# syntax=docker/dockerfile:1

# --- builder ---------------------------------------------------------------
FROM python:3.13-slim AS builder

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    UV_LINK_MODE=copy \
    UV_COMPILE_BYTECODE=1

COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/

WORKDIR /app

# Resolve and install deps using only the manifest first for better layer caching.
COPY pyproject.toml README.md ./
COPY src ./src

RUN uv sync --no-dev --frozen 2>/dev/null || uv sync --no-dev

# --- runtime ---------------------------------------------------------------
FROM python:3.13-slim AS runtime

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH="/app/.venv/bin:$PATH" \
    # The image serves the network transport; stdio is for locally spawned
    # servers and would be useless in a long-running container.
    PAPERLESS_MCP_TRANSPORT=http \
    # Reachable from outside the container, unlike the CLI's 127.0.0.1 default.
    PAPERLESS_MCP_HOST=0.0.0.0 \
    PAPERLESS_MCP_PORT=8000

# Non-root user.
RUN groupadd --system --gid 1000 app \
    && useradd --system --uid 1000 --gid app --create-home --home-dir /home/app app

WORKDIR /app

COPY --from=builder --chown=app:app /app /app

USER app

EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD python -m paperless_mcp.healthcheck || exit 1

ENTRYPOINT ["paperless-mcp"]
CMD ["--transport", "http"]
