# Stage 1: Base image with build dependencies
FROM python:3.12-slim-bookworm AS rebase-base

ENV DEBIAN_FRONTEND=noninteractive \
    RUSTUP_HOME=/usr/local/rustup \
    CARGO_HOME=/usr/local/cargo \
    PATH=/usr/local/cargo/bin:$PATH \
    RUSTUP_TOOLCHAIN=nightly \
    CARGO_BUILD_JOBS=1 \
    UV_CONCURRENCY=2 \
    PIP_NO_CACHE_DIR=off

# Force APT repos to HTTPS (your Docker network blocks outbound HTTP/80)
RUN set -eux; \
    if [ -f /etc/apt/sources.list.d/debian.sources ]; then \
      sed -i 's|http://deb.debian.org|https://deb.debian.org|g; s|http://security.debian.org|https://security.debian.org|g' /etc/apt/sources.list.d/debian.sources; \
    fi; \
    if [ -f /etc/apt/sources.list ]; then \
      sed -i 's|http://deb.debian.org|https://deb.debian.org|g; s|http://security.debian.org|https://security.debian.org|g' /etc/apt/sources.list; \
    fi


RUN apt-get update && \
    apt-get install -y --no-install-recommends \
    build-essential \
    ca-certificates \
    git \
    curl \
    gcc \
    g++ \
    libffi-dev \
    libssl-dev \
    pkg-config \
    python3-dev \
    && rm -rf /var/lib/apt/lists/*

RUN --mount=type=cache,id=cargo_registry,target=/usr/local/cargo/registry \
    --mount=type=cache,id=cargo_git,target=/usr/local/cargo/git \
    --mount=type=cache,id=rustup_cache,target=/root/.rustup \
    --mount=type=cache,id=python_wheels,target=/root/.cache/pip \
    set -eux; \
    curl https://sh.rustup.rs -sSf | sh -s -- -y; \
    rustup toolchain install nightly; \
    rustup default nightly; \
    rustup component remove --toolchain nightly rust-docs || true; \
    python -m pip install uv cryptography; \
    rm -rf /tmp/*

# Stage 2: Dependencies builder
FROM rebase-base AS deps-builder

ARG UV_INDEX_DIGITALKIN_USERNAME
ARG UV_INDEX_DIGITALKIN_PASSWORD

ENV UV_CACHE_DIR=/root/.cache/uv \
    UV_INDEX_DIGITALKIN_USERNAME=${UV_INDEX_DIGITALKIN_USERNAME} \
    UV_INDEX_DIGITALKIN_PASSWORD=${UV_INDEX_DIGITALKIN_PASSWORD}

WORKDIR /build

# Copy chainlit_app with its pyproject.toml
COPY . ./scripts/chainlit_app/

RUN --mount=type=cache,id=python_wheels,target=/root/.cache/pip \
    --mount=type=cache,id=uv_cache,target=/root/.cache/uv \
    uv venv --python 3.12 && \
    uv pip install --cache-dir ${UV_CACHE_DIR} -r scripts/chainlit_app/pyproject.toml scripts/chainlit_app/Dockerfile/digitalkin-1.0.0.dev0.tar.gz

# Stage 3: Certificate builder
FROM deps-builder AS cert-builder

ARG CHAINLIT_URL=localhost

COPY Dockerfile/generate_certificates.py ./scripts/

RUN set -eux; \
    mkdir -p /certs; \
    echo "Generating certificates for ${CHAINLIT_URL}"; \
    python scripts/generate_certificates.py \
    --output-dir /certs \
    --server-name "${CHAINLIT_URL}" \
    --dns-names "${CHAINLIT_URL}" localhost \
    --ip-addresses 127.0.0.1

# Stage 4: Final runtime
FROM python:3.12-slim-bookworm AS runtime

ARG CHAINLIT_CERTIFICATE_VOLUME=/certs

# Force APT repos to HTTPS (your Docker network blocks outbound HTTP/80)
RUN set -eux; \
    if [ -f /etc/apt/sources.list.d/debian.sources ]; then \
      sed -i 's|http://deb.debian.org|https://deb.debian.org|g; s|http://security.debian.org|https://security.debian.org|g' /etc/apt/sources.list.d/debian.sources; \
    fi; \
    if [ -f /etc/apt/sources.list ]; then \
      sed -i 's|http://deb.debian.org|https://deb.debian.org|g; s|http://security.debian.org|https://security.debian.org|g' /etc/apt/sources.list; \
    fi


RUN apt-get update && \
    apt-get install -y --no-install-recommends \
    libffi-dev \
    libssl-dev \
    && rm -rf /var/lib/apt/lists/*

RUN groupadd -r appuser && useradd -r -g appuser appuser

WORKDIR /app

COPY --from=deps-builder /build/.venv /.venv
COPY --from=cert-builder /certs ${CHAINLIT_CERTIFICATE_VOLUME}
COPY --from=deps-builder /build/scripts/chainlit_app/ /app/chainlit_app/
COPY Dockerfile/entrypoint.sh ./entrypoint.sh

RUN chmod +x ./entrypoint.sh

ENV PATH="/.venv/bin:$PATH" \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

RUN set -eux; \
    mkdir -p ${CHAINLIT_CERTIFICATE_VOLUME}; \
    chmod -R 700 ${CHAINLIT_CERTIFICATE_VOLUME}; \
    chown -R appuser:appuser /app ${CHAINLIT_CERTIFICATE_VOLUME} || true

USER appuser

EXPOSE 8001 50057

CMD ["/.venv/bin/python", "-m", "chainlit", "run", "chainlit_app/main.py", "--host", "0.0.0.0", "--port", "8001"]