# Thermograph frontend: server-rendered content pages, the interactive tool's
# SPA shells, and every static asset. Split from the monorepo (repo-split
# Stage 7). No migrations, no DB, no pre-boot logic -- a plain shell-form CMD
# is enough (unlike backend, no separate entrypoint script needed).
FROM python:3.12-slim

RUN apt-get update \
    && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt /tmp/requirements.txt
RUN pip install --no-cache-dir -r /tmp/requirements.txt

COPY . /app/

RUN useradd --system --create-home --uid 10001 thermograph \
    && chown -R thermograph:thermograph /app

USER thermograph
WORKDIR /app

ENV PORT=8080 \
    WORKERS=1 \
    THERMOGRAPH_BASE=/ \
    PYTHONUNBUFFERED=1

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
    CMD curl -fsS http://127.0.0.1:${PORT}/healthz || exit 1

# Worker count is env-driven (mirrors thermograph-backend's Dockerfile/
# entrypoint WORKERS pattern) so infra can raise it later with no code
# change. Default of 1 preserves today's exact behavior (no --workers was
# ever passed before). api_client's TTL cache and register()'s IndexNow-key
# handling are both in-process only -- multiple workers just each keep their
# own independent cache, and the IndexNow key is fetched fresh FROM the
# backend by every worker's own boot, so there's no cross-worker state to
# diverge -- safe to raise whenever infra wants the throughput.
CMD uvicorn app:app --host 0.0.0.0 --port ${PORT} --workers ${WORKERS:-1}