# Backend image for dev and prod (single image, full dependencies).
# Dev specifics (APP_ENV=dev for autoreload, opencode, SSH keys) arrive via
# devcontainer.json / setup.sh — never via this file.
FROM python:3.12-slim

ENV PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    # Venv + managed Python live outside the repo bind-mount: a venv under
    # backend/ used to be shadowed by a named volume (empty on first start)
    # and backed by a root-owned interpreter vscode could not execute.
    # /opt is image-local, world-readable, identical in dev and prod.
    UV_PYTHON_INSTALL_DIR=/opt/python \
    UV_PROJECT_ENVIRONMENT=/opt/venv
ENV PATH="/opt/venv/bin:$PATH"

COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

# Foundational, inert in prod: non-root user for the editor, sudo for setup,
# openssh-client for the devcontainer post-start hook, curl for the opencode
# installer in setup.sh, git for the VS Code source-control view, gosu to
# drop privileges before serving (the server never runs as root).
RUN apt-get update \
    && apt-get install -y --no-install-recommends sudo openssh-client curl git ca-certificates gosu \
    && rm -rf /var/lib/apt/lists/* \
    && useradd -m -s /bin/bash vscode \
    && echo "vscode ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/vscode \
    && mkdir -p /opt/python /opt/venv \
    && chmod 755 /opt/python /opt/venv

WORKDIR /srv/kirche-einfach/backend
COPY pyproject.toml alembic.ini entrypoint.sh ./
COPY app ./app
COPY migrations ./migrations
COPY scripts ./scripts
# No lockfile is committed; dependencies resolve at build time.
# Full groups (incl. dev): pytest and friends must work in dev with zero steps.
# a+rX: the image builds as root, but the attached devcontainer runs as vscode.
RUN uv sync && chmod +x entrypoint.sh && chmod -R a+rX /opt/python /opt/venv

ENV FLOWS_WATCH_ENABLED=true
EXPOSE 8000

# Explicit interpreter: the repo bind-mount shadows the image at runtime and
# git tracks entrypoint.sh as 100644, so the exec bit cannot be relied on.
ENTRYPOINT ["/bin/sh", "./entrypoint.sh"]