-bundle.tar.zst"; \
    curl --proto '=https' --tlsv1.2 -fsSL -o sensevoice-bundle.tar.zst "$url"; \
    echo "${SENSEVOICE_BUNDLE_SHA256}  sensevoice-bundle.tar.zst" | sha256sum -c -; \
    mkdir -p extracted; \
    tar --zstd -xf sensevoice-bundle.tar.zst -C extracted; \
    test -f extracted/libsensevoice.so

WORKDIR /models
RUN set -eux; \
    f="sherpa-onnx-sense-voice-zh-en-ja-ko-yue-int8-2025-09-09"; \
    curl --proto '=https' --tlsv1.2 -fsSL -o "${f}.tar.bz2" \
      "https://huggingface.co/streamkit/sensevoice-models/resolve/main/${f}.tar.bz2"; \
    echo "${SENSEVOICE_MODEL_SHA256}  ${f}.tar.bz2" | sha256sum -c -; \
    tar xf "${f}.tar.bz2"; \
    rm "${f}.tar.bz2"; \
    test -d "${f}"

# ---------------------------------------------------------------
# Stage: vad bundle + ten-vad model.
# ---------------------------------------------------------------
FROM bundle-deps AS vad-bundle
ARG VAD_PLUGIN_VERSION=0.4.0
ARG VAD_BUNDLE_SHA256=5122e4a24598ad761b4dc385e7ebc2343cb7249f7714546a0d0a56d69ab9d957
ARG TEN_VAD_SHA256=718cb7eef47e3cf5ddbe7e967a7503f46b8b469c0706872f494dfa921b486206

WORKDIR /bundle
RUN set -eux; \
    url="https://github.com/streamer45/streamkit/releases/download/plugin-vad-v${VAD_PLUGIN_VERSION}/vad-${VAD_PLUGIN_VERSION}-bundle.tar.zst"; \
    curl --proto '=https' --tlsv1.2 -fsSL -o vad-bundle.tar.zst "$url"; \
    echo "${VAD_BUNDLE_SHA256}  vad-bundle.tar.zst" | sha256sum -c -; \
    mkdir -p extracted; \
    tar --zstd -xf vad-bundle.tar.zst -C extracted; \
    test -f extracted/libvad.so

WORKDIR /models
RUN set -eux; \
    curl --proto '=https' --tlsv1.2 -fsSL -o ten-vad.onnx \
      "https://huggingface.co/streamkit/vad-models/resolve/main/ten-vad.onnx"; \
    echo "${TEN_VAD_SHA256}  ten-vad.onnx" | sha256sum -c -

# ---------------------------------------------------------------
# Stage: matcha bundle + Matcha LJSpeech models.
# ---------------------------------------------------------------
FROM bundle-deps AS matcha-bundle
ARG MATCHA_PLUGIN_VERSION=0.3.0
ARG MATCHA_BUNDLE_SHA256=46fa83617d0e53d619d9f52ae4b70c9f3a45f31ea9da327ac2bdd012396257bb
ARG MATCHA_MODEL_SHA256=f7862f5d93b956561ee7aca86bf33504f47726c1d5a559066f3cef8fab6c3e23
ARG MATCHA_VOCOS_SHA256=0574a135aa1db2de6e181050db2ec528496cacd4a4701fc5d7faf9f9804c0081

WORKDIR /bundle
RUN set -eux; \
    url="https://github.com/streamer45/streamkit/releases/download/plugin-matcha-v${MATCHA_PLUGIN_VERSION}/matcha-${MATCHA_PLUGIN_VERSION}-bundle.tar.zst"; \
    curl --proto '=https' --tlsv1.2 -fsSL -o matcha-bundle.tar.zst "$url"; \
    echo "${MATCHA_BUNDLE_SHA256}  matcha-bundle.tar.zst" | sha256sum -c -; \
    mkdir -p extracted; \
    tar --zstd -xf matcha-bundle.tar.zst -C extracted; \
    test -f extracted/libmatcha.so

WORKDIR /models
RUN set -eux; \
    curl --proto '=https' --tlsv1.2 -fsSL -o matcha-icefall-en_US-ljspeech.tar.bz2 \
      "https://huggingface.co/streamkit/matcha-models/resolve/main/matcha-icefall-en_US-ljspeech.tar.bz2"; \
    echo "${MATCHA_MODEL_SHA256}  matcha-icefall-en_US-ljspeech.tar.bz2" | sha256sum -c -; \
    tar xf matcha-icefall-en_US-ljspeech.tar.bz2; \
    rm matcha-icefall-en_US-ljspeech.tar.bz2; \
    curl --proto '=https' --tlsv1.2 -fsSL -o matcha-icefall-en_US-ljspeech/vocos-22khz-univ.onnx \
      "https://huggingface.co/streamkit/matcha-models/resolve/main/matcha-icefall-en_US-ljspeech/vocos-22khz-univ.onnx"; \
    echo "${MATCHA_VOCOS_SHA256}  matcha-icefall-en_US-ljspeech/vocos-22khz-univ.onnx" | sha256sum -c -

# ---------------------------------------------------------------
# Stage: helsinki bundle + OPUS-MT EN<->ES models.
# The from-source build used a Python/torch conversion step; we now pull
# the pre-converted CTranslate2 model tarballs from streamkit/helsinki-models.
# ---------------------------------------------------------------
FROM bundle-deps AS helsinki-bundle
ARG HELSINKI_PLUGIN_VERSION=0.3.0
ARG HELSINKI_BUNDLE_SHA256=b8cdfef21d66cfc75596bdb8080cfb20115f6be883c2c1990b2e6edc50190045
ARG HELSINKI_EN_ES_SHA256=6624ec0babce458c0771f493460e62f7e7dc6d4d832e56dbde1621444d4b37cf
ARG HELSINKI_ES_EN_SHA256=01a0ddd203b3343d02c013539d4d8f0dfcd747585c9b26f0c3f90f7a11d7cde9

WORKDIR /bundle
RUN set -eux; \
    url="https://github.com/streamer45/streamkit/releases/download/plugin-helsinki-v${HELSINKI_PLUGIN_VERSION}/helsinki-${HELSINKI_PLUGIN_VERSION}-bundle.tar.zst"; \
    curl --proto '=https' --tlsv1.2 -fsSL -o helsinki-bundle.tar.zst "$url"; \
    echo "${HELSINKI_BUNDLE_SHA256}  helsinki-bundle.tar.zst" | sha256sum -c -; \
    mkdir -p extracted; \
    tar --zstd -xf helsinki-bundle.tar.zst -C extracted; \
    test -f extracted/libhelsinki.so

WORKDIR /models
RUN set -eux; \
    hf_base="https://huggingface.co/streamkit/helsinki-models/resolve/main"; \
    for spec in \
        "opus-mt-en-es ${HELSINKI_EN_ES_SHA256}" \
        "opus-mt-es-en ${HELSINKI_ES_EN_SHA256}" \
    ; do \
        name=$(echo "$spec" | awk '{print $1}'); \
        sha=$(echo "$spec" | awk '{print $2}'); \
        curl --proto '=https' --tlsv1.2 -fsSL -o "${name}.tar.bz2" "${hf_base}/${name}.tar.bz2"; \
        echo "${sha}  ${name}.tar.bz2" | sha256sum -c -; \
        tar xf "${name}.tar.bz2"; \
        rm "${name}.tar.bz2"; \
        test -d "${name}"; \
    done

# ---------------------------------------------------------------
# Stage: pocket-tts bundle + Kyutai Pocket TTS models.
# ---------------------------------------------------------------
FROM bundle-deps AS pocket-tts-bundle
ARG POCKET_TTS_PLUGIN_VERSION=0.3.0
ARG POCKET_TTS_BUNDLE_SHA256=9f86803c8fce08f84da8484f2e7c38037ed20215df10d0188a423631bc7f76b0
ARG POCKET_TTS_MODELS_SHA256=7661d610217e8d2b0ae1d8739d384756e50c734fb136047679ca651385ed3035

WORKDIR /bundle
RUN set -eux; \
    url="https://github.com/streamer45/streamkit/releases/download/plugin-pocket-tts-v${POCKET_TTS_PLUGIN_VERSION}/pocket-tts-${POCKET_TTS_PLUGIN_VERSION}-bundle.tar.zst"; \
    curl --proto '=https' --tlsv1.2 -fsSL -o pocket-tts-bundle.tar.zst "$url"; \
    echo "${POCKET_TTS_BUNDLE_SHA256}  pocket-tts-bundle.tar.zst" | sha256sum -c -; \
    mkdir -p extracted; \
    tar --zstd -xf pocket-tts-bundle.tar.zst -C extracted; \
    test -f extracted/libpocket_tts.so

WORKDIR /models
RUN set -eux; \
    curl --proto '=https' --tlsv1.2 -fsSL -o pocket-tts-models.tar.bz2 \
      "https://huggingface.co/streamkit/pocket-tts-models/resolve/main/pocket-tts-b6369a24.tar.bz2"; \
    echo "${POCKET_TTS_MODELS_SHA256}  pocket-tts-models.tar.bz2" | sha256sum -c -; \
    tar xf pocket-tts-models.tar.bz2; \
    rm pocket-tts-models.tar.bz2; \
    test -d pocket-tts

# ---------------------------------------------------------------
# Stage: supertonic bundle + Supertonic v2 ONNX models.
# ---------------------------------------------------------------
FROM bundle-deps AS supertonic-bundle
ARG SUPERTONIC_PLUGIN_VERSION=0.3.0
ARG SUPERTONIC_BUNDLE_SHA256=cc815d2f807021cdd424936fd8c0d84321773c29eeb6b8c79394b92becf8ae02
ARG SUPERTONIC_MODELS_SHA256=3c3ba6326cd6c8ee48d4c7322322d1f1f4ebf188bf4a7d80fc218babca186f41

WORKDIR /bundle
RUN set -eux; \
    url="https://github.com/streamer45/streamkit/releases/download/plugin-supertonic-v${SUPERTONIC_PLUGIN_VERSION}/supertonic-${SUPERTONIC_PLUGIN_VERSION}-bundle.tar.zst"; \
    curl --proto '=https' --tlsv1.2 -fsSL -o supertonic-bundle.tar.zst "$url"; \
    echo "${SUPERTONIC_BUNDLE_SHA256}  supertonic-bundle.tar.zst" | sha256sum -c -; \
    mkdir -p extracted; \
    tar --zstd -xf supertonic-bundle.tar.zst -C extracted; \
    test -f extracted/libsupertonic.so

WORKDIR /models
RUN set -eux; \
    curl --proto '=https' --tlsv1.2 -fsSL -o supertonic-v2-onnx.tar.bz2 \
      "https://huggingface.co/streamkit/supertonic-models/resolve/main/supertonic-v2-onnx.tar.bz2"; \
    echo "${SUPERTONIC_MODELS_SHA256}  supertonic-v2-onnx.tar.bz2" | sha256sum -c -; \
    tar xf supertonic-v2-onnx.tar.bz2; \
    rm supertonic-v2-onnx.tar.bz2; \
    test -d supertonic-v2-onnx

# ---------------------------------------------------------------
# Stage: aac-encoder bundle. No models.
# ---------------------------------------------------------------
FROM bundle-deps AS aac-encoder-bundle
ARG AAC_ENCODER_PLUGIN_VERSION=0.2.0
ARG AAC_ENCODER_BUNDLE_SHA256=6ccf39fdcc4a9b9984980dad0fa73cbcd9d092323b359538785aa0edd6421e7c

WORKDIR /bundle
RUN set -eux; \
    url="https://github.com/streamer45/streamkit/releases/download/plugin-aac-encoder-v${AAC_ENCODER_PLUGIN_VERSION}/aac-encoder-${AAC_ENCODER_PLUGIN_VERSION}-bundle.tar.zst"; \
    curl --proto '=https' --tlsv1.2 -fsSL -o aac-encoder-bundle.tar.zst "$url"; \
    echo "${AAC_ENCODER_BUNDLE_SHA256}  aac-encoder-bundle.tar.zst" | sha256sum -c -; \
    mkdir -p extracted; \
    tar --zstd -xf aac-encoder-bundle.tar.zst -C extracted; \
    test -f extracted/libaac_encoder.so

# ---------------------------------------------------------------
# Stage: slint bundle. No models.
# ---------------------------------------------------------------
FROM bundle-deps AS slint-bundle
ARG SLINT_PLUGIN_VERSION=0.4.0
ARG SLINT_BUNDLE_SHA256=2b33767cdd35b9eeba3bec4e1801aa020a59ef9a61c54b28f7c5d71fa087034d

WORKDIR /bundle
COPY plugins/native/slint/plugin.yml plugin.yml.src
RUN set -eux; \
    url="https://github.com/streamer45/streamkit/releases/download/plugin-slint-v${SLINT_PLUGIN_VERSION}/slint-${SLINT_PLUGIN_VERSION}-bundle.tar.zst"; \
    curl --proto '=https' --tlsv1.2 -fsSL -o slint-bundle.tar.zst "$url"; \
    echo "${SLINT_BUNDLE_SHA256}  slint-bundle.tar.zst" | sha256sum -c -; \
    mkdir -p extracted; \
    tar --zstd -xf slint-bundle.tar.zst -C extracted; \
    test -f extracted/libslint.so; \
    sed "s/^version:.*/version: ${SLINT_PLUGIN_VERSION}/" plugin.yml.src > extracted/plugin.yml

# Runtime stage
FROM debian:bookworm-slim

# Install runtime dependencies (include gdb for debugging demo image crashes)
# libfdk-aac2 is in Debian's non-free component.
# sherpa-onnx / ONNX Runtime are NOT installed here: each sherpa-backed
# bundle vendors its own libs (RUNPATH=$ORIGIN).
RUN sed -i 's/^Components: main$/Components: main non-free/' /etc/apt/sources.list.d/debian.sources && \
    apt-get update && apt-get install -y \
    ca-certificates \
    libssl3 \
    libopus0 \
    libvpx7 \
    libgomp1 \
    libfontconfig1 \
    fonts-dejavu-core \
    libfdk-aac2 \
    gdb \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Create app user
RUN useradd -m -u 1000 -s /bin/bash app

# Copy binary from rust builder
COPY --from=rust-builder /build/bin/skit /usr/local/bin/skit

# Plugins are shipped as directory bundles (plugins/native/<id>/ with the
# .so + embedded manifest.json + any vendored libs) -- the layout the
# loader expects. Each marketplace bundle is copied verbatim from its
# fetch stage so $ORIGIN-relative vendored libs stay co-located.
# IMPORTANT: Use --chown=app:app on every COPY to avoid a bulk `chown -R`
# later which would duplicate every file in a new layer.
COPY --chown=app:app --from=whisper-bundle /bundle/extracted /opt/streamkit/plugins/native/whisper
COPY --chown=app:app --from=whisper-bundle /models/ggml-tiny-q5_1.bin /opt/streamkit/models/ggml-tiny-q5_1.bin
COPY --chown=app:app --from=whisper-bundle /models/silero_vad.onnx /opt/streamkit/models/silero_vad.onnx

COPY --chown=app:app --from=kokoro-bundle /bundle/extracted /opt/streamkit/plugins/native/kokoro
COPY --chown=app:app --from=kokoro-bundle /models/kokoro-multi-lang-v1_1 /opt/streamkit/models/kokoro-multi-lang-v1_1

COPY --chown=app:app --from=piper-bundle /bundle/extracted /opt/streamkit/plugins/native/piper
COPY --chown=app:app --from=piper-bundle /models/vits-piper-en_US-libritts_r-medium /opt/streamkit/models/vits-piper-en_US-libritts_r-medium
COPY --chown=app:app --from=piper-bundle /models/vits-piper-es_MX-claude-high /opt/streamkit/models/vits-piper-es_MX-claude-high

COPY --chown=app:app --from=sensevoice-bundle /bundle/extracted /opt/streamkit/plugins/native/sensevoice
COPY --chown=app:app --from=sensevoice-bundle /models/sherpa-onnx-sense-voice-zh-en-ja-ko-yue-int8-2025-09-09 /opt/streamkit/models/sherpa-onnx-sense-voice-zh-en-ja-ko-yue-int8-2025-09-09

COPY --chown=app:app --from=helsinki-bundle /bundle/extracted /opt/streamkit/plugins/native/helsinki
COPY --chown=app:app --from=helsinki-bundle /models/opus-mt-en-es /opt/streamkit/models/opus-mt-en-es
COPY --chown=app:app --from=helsinki-bundle /models/opus-mt-es-en /opt/streamkit/models/opus-mt-es-en

COPY --chown=app:app --from=vad-bundle /bundle/extracted /opt/streamkit/plugins/native/vad
COPY --chown=app:app --from=vad-bundle /models/ten-vad.onnx /opt/streamkit/models/ten-vad.onnx

COPY --chown=app:app --from=matcha-bundle /bundle/extracted /opt/streamkit/plugins/native/matcha
COPY --chown=app:app --from=matcha-bundle /models/matcha-icefall-en_US-ljspeech /opt/streamkit/models/matcha-icefall-en_US-ljspeech

COPY --chown=app:app --from=pocket-tts-bundle /bundle/extracted /opt/streamkit/plugins/native/pocket-tts
COPY --chown=app:app --from=pocket-tts-bundle /models/pocket-tts /opt/streamkit/models/pocket-tts

COPY --chown=app:app --from=supertonic-bundle /bundle/extracted /opt/streamkit/plugins/native/supertonic
COPY --chown=app:app --from=supertonic-bundle /models/supertonic-v2-onnx /opt/streamkit/models/supertonic-v2-onnx

# The pinned slint bundle predates self-describing bundles, so the slint-bundle
# stage injects a plugin.yml (version-matched to the pinned bundle) to keep the
# "Slint Files" asset type + /api/v1/assets/plugin/slint endpoints. Drop the
# injection once SLINT_PLUGIN_VERSION points at a self-describing bundle.
COPY --chown=app:app --from=slint-bundle /bundle/extracted /opt/streamkit/plugins/native/slint

COPY --chown=app:app --from=aac-encoder-bundle /bundle/extracted /opt/streamkit/plugins/native/aac-encoder

# Copy sample pipelines + small bundled audio samples (Opus/Ogg only)
COPY --chown=app:app samples/pipelines /opt/streamkit/samples/pipelines
COPY --chown=app:app samples/audio/system/*.ogg samples/audio/system/*.ogg.license /opt/streamkit/samples/audio/system/
COPY --chown=app:app samples/audio/system/*.opus samples/audio/system/*.opus.license /opt/streamkit/samples/audio/system/

# Copy Slint UI source files (referenced by sample pipelines)
COPY --chown=app:app samples/slint /opt/streamkit/samples/slint

# Demo image uses a single tiny multilingual Whisper model, but the committed sample pipelines
# reference a mix of base.en/tiny.en/multilingual model filenames. Rewrite them inside the image
# so the shipped samples work without bundling multiple Whisper models.
RUN find /opt/streamkit/samples/pipelines -type f \( -name '*.yml' -o -name '*.yaml' \) -print0 | \
    xargs -0 sed -i \
      -e 's#models/ggml-base\.en-q5_1\.bin#models/ggml-tiny-q5_1.bin#g' \
      -e 's#models/ggml-tiny\.en-q5_1\.bin#models/ggml-tiny-q5_1.bin#g' \
      -e 's#models/ggml-base-q5_1\.bin#models/ggml-tiny-q5_1.bin#g' && \
    rm -f \
    /opt/streamkit/samples/pipelines/oneshot/speech_to_text_translate.yml \
    /opt/streamkit/samples/pipelines/oneshot/gain_filter_rust.yml \
    /opt/streamkit/samples/pipelines/dynamic/speech-translate-en-es.yaml \
    /opt/streamkit/samples/pipelines/dynamic/speech-translate-es-en.yaml && \
    chown -R app:app /opt/streamkit/samples/pipelines

# Copy demo configuration
COPY --chown=app:app docker-skit-demo.toml /opt/streamkit/config/skit.toml

# Create runtime-writable directories and compatibility symlinks.
# No bulk chown needed — all COPY instructions above use --chown=app:app.
RUN mkdir -p /opt/streamkit/.plugins /opt/streamkit/logs /opt/streamkit/config /opt/streamkit/demo && \
    chown app:app /opt/streamkit/.plugins /opt/streamkit/logs /opt/streamkit/config /opt/streamkit/demo && \
    mkdir -p /app && \
    ln -sfn /opt/streamkit/config/skit.toml /opt/streamkit/skit.toml && \
    ln -sfn /opt/streamkit/plugins /app/plugins && \
    ln -sfn /opt/streamkit/models /app/models && \
    ln -sfn /opt/streamkit/samples /app/samples && \
    ln -sfn /opt/streamkit/config /app/config && \
    ln -sfn /opt/streamkit/.plugins /app/.plugins && \
    ln -sfn /opt/streamkit/logs /app/logs

WORKDIR /opt/streamkit
USER app

# Expose HTTP and UDP ports
EXPOSE 4545/tcp
EXPOSE 4545/udp

# OCI image labels
LABEL org.opencontainers.image.title="StreamKit Demo"
LABEL org.opencontainers.image.description="Demo image with pre-configured plugins for speech-to-text, text-to-speech, and translation"
LABEL org.opencontainers.image.source="https://github.com/streamer45/streamkit"
LABEL org.opencontainers.image.licenses="MPL-2.0"
LABEL org.opencontainers.image.vendor="StreamKit Contributors"

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
    CMD curl -f http://localhost:4545/healthz || exit 1

# Default command
CMD ["skit", "serve"]