FROM python:3.13-slim-trixie@sha256:8d9d0b8bcf6506481eae4907c18f5e3e7902e629f5f6d684f9e7c32e85e3ddf0 AS source
WORKDIR /source
COPY . .
RUN python tools/source_archive.py

FROM python:3.13-slim-trixie@sha256:8d9d0b8bcf6506481eae4907c18f5e3e7902e629f5f6d684f9e7c32e85e3ddf0
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 REMINDHUB_STATE_DIR=/data
WORKDIR /app
COPY requirements.lock .
RUN pip install --no-cache-dir --require-hashes -r requirements.lock \
    && groupadd --gid 10001 remindhub \
    && useradd --uid 10001 --gid 10001 --no-create-home remindhub \
    && mkdir /data && chown 10001:10001 /data
COPY --chown=10001:10001 manage.py ./
COPY --chown=10001:10001 manager ./manager
COPY --chown=10001:10001 devices ./devices
COPY --from=source /source/source.tar.gz /app/source.tar.gz
USER 10001:10001
EXPOSE 8000
CMD ["gunicorn", "manager.wsgi:application", "--bind", "0.0.0.0:8000", "--workers", "1", "--threads", "4", "--timeout", "30", "--max-requests", "1000", "--max-requests-jitter", "100", "--worker-tmp-dir", "/tmp"]
