# syntax=docker/dockerfile:1.7
FROM python:3.13-slim-bookworm AS runtime

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_DEFAULT_INDEX=https://pypi.org/simple \
    PATH="/app/.venv/bin:$PATH"

RUN apt-get update \
    && apt-get install -y --no-install-recommends curl ca-certificates libpq5 \
    && rm -rf /var/lib/apt/lists/*

COPY --from=ghcr.io/astral-sh/uv:0.10.0 /uv /uvx /bin/
WORKDIR /app

RUN addgroup --system app \
    && adduser --system --ingroup app --home /app --no-create-home app \
    && mkdir -p /app \
    && chown -R app:app /app

COPY pyproject.toml uv.lock ./
RUN uv sync --frozen --no-dev --no-install-project

COPY . .
RUN uv sync --frozen --no-dev \
    && chmod +x scripts/*.sh \
    && DJANGO_DEBUG=0 \
       DJANGO_SECRET_KEY=build-only-static-manifest-key-not-used-at-runtime-000000000000 \
       PUBLIC_BASE_URL=https://build.invalid \
       python manage.py collectstatic --noinput \
    && mkdir -p /app/media /app/logs /app/local \
    && chown -R app:app /app \
    && chmod -R 0775 /app/media /app/logs /app/local /app/staticfiles /app/.venv

USER app

EXPOSE 8080
ENTRYPOINT ["/app/scripts/entrypoint.sh"]
CMD ["gunicorn", "config.wsgi:application", "--bind", "0.0.0.0:8080", "--workers", "2", "--threads", "4", "--timeout", "90", "--no-control-socket"]