FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    IPQUALITY_DATA_DIR=/data \
    IPQUALITY_API_KEY_FILE=/run/secrets/api_keys \
    IPQUALITY_PROVIDER_KEYS_FILE=/run/secrets/provider_keys \
    IPQUALITY_ENABLE_EXTERNAL_SOURCES=true

WORKDIR /opt/ipquality
RUN groupadd --gid 10001 ipquality \
    && useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin ipquality \
    && install -d -m 0750 -o 10001 -g 10001 /data /data/feeds

COPY requirements.txt ./
RUN pip install --no-cache-dir --disable-pip-version-check -r requirements.txt
COPY app ./app
COPY tests ./tests
COPY scripts ./scripts
COPY deploy ./deploy
COPY Dockerfile compose.yaml LICENSE README.md .dockerignore .gitignore ./
# 镜像内从显式白名单生成源码，不能把宿主密钥或数据库带入 /source。
RUN python scripts/package_source.py --apply --output build/ipquality-source.tar.gz \
    && chmod 0444 build/ipquality-source.tar.gz

LABEL org.opencontainers.image.licenses="AGPL-3.0-only" \
    io.slowstartai.ipquality.reference-revision="87397e2c3196ec796f5477c83343c2354df601ea"
USER 10001:10001
EXPOSE 8080
HEALTHCHECK --interval=20s --timeout=3s --start-period=15s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=2).close()"
CMD ["python", "-m", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080", "--workers", "1", "--no-proxy-headers", "--no-access-log"]
