FROM python:3.12-slim

# Source-commit provenance — readable via `docker inspect` so the drift detector
# reads the baked commit directly instead of guessing (closes ovui_commit_drift).
# Passed by jambot-build-images.sh as: --build-arg SOURCE_COMMIT=$(git rev-parse --short HEAD)
ARG SOURCE_COMMIT=unknown
LABEL com.jambot.source_commit=$SOURCE_COMMIT

WORKDIR /app

# System deps for cryptography, audio processing, vision, and canvas features
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential libffi-dev \
    libgl1 libglib2.0-0 \
    ffmpeg \
    libsndfile1 \
    git && \
    rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY . .

# Version stamp — auto-detect from git, with build-arg override for CI
ARG BUILD_COMMIT=""
ARG BUILD_BRANCH=""
ARG BUILD_DATE=""
RUN COMMIT="${BUILD_COMMIT:-$(git -C /app rev-parse --short HEAD 2>/dev/null || echo unknown)}" && \
    BRANCH="${BUILD_BRANCH:-$(git -C /app rev-parse --abbrev-ref HEAD 2>/dev/null || echo unknown)}" && \
    DATE="${BUILD_DATE:-$(git -C /app log -1 --format=%cI 2>/dev/null || echo unknown)}" && \
    echo "{\"commit\":\"${COMMIT}\",\"branch\":\"${BRANCH}\",\"date\":\"${DATE}\"}" > /app/version.json

# Writable dirs for runtime data
RUN mkdir -p runtime/uploads runtime/canvas-pages runtime/known_faces runtime/music runtime/generated_music runtime/faces runtime/transcripts runtime/issue-reports

# Run as non-root user
RUN useradd -m -u 1001 appuser && chown -R appuser:appuser /app
USER appuser

# Allow git operations in /app (owner may differ between build and runtime)
RUN git config --global --add safe.directory /app

# Bind to all interfaces inside the container
ENV HOST=0.0.0.0

EXPOSE 5001

ENTRYPOINT ["./entrypoint.sh"]
CMD ["python3", "server.py"]