Hermes Agent

# 国内网络适配版 Dockerfile
# 策略：
#   - apt/apt-get: 用清华镜像源（国内直连很快，不走代理）
#   - npm: 用 npmmirror 镜像源（国内直连）
#   - pip/uv: 赫尔代理直连官方 PyPI（清华镜像 TLS 不稳定）
#   - GitHub/astral.sh 二进制下载: 走 Clash 代理
FROM docker.m.daocloud.io/library/debian:13.4

ENV PYTHONUNBUFFERED=1
ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright

ARG HTTP_PROXY
ARG HTTPS_PROXY
ARG NO_PROXY

# ---------- apt: 替换为清华镜像源 ----------
RUN sed -i 's|deb.debian.org|mirrors.tuna.tsinghua.edu.cn|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
    (echo "deb http://mirrors.tuna.tsinghua.edu.cn/debian trixie main" > /etc/apt/sources.list && \
     echo "deb http://mirrors.tuna.tsinghua.edu.cn/debian trixie-updates main" >> /etc/apt/sources.list && \
     echo "deb http://mirrors.tuna.tsinghua.edu.cn/debian-security trixie-security main" >> /etc/apt/sources.list) && \
    apt-get update && \
    apt-get install -y --no-install-recommends \
        build-essential nodejs npm python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini curl ca-certificates && \
    rm -rf /var/lib/apt/lists/*

RUN useradd -u 10000 -m -d /opt/data hermes

# ---------- gosu: GitHub release，走代理下载 ----------
RUN ARCH=$(dpkg --print-architecture) && \
    curl -fsSL -x "${HTTP_PROXY}" -o /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.19/gosu-${ARCH}" && \
    chmod +x /usr/local/bin/gosu

# ---------- uv: astral.sh，走代理下载 ----------
RUN curl -fsSL -x "${HTTP_PROXY}" https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh && \
    chmod +x /usr/local/bin/uv /usr/local/bin/uvx

WORKDIR /opt/hermes

# ---------- npm: 用国内 npmmirror 镜像源 ----------
RUN npm config set registry https://registry.npmmirror.com

COPY package.json package-lock.json ./
COPY web/package.json web/package-lock.json web/

RUN npm install --prefer-offline --no-audit

RUN apt-get update && \
    npx playwright install --with-deps chromium --only-shell && \
    rm -rf /var/lib/apt/lists/*

RUN cd web && npm install --prefer-offline --no-audit

RUN npm cache clean --force

COPY --chown=hermes:hermes . .

RUN cd web && npm run build

USER root
RUN chmod -R a+rX /opt/hermes

# ---------- pip: uv 走 Clash 代理直连官方 PyPI ----------
RUN uv venv && \
    uv pip install --no-cache-dir -e ".[all]"

ENV HERMES_WEB_DIST=/opt/hermes/hermes_cli/web_dist
ENV HERMES_HOME=/opt/data
ENV PATH="/opt/data/.local/bin:${PATH}"
VOLUME [ "/opt/data" ]
ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/docker/entrypoint.sh" ]