FROM python:3.13-slim

RUN DEBIAN_FRONTEND=noninteractive apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        iputils-ping \
        # NUT (Network UPS Tools) — only used when NUT_MANAGED=1
        nut \
        nut-client \
        # gosu — minimal privilege-drop tool used by entrypoint.sh
        gosu \
    && rm -rf /var/lib/apt/lists/*

# Upgrade pip to suppress the version notice
RUN pip install --upgrade pip

WORKDIR /app

COPY pyproject.toml .
COPY fabledscryer/ fabledscryer/
RUN pip install --no-cache-dir .

COPY alembic.ini .
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# Runtime directories — owned by app user.
# The container runs as root so the entrypoint can start NUT daemons (USB
# access requires root); it drops to 'app' (uid 1000) via gosu before
# launching fabledscryer.
RUN useradd -m -u 1000 app \
    && mkdir -p /data/playbook_cache /data/plugins \
    && chown -R app:app /data /app

EXPOSE 5000

ENTRYPOINT ["/entrypoint.sh"]
CMD ["fabledscryer", "--host", "0.0.0.0", "--port", "5000"]