# Multi-stage Build für OIDC Identity Provider
FROM python:3.10-slim as base

# System dependencies (including openssl for JWT key generation)
RUN apt-get update && apt-get install -y \
    gcc \
    postgresql-client \
    openssl \
    && rm -rf /var/lib/apt/lists/*

# Working directory
WORKDIR /app

# Copy requirements first (for better caching)
COPY requirements.txt .

# Install Python dependencies
RUN pip install --no-cache-dir -r requirements.txt gunicorn

# Copy application code
COPY config.py .
COPY models.py .
COPY oidc_server.py .

# Copy app package with services
COPY app/ app/

# Copy templates directory with HTML templates
COPY templates/ templates/

# Copy migrations directory for database schema management
COPY migrations/ migrations/

# Copy static directory with CSS files
COPY static/ static/

# Copy entrypoint script for initialization
COPY docker-entrypoint.sh /app/docker-entrypoint.sh

# Make entrypoint script executable and create instance directory
RUN chmod +x /app/docker-entrypoint.sh && mkdir -p /app/instance

# Create non-root user and set permissions
RUN useradd -m -u 1000 oidc && chown -R oidc:oidc /app
USER oidc

# Expose port
EXPOSE 5000

# Health check
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD python -c "import requests; requests.get('http://localhost:5000/health')" || exit 1

# Set entrypoint script to handle initialization
ENTRYPOINT ["/app/docker-entrypoint.sh"]

# Start with Gunicorn (production WSGI server)
CMD ["gunicorn", "--bind", "0.0.0.0:5000", "--workers", "4", "--threads", "2", "--timeout", "60", "oidc_server:app"]