FROM python:3.14-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1

WORKDIR /app

RUN groupadd --system portal \
    && useradd --system --gid portal --home-dir /app portal

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY backend ./backend
COPY frontend ./frontend
COPY scripts ./scripts
COPY sql ./sql
COPY data ./data

RUN mkdir -p /app/uploads /app/logs /app/backups \
    && chown -R portal:portal /app

USER portal

EXPOSE 8005

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8005/api/health/live', timeout=3)" || exit 1

CMD ["python", "scripts/run_production.py"]