FROM python:3.12-slim AS builder

WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

FROM python:3.12-slim

WORKDIR /app

# Только бинарники и зависимости — без сборщика
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin

COPY app/ app/
COPY .env.example .env

# Read-only rootfs — только /data для БД и /logs для аудита
RUN mkdir -p /data /logs && chmod 755 /data /logs

# Не root
RUN useradd -m -u 1000 md2vk && chown -R md2vk:md2vk /app /data /logs
USER md2vk

EXPOSE 8420

# Ключ шифрования — через Docker secret /run/secrets/token_encryption_key
ENV TOKEN_ENCRYPTION_KEY_FILE=/run/secrets/token_encryption_key
ENV DATABASE_URL=sqlite+aiosqlite:////data/md2vk.db
ENV AUDIT_LOG_DIR=/logs

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8420"]