# Backend image for dev and prod (single image, full dependencies).
# Dev specifics (APP_ENV=dev for autoreload, opencode, SSH keys) arrive via
# devcontainer.json / setup.sh — never via this file.
FROM python:3.12-slim

ENV PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1

COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

# Foundational, inert in prod: non-root user for the editor, sudo for setup,
# openssh-client for the devcontainer post-start hook.
RUN apt-get update \
    && apt-get install -y --no-install-recommends sudo openssh-client \
    && rm -rf /var/lib/apt/lists/* \
    && useradd -m -s /bin/bash vscode \
    && echo "vscode ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/vscode

WORKDIR /srv/kirche-einfach/backend
COPY pyproject.toml alembic.ini entrypoint.sh ./
COPY app ./app
COPY migrations ./migrations
COPY scripts ./scripts
# No lockfile is committed; dependencies resolve at build time.
# Full groups (incl. dev): pytest and friends must work in dev with zero steps.
RUN uv sync && chmod +x entrypoint.sh

ENV FLOWS_WATCH_ENABLED=true
EXPOSE 8000

ENTRYPOINT ["./entrypoint.sh"]