FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app

RUN addgroup --system updateapp && adduser --system --ingroup updateapp updateapp

COPY server/requirements.txt ./requirements.txt
RUN pip install --no-cache-dir -r requirements.txt

COPY server/main.py server/db.py server/minio_tool.py server/tables.sql ./
COPY --chown=updateapp:updateapp client/admin.html ./admin.html

RUN mkdir -p /data/uploads /data/upload_spool /run/secrets/update-keys \
    && chown -R updateapp:updateapp /app /data \
    && chmod 644 /app/admin.html

USER updateapp

EXPOSE 8000

HEALTHCHECK --interval=15s --timeout=3s --start-period=10s --retries=3 \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=2)"

CMD ["python", "main.py"]