Dockerfile.unified

# Unified Dockerfile for BrainKB Services
# Deploys: APItokenmanager, query_service, ml_service, and oxigraph

# Note: Oxigraph binary extraction skipped - oxigraph image is distroless
# Oxigraph will be run as a separate service in docker-compose or use the fallback script

# Main build stage
FROM python:3.10-slim

# Set metadata
LABEL project="BrainyPedia" \
      maintainer="Tek Raj Chhetri <tekraj@mit.edu>" \
      version="1.0" \
      description="Unified Docker image for BrainKB services"

# Install system dependencies
RUN apt-get update && apt-get install -y \
    gcc \
    g++ \
    postgresql-client \
    libpq-dev \
    supervisor \
    curl \
    wget \
    openssl \
    apache2-utils \
    && rm -rf /var/lib/apt/lists/*

# Create directories for all services
WORKDIR /app

# Copy APItokenmanager
COPY APItokenmanager/ /app/APItokenmanager/
WORKDIR /app/APItokenmanager
RUN pip install --upgrade pip && \
    pip install -r requirements.txt && \
    pip install python-decouple gunicorn

# Copy query_service
COPY query_service/ /app/query_service/
WORKDIR /app/query_service
RUN pip install -r requirements.txt

# Copy ml_service
COPY ml_service/ /app/ml_service/
WORKDIR /app/ml_service
RUN pip install --use-deprecated=legacy-resolver "structsense==0.0.4" || \
    pip install --use-deprecated=legacy-resolver --no-deps "structsense==0.0.4" && \
    pip install -r requirements.txt


# Create supervisor configuration
RUN mkdir -p /etc/supervisor/conf.d
RUN cat > /etc/supervisor/conf.d/supervisord.conf << 'EOF'
[unix_http_server]
file=/var/run/supervisor.sock
chmod=0700

[supervisord]
nodaemon=true
logfile=/var/log/supervisor/supervisord.log
pidfile=/var/run/supervisord.pid

[supervisorctl]
serverurl=unix:///var/run/supervisor.sock

[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

[program:api_tokenmanager]
command=gunicorn -b 0.0.0.0:8000 APIAuthManager.wsgi:application
directory=/app/APItokenmanager
autostart=true
autorestart=true
startsecs=10
stderr_logfile=/var/log/supervisor/api_tokenmanager.err.log
stdout_logfile=/var/log/supervisor/api_tokenmanager.out.log
environment=PATH="/usr/local/bin:/usr/bin:/bin"
priority=100

[program:query_service]
command=gunicorn core.main:app --bind 0.0.0.0:8010 --workers 6 --worker-class uvicorn.workers.UvicornWorker --threads 2 --timeout 300 --keep-alive 120 --max-requests 1000 --max-requests-jitter 50
directory=/app/query_service
autostart=true
autorestart=true
startsecs=30
stderr_logfile=/var/log/supervisor/query_service.err.log
stdout_logfile=/var/log/supervisor/query_service.out.log
environment=PATH="/usr/local/bin:/usr/bin:/bin",WEB_CONCURRENCY="6"
startretries=10
stopwaitsecs=10
priority=200

[program:ml_service]
command=gunicorn core.main:app --bind 0.0.0.0:8007 --workers 6 --worker-class uvicorn.workers.UvicornWorker --threads 2 --max-requests 1000 --max-requests-jitter 50 --timeout 220 --keep-alive 220 --log-level debug
directory=/app/ml_service
autostart=true
autorestart=true
startsecs=15
stderr_logfile=/var/log/supervisor/ml_service.err.log
stdout_logfile=/var/log/supervisor/ml_service.out.log
environment=PATH="/usr/local/bin:/usr/bin:/bin",WEB_CONCURRENCY="6"

[program:oxigraph]
command=/app/oxigraph/oxigraph_server --bind 0.0.0.0:7878 --storage /data
directory=/app/oxigraph
autostart=false
autorestart=false
stderr_logfile=/var/log/supervisor/oxigraph.err.log
stdout_logfile=/var/log/supervisor/oxigraph.out.log
environment=PATH="/usr/local/bin:/usr/bin:/bin",TMPDIR="/tmp"
startsecs=0
startretries=0
EOF

# Create directories for logs and data
# Ensure supervisor socket directory exists and is writable
RUN mkdir -p /var/log/supervisor /data /app/oxigraph /var/run && \
    chmod 777 /var/run /var/log/supervisor

# Create oxigraph fallback script
# Note: Oxigraph binary extraction from distroless image is not possible
# Oxigraph should be run as a separate service in docker-compose
RUN echo '#!/bin/bash' > /app/oxigraph/oxigraph_server && \
    echo 'echo "Oxigraph is not available in this container. Please run oxigraph as a separate service."' >> /app/oxigraph/oxigraph_server && \
    echo 'echo "You can add it to docker-compose.unified.yml or run it separately."' >> /app/oxigraph/oxigraph_server && \
    echo 'exit 1' >> /app/oxigraph/oxigraph_server && \
    chmod +x /app/oxigraph/oxigraph_server

# Create healthcheck script
RUN cat > /app/healthcheck.sh << 'EOF'
#!/bin/bash
# Healthcheck script to verify all services are running

# Check if supervisor is running
if ! pgrep supervisord > /dev/null; then
    echo "ERROR: supervisord is not running"
    exit 1
fi

# Check if supervisor socket is accessible
if ! supervisorctl status > /dev/null 2>&1; then
    echo "ERROR: Cannot connect to supervisor"
    exit 1
fi

# Check each service status
for service in api_tokenmanager query_service ml_service; do
    status=$(supervisorctl status $service 2>/dev/null | awk '{print $2}')
    if [ "$status" != "RUNNING" ]; then
        echo "ERROR: Service $service is not running (status: $status)"
        echo "Check logs at: /var/log/supervisor/${service}.err.log"
        exit 1
    fi
done

# Check if services are listening on their ports
# Give services time to bind to ports if they just started
sleep 2

# Check API Token Manager (port 8000)
if ! curl -s -f http://localhost:8000/ > /dev/null 2>&1; then
    echo "WARNING: API Token Manager (port 8000) is not responding"
fi

# Check Query Service (port 8010)
if ! curl -s -f http://localhost:8010/api/ > /dev/null 2>&1; then
    echo "WARNING: Query Service (port 8010) is not responding"
fi

# Check ML Service (port 8007)
if ! curl -s -f http://localhost:8007/api/ > /dev/null 2>&1; then
    echo "WARNING: ML Service (port 8007) is not responding"
fi

# If we got here, at least supervisor and services are running
exit 0
EOF

RUN chmod +x /app/healthcheck.sh

# Create startup script
RUN cat > /app/start.sh << 'EOF'
#!/bin/bash
set -e

echo "=========================================="
echo "BrainKB Unified Container Startup"
echo "=========================================="
echo ""

# Check critical environment variables
echo "Checking environment configuration..."
MISSING_VARS=()

# Check JWT/Database configuration
if [ -z "$JWT_POSTGRES_DATABASE_USER" ] && [ -z "$DB_USER" ]; then
    MISSING_VARS+=("JWT_POSTGRES_DATABASE_USER or DB_USER")
fi
if [ -z "$JWT_POSTGRES_DATABASE_PASSWORD" ] && [ -z "$DB_PASSWORD" ]; then
    MISSING_VARS+=("JWT_POSTGRES_DATABASE_PASSWORD or DB_PASSWORD")
fi
if [ -z "$QUERY_SERVICE_JWT_SECRET_KEY" ]; then
    MISSING_VARS+=("QUERY_SERVICE_JWT_SECRET_KEY")
fi
if [ -z "$ML_SERVICE_JWT_SECRET_KEY" ]; then
    MISSING_VARS+=("ML_SERVICE_JWT_SECRET_KEY")
fi

if [ ${#MISSING_VARS[@]} -gt 0 ]; then
    echo "WARNING: Missing critical environment variables:"
    for var in "${MISSING_VARS[@]}"; do
        echo "  - $var"
    done
    echo ""
    echo "Services may fail to start without these variables."
    echo "Please ensure your .env file is properly configured."
    echo ""
fi

# Note: Oxigraph runs as a separate service in docker-compose

# Ensure supervisor socket directory exists and is writable
mkdir -p /var/run
chmod 755 /var/run

# Wait for PostgreSQL to be ready
# Use JWT_POSTGRES_DATABASE_USER if available, otherwise fall back to DB_USER
# This ensures we use the same user that PostgreSQL was initialized with
PG_USER="${JWT_POSTGRES_DATABASE_USER:-${DB_USER:-postgres}}"
PG_PASSWORD="${JWT_POSTGRES_DATABASE_PASSWORD:-${DB_PASSWORD}}"
PG_HOST="${JWT_POSTGRES_DATABASE_HOST_URL:-${DB_HOST:-postgres}}"
PG_DB="${JWT_POSTGRES_DATABASE_NAME:-${DB_NAME:-brainkb}}"

echo "Waiting for PostgreSQL to be ready..."
echo "Connecting as user: ${PG_USER} to database: ${PG_DB} on host: ${PG_HOST}"
until PGPASSWORD="$PG_PASSWORD" psql -h "$PG_HOST" -U "$PG_USER" -d "$PG_DB" -c '\q' 2>/dev/null; do
    echo "PostgreSQL is unavailable - sleeping"
    sleep 2
done
echo "PostgreSQL is ready!"

# Note: Oxigraph is optional - services will handle connection failures gracefully
# No need to wait for it here - services will retry when needed

# Run Django migrations for APItokenmanager if needed
cd /app/APItokenmanager
if [ -f .env ] || [ -n "$DB_NAME" ]; then
    echo "Running Django migrations..."
    python manage.py makemigrations || true
    python manage.py migrate || true
    python manage.py collectstatic --noinput || true
    
    # Create superuser if credentials are provided and user doesn't exist
    if [ -n "$DJANGO_SUPERUSER_USERNAME" ] && [ -n "$DJANGO_SUPERUSER_EMAIL" ] && [ -n "$DJANGO_SUPERUSER_PASSWORD" ]; then
        echo "Creating Django superuser..."
        export DJANGO_SUPERUSER_USERNAME DJANGO_SUPERUSER_EMAIL DJANGO_SUPERUSER_PASSWORD
        python manage.py shell << 'PYTHON_SCRIPT' || true
import os
from django.contrib.auth import get_user_model
User = get_user_model()
username = os.environ.get('DJANGO_SUPERUSER_USERNAME')
email = os.environ.get('DJANGO_SUPERUSER_EMAIL')
password = os.environ.get('DJANGO_SUPERUSER_PASSWORD')
if username and email and password:
    if not User.objects.filter(username=username).exists():
        User.objects.create_superuser(username, email, password)
        print(f'Superuser {username} created successfully')
    else:
        print(f'Superuser {username} already exists')
else:
    print('Error: Missing superuser credentials in environment')
PYTHON_SCRIPT
    else
        echo "Warning: DJANGO_SUPERUSER credentials not provided. Superuser not created."
        echo "You can create one manually with: python manage.py createsuperuser"
    fi
    
    echo "Django migrations completed"
fi

# Ensure supervisor socket directory exists and is writable (in case /var/run is tmpfs)
mkdir -p /var/run
chmod 755 /var/run

# Start supervisor
echo ""
echo "Starting all services via supervisord..."
echo "=========================================="
echo ""
echo "Services being started:"
echo "  - API Token Manager (port 8000)"
echo "  - Query Service (port 8010)"
echo "  - ML Service (port 8007)"
echo ""
echo "Logs are available at:"
echo "  - /var/log/supervisor/api_tokenmanager.err.log"
echo "  - /var/log/supervisor/query_service.err.log"
echo "  - /var/log/supervisor/ml_service.err.log"
echo ""
echo "From host, view logs with:"
echo "  docker exec brainkb-unified tail -f /var/log/supervisor/query_service.err.log"
echo ""
echo "=========================================="
echo ""

# Use our config file that includes socket configuration
exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf
EOF

RUN chmod +x /app/start.sh

# Expose ports
EXPOSE 8000 8007 8010

# Set working directory
WORKDIR /app

# Default command
CMD ["/app/start.sh"]