FROM ghcr.io/astral-sh/uv:0.11.14 AS uv

FROM python:3.12-slim

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    JARCA_LEDGER_DB_PATH=/data/ledger.sqlite3 \
    JARCA_MCP_TRANSPORT=streamable-http \
    JARCA_MCP_HOST=0.0.0.0 \
    JARCA_MCP_PORT=8000 \
    JARCA_MCP_STREAMABLE_HTTP_PATH=/mcp \
    HOME=/home/jarca \
    TMPDIR=/tmp \
    PATH=/app/.venv/bin:$PATH

COPY --from=uv /uv /uvx /usr/local/bin/

WORKDIR /app

COPY pyproject.toml uv.lock README.md ./
RUN uv sync --frozen --no-dev --extra dashboard --no-install-project

RUN groupadd --gid 1000 jarca \
    && useradd --uid 1000 --gid 1000 --create-home --home-dir /home/jarca --shell /usr/sbin/nologin jarca \
    && chown -R 1000:1000 /home/jarca \
    && install -d -o 1000 -g 1000 -m 0770 /data

COPY --chown=1000:1000 jarca_ledger_mcp ./jarca_ledger_mcp
COPY --chown=1000:1000 dashboard ./dashboard
RUN uv sync --frozen --no-dev --extra dashboard \
    && chmod -R a+rX /app

VOLUME ["/data"]
EXPOSE 8000 8501

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD python -c "import os, socket; s=socket.create_connection(('127.0.0.1', int(os.getenv('JARCA_MCP_PORT', '8000'))), timeout=3); s.close()"

USER 1000:1000

CMD ["jarca-ledger-mcp"]