FROM python:3.12-slim

# WeasyPrint braucht diese nativen Libs zum PDF-Rendern (Pango/Cairo/GDK-Pixbuf).
# postgresql-client liefert pg_dump fuers System-Backup (app/backup.py) - der
# Python-Postgres-Treiber (psycopg) kann selbst keinen Dump erzeugen.
# tesseract-ocr (+ -deu Sprachpaket) fuer die eGK-Kartenerfassung
# (app/egk_ocr.py) - bewusst offline/kostenlos statt einer Cloud-Vision-API,
# siehe CLAUDE.md.
RUN apt-get update && apt-get install -y --no-install-recommends \
    libpango-1.0-0 \
    libpangocairo-1.0-0 \
    libcairo2 \
    libgdk-pixbuf-2.0-0 \
    libffi8 \
    shared-mime-info \
    fonts-dejavu-core \
    postgresql-client \
    tesseract-ocr \
    tesseract-ocr-deu \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY . .

RUN useradd --create-home appuser \
    && mkdir -p /app/app/uploads /app/app/backups \
    && chown -R appuser:appuser /app
USER appuser

EXPOSE 5050

CMD ["sh", "-c", "alembic upgrade head && gunicorn app.main:app -k uvicorn.workers.UvicornWorker -w ${GUNICORN_WORKERS:-2} -b 0.0.0.0:5050"]
