FROM python:3.12-slim-bookworm

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PATH="/opt/venv/bin:$PATH"

WORKDIR /app

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
        ffmpeg \
        tini \
    && rm -rf /var/lib/apt/lists/*

RUN python -m venv /opt/venv

COPY requirements.txt /app/requirements.txt

RUN /opt/venv/bin/pip install --upgrade pip setuptools wheel \
    && /opt/venv/bin/pip install --no-cache-dir -r /app/requirements.txt

COPY app.py network.py /app/
COPY static /app/static

RUN groupadd --gid 10002 app \
    && useradd --uid 10002 --gid app --create-home \
        --home-dir /app --shell /usr/sbin/nologin app \
    && mkdir -p /app/data /tmp \
    && chown -R 10002:10002 /app /opt/venv \
    && chmod 1777 /tmp

USER 10002:10002

EXPOSE 8003

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD curl --fail --silent --show-error http://127.0.0.1:8003/healthz || exit 1

ENTRYPOINT ["/usr/bin/tini","--"]

CMD ["uvicorn","app:app","--host","0.0.0.0","--port","8003","--workers","1","--loop","uvloop","--http","httptools","--proxy-headers","--forwarded-allow-ips","*","--timeout-keep-alive","30","--timeout-graceful-shutdown","30","--limit-concurrency","256","--backlog","2048"]