# syntax=docker/dockerfile:1

# ── Stage 1: builder ──────────────────────────────────────────────────────────
# Install build tools and the package with all server dependencies.
# Keeping build-time deps in this stage prevents them from bloating the final image.
FROM python:3.12-slim AS builder

WORKDIR /build

# gcc is required by some compiled extensions pulled in via uvicorn[standard].
# git + openssh-client stay here only if the GitLedger is used at build time;
# the runtime stage brings them back for live git operations.
RUN apt-get update \
    && apt-get install -y --no-install-recommends gcc \
    && rm -rf /var/lib/apt/lists/*

# Copy only what pip needs to resolve and install the package.
COPY pyproject.toml README.md ./
# docs/SPEC.md is referenced by README — include it so hatchling doesn't fail.
COPY docs/SPEC.md docs/SPEC.md
COPY swarm_at/ ./swarm_at/

# Install into /install so we can COPY the whole prefix into the runtime stage.
RUN pip install --no-cache-dir --prefix=/install ".[server,mcp]"


# ── Stage 2: runtime ─────────────────────────────────────────────────────────
# Lean image: no compiler, no build cache.
FROM python:3.12-slim AS runtime

LABEL org.opencontainers.image.title="swarm.at API" \
      org.opencontainers.image.description="Git-native settlement protocol for AI agent workflows" \
      org.opencontainers.image.url="https://swarm.at" \
      org.opencontainers.image.source="https://github.com/Mediaeater/swarm-at-ledger" \
      org.opencontainers.image.licenses="MIT"

# git + openssh-client are needed at runtime for GitLedger push/pull operations.
RUN apt-get update \
    && apt-get install -y --no-install-recommends git openssh-client \
    && rm -rf /var/lib/apt/lists/*

# Pre-configure git identity and cache the GitHub host key.
# These run as root before dropping privileges so /root/.ssh is accessible.
RUN git config --global user.email "ledger@swarm.at" \
    && git config --global user.name "swarm.at" \
    && mkdir -p /root/.ssh \
    && ssh-keyscan github.com >> /root/.ssh/known_hosts 2>/dev/null

# Non-root user — running as root inside a container is unnecessary risk.
# The /data volume for ledger storage is created here and owned by this user.
RUN useradd --create-home --shell /bin/bash swarm \
    && mkdir -p /data/ledger-repo \
    && chown -R swarm:swarm /data

USER swarm
WORKDIR /home/swarm

# Pull in the installed packages from the builder stage.
COPY --from=builder /install /usr/local

# Prevent .pyc files and force stdout/stderr to be unbuffered (important for log streaming).
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1
ENV PORT=8000

EXPOSE 8000

# --proxy-headers: trust X-Forwarded-* from Railway / any reverse proxy.
# --forwarded-allow-ips "*": Railway terminates TLS upstream, so all proxy IPs are valid.
# Workers default to 1; scale via replica count at the orchestrator level instead of
# stuffing multiple workers into one container (better for Railway's per-instance billing).
CMD ["uvicorn", "swarm_at.api.main:app", \
     "--host", "0.0.0.0", \
     "--port", "8000", \
     "--proxy-headers", \
     "--forwarded-allow-ips", "*"]
