# Fly.io / self-host image for the AgentGov gateway.
#
# HARD RULE (§12.1): this container must NEVER run on a governed developer's
# machine. `agentgov doctor` checks host fingerprint against known developer
# machines and refuses.

FROM python:3.12-slim AS build

WORKDIR /app

ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1 \
    PYTHONDONTWRITEBYTECODE=1

RUN pip install --upgrade pip uv==0.4.20

COPY pyproject.toml uv.lock* README.md /app/
COPY agentgov_gateway /app/agentgov_gateway
RUN uv sync --frozen 2>/dev/null || uv sync


FROM python:3.12-slim AS run

WORKDIR /app

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    AGENTGOV_ENV=production \
    POLICY_CACHE_PATH=/app/.runtime/policy_cache.sqlite \
    EVENT_QUEUE_DIR=/app/.runtime/event_queue

COPY --from=build /app /app

# Non-root user — the vault key never touches root's crash dumps.
RUN useradd -u 10001 -r -s /usr/sbin/nologin gateway \
    && mkdir -p /app/.runtime \
    && chown -R gateway:gateway /app/.runtime
USER gateway

EXPOSE 8000 9090

HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
    CMD python -c "import httpx; httpx.get('http://127.0.0.1:8000/health', timeout=3).raise_for_status()" || exit 1

CMD ["/app/.venv/bin/uvicorn", "agentgov_gateway.main:app", "--host", "0.0.0.0", "--port", "8000"]
