FROM python:3.11-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1

WORKDIR /app

RUN groupadd --gid 10001 fluxip \
    && useradd --uid 10001 --gid fluxip --home-dir /app --no-create-home \
        --shell /usr/sbin/nologin fluxip

COPY requirements.txt ./
RUN python -m pip install --upgrade pip "setuptools>=83" \
    && python -m pip install --requirement requirements.txt

COPY app ./app
COPY migrations ./migrations
COPY deploy/backup.py ./deploy/backup.py

RUN mkdir -p /app/data /app/secrets /app/backups \
    && chown -R fluxip:fluxip /app/data /app/secrets /app/backups

USER fluxip

EXPOSE 8787
VOLUME ["/app/data", "/app/secrets", "/app/backups"]

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8787/readyz', timeout=3).read()"]

# The scheduler and recovery loop require exactly one web worker.
CMD ["python", "-m", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8787", "--workers", "1"]