# bulwark-filters: builds and signs filter data; serves nothing itself
# (Caddy on the host serves /srv/bulwark-filters/public).
FROM python:3.12-slim-bookworm

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONPATH=/app/src \
    BF_PKG_ROOT=/app \
    BF_STATE=/data/state \
    BF_PUBLIC=/data/public \
    BF_KEY_FILE=/run/secrets/bulwark_filters_ed25519 \
    BF_INHOUSE=/app/inhouse/blockade-jp.txt

RUN pip install --no-cache-dir "cryptography==46.0.7" \
 && useradd --uid 10001 --no-create-home --shell /usr/sbin/nologin bulwark

WORKDIR /app
# Everything copied here is also what the public source tarball contains.
COPY pyproject.toml Dockerfile compose.yaml README.md ./
COPY src ./src
COPY tests ./tests
COPY deploy ./deploy

USER 10001
HEALTHCHECK --interval=10m --timeout=20s --start-period=15m \
  CMD ["python", "-m", "bulwark_filters.cli", "health"]
ENTRYPOINT ["python", "-m", "bulwark_filters.cli"]
CMD ["loop"]
