FROM python:3.13-slim

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1

WORKDIR /app

# Runtime dependencies are installed by NAME, not by building this project
# as a wheel: setuptools auto-discovery would fail on the flat layout
# (app/ + migrations/ are two top-level dirs), and the app is run from
# WORKDIR anyway, so there is nothing to install from the source tree.
COPY pyproject.toml ./
RUN pip install --no-cache-dir \
    "fastapi>=0.115" \
    "uvicorn[standard]>=0.32" \
    "sqlalchemy>=2.0" \
    "psycopg[binary]>=3.2" \
    "alembic>=1.14" \
    "pydantic>=2.9" \
    "pydantic-settings>=2.6" \
    "argon2-cffi>=23.1" \
    "paho-mqtt>=2.1" \
    "python-multipart>=0.0.17" \
    "httpx>=0.28" \
    "cryptography>=43.0"

# Source is plain files; uvicorn imports app.main from WORKDIR (/app).
COPY . .

EXPOSE 8000

# uvicorn behind the frontend proxy; bind container-internal only.
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]