# Multi-stage Build für OIDC Identity Provider
FROM python:3.10-slim as base

# System dependencies
RUN apt-get update && apt-get install -y \
    gcc \
    postgresql-client \
    && rm -rf /var/lib/apt/lists/*

# Working directory
WORKDIR /app

# Copy requirements first (for better caching)
COPY requirements.txt .

# Install Python dependencies
RUN pip install --no-cache-dir -r requirements.txt gunicorn

# Copy application code
COPY config.py .
COPY models.py .
COPY oidc_server.py .

# Copy app package with services
COPY app/ app/

# Copy templates directory with HTML templates
COPY templates/ templates/

# Copy migrations directory for database schema management
COPY migrations/ migrations/

# Copy instance directory with JWT keys
COPY instance/ instance/

# Copy static directory with CSS files
COPY static/ static/

# Create non-root user and set permissions
RUN useradd -m -u 1000 oidc && chown -R oidc:oidc /app
USER oidc

# Expose port
EXPOSE 5000

# Health check
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD python -c "import requests; requests.get('http://localhost:5000/health')" || exit 1

# Start with Gunicorn (production WSGI server)
CMD ["gunicorn", "--bind", "0.0.0.0:5000", "--workers", "4", "--threads", "2", "--timeout", "60", "oidc_server:app"]
