FROM python:3.12-slim-bookworm

ARG SQLITE_ARCHIVE=sqlite-autoconf-3530100.tar.gz
ARG SQLITE_URL=https://www.sqlite.org/2026/sqlite-autoconf-3530100.tar.gz
ARG SQLITE_SHA3_256=36ca143645cf76997d07b66e9244c636b8ccdec64a1d50558259c4e415e6558b
ARG APP_UID=1000
ARG APP_GID=1000

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    LD_LIBRARY_PATH=/usr/local/lib \
    INTRANET_DB_PATH=/runtime/db/data.db \
    INTRANET_BACKUP_DIR=/runtime/backups \
    INTRANET_CACHE_ROOT=/runtime/cache \
    INTRANET_COMPARE_EXPORT_DIR=/runtime/exports/wehago_compare \
    INTRANET_HANMAC_EXPORT_DIR=/runtime/exports/hanmac \
    WEHAGO_SOURCE_ROOT=/source/wehago \
    INTRANET_REQUIRE_SAFE_SQLITE=1

RUN apt-get update \
    && apt-get install -y --no-install-recommends build-essential ca-certificates curl \
    && curl -fsSL "${SQLITE_URL}" -o "/tmp/${SQLITE_ARCHIVE}" \
    && python -c "import hashlib, pathlib; p=pathlib.Path('/tmp/${SQLITE_ARCHIVE}'); actual=hashlib.sha3_256(p.read_bytes()).hexdigest(); expected='${SQLITE_SHA3_256}'; assert actual == expected, (actual, expected)" \
    && mkdir -p /tmp/sqlite-src \
    && tar -xzf "/tmp/${SQLITE_ARCHIVE}" -C /tmp/sqlite-src --strip-components=1 \
    && cd /tmp/sqlite-src \
    && ./configure --prefix=/usr/local --enable-shared --disable-static \
    && make -j2 \
    && make install \
    && ldconfig \
    && python -c "import sqlite3; assert sqlite3.sqlite_version_info >= (3, 51, 3), sqlite3.sqlite_version" \
    && rm -rf /tmp/sqlite-src "/tmp/${SQLITE_ARCHIVE}" \
    && apt-get purge -y --auto-remove build-essential curl \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY requirements.txt /app/requirements.txt
RUN pip install --no-cache-dir -r /app/requirements.txt

COPY . /app

RUN mkdir -p /runtime/db /runtime/backups /runtime/cache /runtime/exports/wehago_compare /runtime/exports/hanmac \
    && groupadd --gid "${APP_GID}" intranet \
    && useradd --create-home --uid "${APP_UID}" --gid "${APP_GID}" intranet \
    && chown -R intranet:intranet /app /runtime

USER intranet
EXPOSE 8010

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8010/health', timeout=3).read()"

CMD ["python", "main.py"]