FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    VERIDROP_JOBS_DIR=/data/jobs \
    VERIDROP_MAX_INFLIGHT=2 \
    VERIDROP_REPORT_RETENTION_DAYS=7 \
    VERIDROP_SOURCE_ARCHIVE=/opt/apikl-veridrop-source.tar.gz

WORKDIR /opt/veridrop

RUN groupadd --gid 10001 veridrop \
    && useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin veridrop

COPY LICENSE README.md DESIGN.md SECURITY.md pyproject.toml ./
COPY src ./src
COPY web ./web
COPY tests ./tests
COPY Dockerfile docker-compose.yml .dockerignore APIKL-README.md ./

RUN python -m pip install --no-cache-dir ".[web]" \
    && python -c "import tarfile; from pathlib import Path; root=Path('/opt/veridrop'); out=Path('/opt/apikl-veridrop-source.tar.gz'); files=['LICENSE','README.md','DESIGN.md','SECURITY.md','pyproject.toml','Dockerfile','docker-compose.yml','.dockerignore','APIKL-README.md','src','web','tests']; tf=tarfile.open(out,'w:gz'); [tf.add(root/p,arcname='apikl-veridrop/'+p) for p in files]; tf.close()" \
    && mkdir -p /data/jobs \
    && chown -R veridrop:veridrop /data

USER 10001:10001

EXPOSE 8000

CMD ["python", "-m", "uvicorn", "web.server:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1", "--no-server-header", "--log-level", "info"]
