FROM python:3.11-slim

# Set working directory
WORKDIR /app

# Single layer for all system setup to minimize image size
RUN apt-get update && apt-get install -y --no-install-recommends \
    sqlite3 curl gosu git \
  && rm -rf /var/lib/apt/lists/* \
  && apt-get clean \
  && groupadd -g 1000 appuser \
  && useradd -u 1000 -g appuser -m appuser

# Install Python dependencies efficiently
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt \
  && pip cache purge \
  && rm -rf ~/.cache/pip

# Copy application files in order of change frequency (for better caching)
COPY VERSION .
COPY core/ ./core/
COPY clients/ ./clients/
COPY nfoguard.py .

# Copy git info to detect branch at runtime
COPY .git/HEAD .git/
COPY .git/refs/ .git/refs/

# Final setup in single layer
RUN mkdir -p /app/data \
  && chown -R appuser:appuser /app \
  && printf '#!/bin/bash\nset -euo pipefail\nPUID=${PUID:-1000}\nPGID=${PGID:-1000}\nif [ "$(id -u)" -eq 0 ]; then\n  groupmod -o -g "$PGID" appuser 2>/dev/null || groupadd -o -g "$PGID" appuser\n  id appuser &>/dev/null || useradd -o -u "$PUID" -g "$PGID" -m appuser\n  usermod -o -u "$PUID" -g "$PGID" appuser 2>/dev/null || true\n  chown -R "$PUID:$PGID" /app || true\n  exec gosu appuser "$@"\nelse\n  exec "$@"\nfi' > /entrypoint.sh \
  && chmod +x /entrypoint.sh

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:8080/health || exit 1

EXPOSE 8080
ENTRYPOINT ["/entrypoint.sh"]
CMD ["python", "nfoguard.py"]