FROM python:3.13-slim

RUN DEBIAN_FRONTEND=noninteractive apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        iputils-ping \
        # gosu — minimal privilege-drop tool used by entrypoint.sh
        gosu \
        # openssh-client — ansible-playbook reaches remote hosts over ssh
        openssh-client \
        # sshpass — Ansible shells out to it for first-contact password SSH
        # (provisioning a fresh host before the managed key is installed)
        sshpass \
    && rm -rf /var/lib/apt/lists/*

# Upgrade pip to suppress the version notice
RUN pip install --upgrade pip

WORKDIR /app

COPY pyproject.toml .
COPY steward/ steward/
# .[ansible] pulls the full Ansible package so the playbook runner works in-image.
RUN pip install --no-cache-dir '.[ansible]'

COPY alembic.ini .
# First-party plugins ship inside the image (bundled root at /app/plugins).
# Third-party plugins are mounted at runtime into the external root
# (STEWARD_PLUGIN_DIR, default /data/plugins).
COPY plugins/ plugins/
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# Runtime directories — owned by app user. The container starts as root
# so the entrypoint can fix up /data permissions if needed, then drops to
# 'app' (uid 1000) via gosu before launching steward.
RUN useradd -m -u 1000 app \
    && mkdir -p /data/playbook_cache /data/plugins \
    && chown -R app:app /data /app

EXPOSE 5000

ENTRYPOINT ["/entrypoint.sh"]
CMD ["steward", "--host", "0.0.0.0", "--port", "5000"]