FROM python:3.13-slim

RUN groupadd -g 10001 mailroom && useradd -u 10001 -g mailroom -M -s /usr/sbin/nologin mailroom

WORKDIR /app
COPY pyproject.toml README.md LICENSE ./
COPY mailroom ./mailroom
RUN pip install --no-cache-dir ".[pdf]"

USER mailroom
ENV MAILROOM_DB=/data/mailroom.db \
    CREDENTIALS_DIRECTORY=/run/secrets
VOLUME /data
EXPOSE 8420

# Inside the container mailroom listens on all interfaces; what keeps it private is
# the compose file publishing the port on 127.0.0.1 only. If you write your own run
# command, bind the HOST side to localhost (-p 127.0.0.1:8420:8420) or put an
# authenticated TLS proxy in front. Never publish 8420 to the open internet.
ENTRYPOINT ["mailroom"]
CMD ["serve", "--host", "0.0.0.0", "--port", "8420"]
