# Ein Dockerfile, zwei Images: --target hostcheck bzw. --target poller.
# Basis per Digest gepinnt; Abhängigkeiten exakt aus uv.lock.
FROM ghcr.io/astral-sh/uv:0.10.4@sha256:4cac394b6b72846f8a85a7a0e577c6d61d4e17fe2ccee65d9451a8b3c9efb4ac AS uv

FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 AS build
COPY --from=uv /uv /usr/local/bin/uv
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never
WORKDIR /app
COPY pyproject.toml uv.lock README.md ./
RUN uv sync --frozen --no-dev --no-install-project
COPY src ./src
RUN uv sync --frozen --no-dev --no-editable

FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 AS base
ARG VERSION=dev
ARG REVISION=unknown
LABEL org.opencontainers.image.source="https://gitea.i.ivo-zilkenat.de/ivo.zilkenat/ops-kit" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.revision="${REVISION}"
COPY --from=build /app/.venv /app/.venv
ENV PATH="/app/.venv/bin:$PATH" PYTHONUNBUFFERED=1
# Nicht-root. Wer den geteilten Mail-Marker in einem root-Verzeichnis des Hosts
# schreiben muss, setzt im Compose `user: "0"` (siehe README).
RUN useradd --system --uid 10001 --no-create-home ops && mkdir -p /state && chown ops /state
USER 10001
VOLUME ["/state"]

FROM base AS hostcheck
EXPOSE 9465
HEALTHCHECK --interval=60s --timeout=5s --start-period=60s --retries=3 \
  CMD ["python", "-c", "import os,urllib.request; urllib.request.urlopen('http://127.0.0.1:'+os.environ.get('OPS_HEALTH_PORT','9465')+'/healthz', timeout=4)"]
ENTRYPOINT ["ops-hostcheck"]
CMD ["--config", "/config/hostcheck.yaml"]

FROM base AS poller
EXPOSE 9466
HEALTHCHECK --interval=60s --timeout=5s --start-period=60s --retries=3 \
  CMD ["python", "-c", "import os,urllib.request; urllib.request.urlopen('http://127.0.0.1:'+os.environ.get('OPS_HEALTH_PORT','9466')+'/healthz', timeout=4)"]
ENTRYPOINT ["ops-poller"]
CMD ["--config", "/config/poller.yaml"]
