WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

docker/Dockerfile.app

@@ -0,0 +1,140 @@
+# Temporary offline build stage: reuse the migration binary already present in
+# the last production image when the Go proxy is unavailable.
+FROM yawan-api:public-20260921-053200 AS migrate-prebuilt
+
+# Build stage
+FROM golang:1.26-bookworm AS builder
+
+WORKDIR /app
+
+# 通过构建参数接收敏感信息
+ARG GOPRIVATE_ARG
+ARG GOPROXY_ARG
+ARG GOSUMDB_ARG=off
+ARG APK_MIRROR_ARG
+
+# 设置Go环境变量
+ENV GOPRIVATE=${GOPRIVATE_ARG}
+ENV GOPROXY=${GOPROXY_ARG}
+ENV GOSUMDB=${GOSUMDB_ARG}
+
+# Install dependencies
+RUN if [ -n "$APK_MIRROR_ARG" ]; then \
+        sed -i "s@deb.debian.org@${APK_MIRROR_ARG}@g" /etc/apt/sources.list.d/debian.sources; \
+    fi && \
+    apt-get update && \
+    apt-get install -y git build-essential libsqlite3-dev curl
+
+# Install migrate tool. The prebuilt binary keeps release builds working when
+# the public Go proxy is temporarily unreachable.
+COPY --from=migrate-prebuilt /usr/local/bin/migrate /go/bin/migrate
+
+# Copy go mod files. go.mod replace-points anydoc at ./third_party/anydoc-go,
+# so that module's go.mod must exist before `go mod download`.
+COPY go.mod go.sum ./
+COPY third_party/anydoc-go/go.mod third_party/anydoc-go/go.mod
+RUN go mod download
+COPY cmd/download cmd/download
+RUN go run cmd/download/duckdb/duckdb.go
+COPY . .
+
+# Get version and commit info for build injection
+ARG VERSION_ARG
+ARG COMMIT_ID_ARG
+ARG BUILD_TIME_ARG
+ARG GO_VERSION_ARG
+
+# Set build-time variables
+ENV VERSION=${VERSION_ARG}
+ENV COMMIT_ID=${COMMIT_ID_ARG}
+ENV BUILD_TIME=${BUILD_TIME_ARG}
+ENV GO_VERSION=${GO_VERSION_ARG}
+
+# Link the anydoc parser engine (office docs converted in-process, no
+# Python docreader). Default on so Hub / compose images ship a working
+# engine; pass WITH_ANYDOC=0 to skip the Rust toolchain (~few minutes and
+# ~1 GB of build-stage layers).
+ARG WITH_ANYDOC=1
+ENV RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo
+ENV PATH=/usr/local/cargo/bin:$PATH
+RUN if [ "$WITH_ANYDOC" = "1" ]; then \
+        curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+            | sh -s -- -y --profile minimal --default-toolchain stable && \
+        ./scripts/build-anydoc-lib.sh; \
+    fi
+
+# Build the application with version info
+RUN if [ "$WITH_ANYDOC" = "1" ]; then \
+        make build-prod GO_BUILD_TAGS=anydoc; \
+    else \
+        make build-prod; \
+    fi
+RUN cp -r /go/pkg/mod/github.com/yanyiwu/ /app/yanyiwu/
+
+# Final stage
+FROM debian:12.12-slim
+
+WORKDIR /app
+
+ARG APK_MIRROR_ARG
+
+# Create a non-root user first
+RUN useradd -m -s /bin/bash appuser
+
+# First, install ca-certificates without mirror to ensure HTTPS works
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# Then switch to mirror if specified and install other packages
+RUN if [ -n "$APK_MIRROR_ARG" ]; then \
+        sed -i "s@deb.debian.org@${APK_MIRROR_ARG}@g" /etc/apt/sources.list.d/debian.sources; \
+    fi && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends \
+        build-essential postgresql-client default-mysql-client tzdata sed curl bash vim wget \
+        libsqlite3-0 \
+        python3 python3-pip python3-dev libffi-dev libssl-dev \
+        nodejs npm \
+        gosu \
+        ffmpeg && \
+    python3 -m pip install --break-system-packages --upgrade pip setuptools wheel && \
+    mkdir -p /home/appuser/.local/bin && \
+    curl -LsSf https://astral.sh/uv/install.sh | CARGO_HOME=/home/appuser/.cargo UV_INSTALL_DIR=/home/appuser/.local/bin sh && \
+    chown -R appuser:appuser /home/appuser && \
+    ln -sf /home/appuser/.local/bin/uvx /usr/local/bin/uvx && \
+    chmod +x /usr/local/bin/uvx && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+# Create data directories and set permissions
+RUN mkdir -p /data/files && \
+    chown -R appuser:appuser /app /data/files
+
+# Copy migrate tool from builder stage
+COPY --from=builder /go/bin/migrate /usr/local/bin/
+COPY --from=builder /app/yanyiwu/ /go/pkg/mod/github.com/yanyiwu/
+
+# Copy the binary from the builder stage
+COPY --from=builder /app/config ./config
+COPY --from=builder /app/scripts ./scripts
+COPY --from=builder /app/migrations ./migrations
+COPY --from=builder /app/dataset/samples ./dataset/samples
+COPY --from=builder /app/skills/preloaded ./skills/preloaded
+# Keep a read-only backup so bind-mount cannot erase built-in skills
+COPY --from=builder /app/skills/preloaded ./skills/_builtin
+COPY --from=builder /root/.duckdb /home/appuser/.duckdb
+COPY --from=builder /app/WeKnora .
+
+# Copy and make entrypoint script executable
+COPY --from=builder /app/scripts/docker-entrypoint.sh ./scripts/docker-entrypoint.sh
+
+# Make scripts executable
+RUN chmod +x ./scripts/*.sh
+
+# Expose ports
+EXPOSE 8080
+
+
+ENTRYPOINT ["./scripts/docker-entrypoint.sh"]
+CMD ["./WeKnora"]