FROM python:3.12-slim

# Install uv
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

# Set working directory
WORKDIR /app

# Copy dependency metadata first (for layer caching)
COPY pyproject.toml uv.lock README.md LICENSE ./

# Install dependencies only (cached until pyproject.toml or uv.lock change)
RUN uv sync --frozen --no-install-project --no-dev

# Copy source and install the local package
COPY src/ ./src/
RUN uv sync --frozen --no-dev

# Run as a non-root user (least privilege). The code stays root-owned and
# read-only for this user: the app writes nothing under /app, and a
# recursive chown would copy the whole virtualenv into a new layer on
# every build.
RUN useradd --create-home --uid 10001 app
USER app

ENV PORT=8501

# Umami analytics — runtime env vars set in Coolify; empty default = inert.
ENV UMAMI_DOMAIN="" \
    UMAMI_ID=""

EXPOSE 8501

HEALTHCHECK --interval=10s --timeout=3s --start-period=5s \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:${PORT}/api/health')" || exit 1

CMD /app/.venv/bin/uvicorn simulator.server:app --host 0.0.0.0 --port ${PORT}
