# ──────────────────────────────────────────────────────────────
# Aquilia Production Dockerfile -- rest_api_contract
# Generated by: aq deploy dockerfile
#
# Multi-stage build with security best-practices.
# Override Python version at build time:
#   docker build --build-arg PYTHON_VERSION=3.13 .
# ──────────────────────────────────────────────────────────────

ARG PYTHON_VERSION=3.12

# ── Stage 1: Builder ──────────────────────────────────────────
FROM python:${PYTHON_VERSION}-slim AS builder

WORKDIR /build

# Install build dependencies
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        build-essential \
                    gcc \
                    libffi-dev \
                    libssl-dev && \
    rm -rf /var/lib/apt/lists/*

# Install Python dependencies (aquilia is pulled from PyPI via requirements.txt)
COPY requirements*.txt ./
RUN mkdir -p /install && \
    pip install --no-cache-dir --prefix=/install -r requirements.txt

# ── Stage 2: Production ───────────────────────────────────────
FROM python:${PYTHON_VERSION}-slim AS production

# Labels for container metadata (OCI standard)
ARG APP_VERSION
LABEL org.opencontainers.image.title="rest_api_contract" \
      org.opencontainers.image.description="Aquilia application -- rest_api_contract" \
      org.opencontainers.image.vendor="Aquilia" \
      org.opencontainers.image.version="${APP_VERSION:-1.0.0}" \
      org.opencontainers.image.created="2026-07-21T13:00:22.325794+00:00"

# Security: run as non-root
RUN groupadd -r aquilia && \
    useradd -r -g aquilia -d /app -s /sbin/nologin aquilia

WORKDIR /app

# Install runtime dependencies only
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        curl \
                    tini && \
    rm -rf /var/lib/apt/lists/*

# Copy installed packages from builder
COPY --from=builder /install /usr/local

# Copy application code (aquilia is installed as a PyPI package, not copied)
COPY --chown=aquilia:aquilia . .

# Create directories for runtime data
RUN mkdir -p /app/artifacts && \
    chown -R aquilia:aquilia /app

# Switch to non-root user
USER aquilia

# Environment variables
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    AQUILIA_ENV=prod \
    AQUILIA_MODE=prod \
    AQUILIA_WORKSPACE=/app \
    AQ_SERVER_HOST=0.0.0.0 \
    AQ_SERVER_PORT=8000 \
    AQ_SERVER_WORKERS=2

# Expose port
EXPOSE 8000

# Health check -- integrated with Aquilia fault system
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
    CMD curl -f http://localhost:8000/_health || exit 1

# Use tini as init system for proper signal handling
ENTRYPOINT ["tini", "--"]

# Start Aquilia production server via the built-in entrypoint module.
# aquilia.entrypoint auto-discovers workspace.py and all module manifests
# at import time — no pre-generation step needed.
CMD ["uvicorn", "aquilia.entrypoint:app", \
     "--host", "0.0.0.0", \
     "--port", "8000", \
     "--workers", "2", \
     "--no-access-log"]
