# Ceiling Guard -- the daemon (and, with a command override, the proxy).
# Zero Python dependencies, so this stays small.
#
#   docker build -t continuity-guard .
#
#   # daemon: mount a config and a dir for the socket + state
#   docker run -d --name cg \
#     -v "$PWD/config.toml:/etc/continuity-guard/config.toml:ro" \
#     -v cg-state:/var/lib/continuity-guard \
#     continuity-guard
#
#   # proxy in the same network namespace as the daemon container
#   docker run -d --name cg-proxy --network container:cg \
#     -v cg-state:/var/lib/continuity-guard \
#     continuity-guard \
#     python -m tools.cg_proxy --upstream http://host.docker.internal:11434 --port 8111
#
# The daemon writes its socket where the config's `socket =` points; keep that
# on the shared volume (e.g. /var/lib/continuity-guard/cg.sock) so the proxy,
# supervisor, or library in another container can reach it.

FROM python:3.12-slim AS base

RUN useradd --system --create-home --home-dir /home/cg cg
WORKDIR /app

COPY pyproject.toml README.md ./
COPY continuity_guard ./continuity_guard
COPY tools ./tools

RUN pip install --no-cache-dir . \
 && mkdir -p /etc/continuity-guard /var/lib/continuity-guard \
 && chown -R cg /var/lib/continuity-guard

# default config location; override by mounting your own or setting CG_CONFIG
ENV CG_CONFIG=/etc/continuity-guard/config.toml \
    PYTHONUNBUFFERED=1 \
    PYTHONPATH=/app
USER cg

# a sane default config baked in (shadow mode, socket on the shared volume)
RUN mkdir -p /home/cg/.config && \
    printf 'socket = "/var/lib/continuity-guard/cg.sock"\ndb = "/var/lib/continuity-guard/state.db"\n[defaults]\nshadow = true\n' \
    > /home/cg/default-config.toml

# if no config is mounted, fall back to the baked default
ENTRYPOINT ["sh", "-c", "exec cg-daemon -c \"${CG_CONFIG}\" 2>/dev/null || exec cg-daemon -c /home/cg/default-config.toml"]
