# Multi-stage production build for Notaris & PPAT Smart Legal Workspace Engine
# Base image: Python 3.12 Slim
FROM python:3.12-slim as base

# Set environment variables
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    DEBIAN_FRONTEND=noninteractive \
    TZ=Asia/Jakarta

# Install system dependencies (Poppler for PDF, Tesseract for OCR, Pango/Cairo, LibPQ)
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    libpq-dev \
    poppler-utils \
    tesseract-ocr \
    tesseract-ocr-ind \
    libpango-1.0-0 \
    libpangoft2-1.0-0 \
    libcairo2 \
    libffi-dev \
    curl \
    git \
    tzdata \
    && rm -rf /var/lib/apt/lists/*

# Set working directory
WORKDIR /app

# Install python dependencies
COPY requirements.txt .
RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r requirements.txt

# Create non-root application user for container execution hardening
RUN groupadd -r notary && useradd -r -g notary -d /app notary

# Copy application source code
COPY . .

# Create necessary runtime directories and adjust permissions
RUN mkdir -p /app/logs /app/staticfiles /app/mediafiles && \
    chown -R notary:notary /app

# Switch to non-root user
USER notary

# Expose internal Gunicorn application port
EXPOSE 8000

# Default entrypoint runs Gunicorn WSGI server
CMD ["gunicorn", "--config", "gunicorn.conf.py", "notaris_core.wsgi:application"]
