# Exact base pin + lock-file installs: the same inputs build the same image.
# The apt upgrade pulls Debian security fixes newer than the base snapshot; the
# Trivy gate in CI blocks on fixable CVEs, so skipping it would rot the build.
FROM python:3.13.12-slim

RUN apt-get update && apt-get -y --no-install-recommends upgrade \
 && rm -rf /var/lib/apt/lists/*

RUN groupadd -g 10001 mailroom && useradd -u 10001 -g mailroom -M -s /usr/sbin/nologin mailroom

WORKDIR /app
COPY pyproject.toml uv.lock README.md LICENSE ./
# Resolve nothing at build time: export the committed lock and install exactly that.
RUN pip install --no-cache-dir uv==0.9.5 \
 && uv export --frozen --no-dev --no-emit-project --extra pdf --no-hashes -o /tmp/requirements.txt \
 && pip install --no-cache-dir -r /tmp/requirements.txt \
 && pip uninstall -y uv
COPY mailroom ./mailroom
RUN pip install --no-cache-dir --no-deps .

USER mailroom
ENV MAILROOM_DB=/data/mailroom.db \
    CREDENTIALS_DIRECTORY=/run/secrets
VOLUME /data
EXPOSE 8420

# Inside the container mailroom listens on all interfaces; what keeps it private is
# the compose file publishing the port on 127.0.0.1 only. If you write your own run
# command, bind the HOST side to localhost (-p 127.0.0.1:8420:8420) or put an
# authenticated TLS proxy in front. Never publish 8420 to the open internet.
ENTRYPOINT ["mailroom"]
CMD ["serve", "--host", "0.0.0.0", "--port", "8420"]
