FROM node:24-alpine AS frontend
WORKDIR /build
COPY frontend/package*.json ./
RUN --mount=type=secret,id=build_ca \
    if [ -f /run/secrets/build_ca ]; then export NODE_EXTRA_CA_CERTS=/run/secrets/build_ca; fi; \
    npm ci --ignore-scripts
COPY frontend/ ./
RUN npm run build

FROM python:3.12-slim
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PIP_NO_CACHE_DIR=1
WORKDIR /app
COPY requirements.lock ./
COPY pyproject.toml README.md LICENSE ./
COPY src/ ./src/
COPY --from=frontend /build/dist ./frontend/dist/
RUN --mount=type=secret,id=build_ca \
    if [ -f /run/secrets/build_ca ]; then export PIP_CERT=/run/secrets/build_ca; fi; \
    pip install -r requirements.lock \
    && pip install --index-url https://download.pytorch.org/whl/cpu torch==2.6.0+cpu \
    && pip install transformers==4.51.3 safetensors==0.8.0 \
    && pip install --no-deps . \
    && useradd --uid 10001 --create-home gateway
USER gateway
EXPOSE 8000
HEALTHCHECK --interval=15s --timeout=5s --start-period=10s --retries=3 \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health/live', timeout=3)"
CMD ["kjnlae", "serve", "--host", "0.0.0.0"]
