# python:3.12-slim-bookworm (glibc, not Alpine): numpy/beets/mutagen need
# manylinux wheels — Alpine's musl libc forces a from-source numpy build and
# is a known source of breakage for this exact stack.
FROM python:3.12-slim-bookworm AS builder

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    && rm -rf /var/lib/apt/lists/*

RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

COPY requirements.txt /tmp/requirements.txt
RUN pip install --no-cache-dir -r /tmp/requirements.txt


FROM python:3.12-slim-bookworm AS runtime

# libicu72: sldl (.NET self-contained publish) runtime dependency.
# ffmpeg: convert-m4a.sh. libchromaprint-tools: fpcalc for fingerprinting.
# gawk: dedup-library.sh's Pass 2-4 use gensub() and POSIX bracket classes
# that plain mawk (Debian's default /usr/bin/awk) doesn't support -- it
# silently threw "syntax error" on every run, so Pass 2-4 dedup detection
# has been a no-op in every deployed image so far. Scripts now invoke
# `gawk` explicitly rather than relying on the `awk` alternative.
RUN apt-get update && apt-get install -y --no-install-recommends \
    libicu72 \
    ca-certificates \
    ffmpeg \
    libchromaprint-tools \
    flac \
    id3v2 \
    curl \
    gawk \
    && rm -rf /var/lib/apt/lists/*

COPY --from=builder /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

RUN groupadd -g 1000 alembic && \
    useradd -u 1000 -g 1000 -m -s /usr/sbin/nologin alembic

WORKDIR /app

COPY app/ /app/app/
COPY pipeline/ /app/pipeline/
COPY schema/ /app/schema/
COPY entrypoint.sh /app/entrypoint.sh

RUN chmod +x /app/entrypoint.sh /app/pipeline/sldl /app/pipeline/bin/*.sh /app/pipeline/lib/*.sh /app/pipeline/lib/manual/* && \
    chown -R alembic:alembic /app

USER alembic

ENV ALEMBIC_CONFIG_DIR=/config \
    MUSIC_DATA_DIR=/data/music \
    PIPELINE_DIR=/app/pipeline \
    ALEMBIC_PORT=8420

EXPOSE 8420

ENTRYPOINT ["/app/entrypoint.sh"]