FROM python:3.12-slim

ENV PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

RUN apt-get update && \
    apt-get install -y --no-install-recommends ffmpeg curl && \
    rm -rf /var/lib/apt/lists/*

# Unprivilegierter Laufzeit-User (UID/GID per PUID/PGID zur Laufzeit anpassbar)
RUN groupadd -g 1000 app && \
    useradd -u 1000 -g app -M -d /nonexistent -s /usr/sbin/nologin app

WORKDIR /app

COPY bin/backend/requirements.txt .
RUN pip install -r requirements.txt

# Code bleibt root-gehörig und für den app-User schreibgeschützt
COPY bin/backend/ /app/
COPY bin/frontend/ /app/frontend/
COPY bin/config.yml.dist /app/config.yml.dist
COPY bin/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh

RUN sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh && \
    chmod 755 /usr/local/bin/docker-entrypoint.sh && \
    mkdir -p /app/data/recordings && \
    chown -R app:app /app/data

ARG APP_VERSION=dev
ENV APP_VERSION=${APP_VERSION}
ENV DATA_DIR=/app/data
ENV STATIC_DIR=/app/frontend/static
ENV PUID=1000 \
    PGID=1000 \
    RECORDING_ROOTS=/app/data/recordings:/recordings

EXPOSE 8484

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD curl -f http://localhost:8484/api/health || exit 1

ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
CMD ["python", "app.py"]