FROM python:3.12-slim

WORKDIR /app

# Build context is the repo root (see docker-compose.yml) so shared/ is
# copyable; shared/ holds the access-control model used by api + webui.
COPY api/requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY shared /app/shared
COPY api /app/api

WORKDIR /app/api

# shared/ is installed at /app/shared; make it importable from /app/api.
ENV PYTHONPATH=/app

RUN useradd --system --no-create-home api
USER api

CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8443", "--ssl-keyfile", "/certs/server.key", "--ssl-certfile", "/certs/server.crt", "--ssl-ca-certs", "/certs/ca.crt"]