Update Dockerfile

Dockerfile

@@ -1,8 +1,22 @@
 FROM node:20-slim AS builder
 WORKDIR /app
-RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+
+# 安装编译 better-sqlite3 所需的工具
+RUN apt-get update && apt-get install -y \
+    git \
+    python3 \
+    make \
+    g++ \
+    && rm -rf /var/lib/apt/lists/*
+
+# 克隆 FreeLLMAPI 仓库（使用 GitHub 镜像加速，可选）
 RUN git clone https://github.com/tashfeenahmed/freellmapi.git .
-RUN npm install
+
+# 安装依赖（使用国内 npm 镜像加速，可选）
+RUN npm config set registry https://registry.npmmirror.com && \
+    npm install
+
+# 构建项目（生成 dist 目录）
 RUN npm run build
 
 # --- 生产运行环境 ---
@@ -10,41 +24,38 @@ FROM node:20-slim AS runner
 WORKDIR /app
 
 COPY --from=builder /app ./
+
+# 创建数据目录
 RUN mkdir -p /data/freellm
 
-# 1. 前端静态路由修复
+# 前端静态文件适配（如果存在）
 RUN cp -r client/dist/* server/dist/public/ 2>/dev/null || cp -r client/dist/* server/public/ 2>/dev/null || true
 
-# 2. 注入基础配置
+# 设置运行端口（Hugging Face 要求 7860）
 EXPOSE 7860
 ENV PORT=7860
-ENV NODE_ENV=production
-ENV DATABASE_URL="file:/data/database.sqlite"
-
-# 3. 【无损看门狗】：直接把拦截逻辑写进一个独立的中间件，然后利用 Node.js 极低层的 http 模块拦截器
-# 无论项目底层怎么写、变量叫什么名字，只要请求进来，首先必过此关，绝不引发任何语法冲突！
-RUN echo "import fs from 'fs';" > security.js && \
-    echo "const file = 'server/dist/index.js';" >> security.js && \
-    echo "if (fs.existsSync(file)) {" >> security.js && \
-    echo "  let content = fs.readFileSync(file, 'utf8');" >> security.js && \
-    echo "  const injectCode = \` \
-import http from 'http'; \
-const originalCreateServer = http.createServer; \
-http.createServer = function(onion) { \
-  return originalCreateServer.call(this, (req, res) => { \
-    const user = process.env.SPACE_BASIC_AUTH_USERNAME || 'admin'; \
-    const pass = process.env.SPACE_BASIC_AUTH_PASSWORD || 'admin123'; \
-    if (req.url.startsWith('/v1')) return onion(req, res); \
-    const b64auth = (req.headers.authorization || '').split(' ')[1] || ''; \
-    const [login, password] = Buffer.from(b64auth, 'base64').toString().split(':'); \
-    if (login === user && password === pass) return onion(req, res); \
-    res.statusCode = 401; \
-    res.setHeader('WWW-Authenticate', 'Basic realm=\"Secure\"'); \
-    res.end('Unauthorized'); \
-  }); \
-}; \n\`;" >> security.js && \
-    echo "  fs.writeFileSync(file, injectCode + content, 'utf8');" >> security.js && \
-    echo "}" >> security.js
-
-# 4. 完美运行命令
+NODE_ENV=production
+DATABASE_URL="file:/data/database.sqlite"
+
+# 可选：添加简单的 Basic Auth 保护（防止你的网关被公开滥用）
+# 你可以在 Hugging Face Space 的 Settings -> Repository secrets 中设置 SPACE_BASIC_AUTH_USERNAME 和 SPACE_BASIC_AUTH_PASSWORD
+RUN echo "import http from 'http';" > security.js && \
+    echo "const originalCreateServer = http.createServer;" >> security.js && \
+    echo "http.createServer = function(onRequest) {" >> security.js && \
+    echo "  return originalCreateServer.call(this, (req, res) => {" >> security.js && \
+    echo "    const auth = req.headers.authorization || '';" >> security.js && \
+    echo "    const b64auth = auth.split(' ')[1] || '';" >> security.js && \
+    echo "    const [user, pwd] = Buffer.from(b64auth, 'base64').toString().split(':');" >> security.js && \
+    echo "    const validUser = process.env.SPACE_BASIC_AUTH_USERNAME || 'admin';" >> security.js && \
+    echo "    const validPwd = process.env.SPACE_BASIC_AUTH_PASSWORD || 'admin123';" >> security.js && \
+    echo "    if (req.url.startsWith('/v1') || (user === validUser && pwd === validPwd)) {" >> security.js && \
+    echo "      return onRequest(req, res);" >> security.js && \
+    echo "    }" >> security.js && \
+    echo "    res.statusCode = 401;" >> security.js && \
+    echo "    res.setHeader('WWW-Authenticate', 'Basic realm=\"FreeLLMAPI\"');" >> security.js && \
+    echo "    res.end('Unauthorized');" >> security.js && \
+    echo "  });" >> security.js && \
+    echo "};" >> security.js
+
+# 启动命令：链接数据目录、注入安全中间件、设置 ENCRYPTION_KEY、启动服务
 CMD ["sh", "-c", "rm -rf /app/server/data && ln -s /data/freellm /app/server/data && node security.js && export ENCRYPTION_KEY=$(node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\") && node server/dist/index.js"]