FROM python:3.11-slim

WORKDIR /app

# psycopg[binary] avoids needing libpq-dev; sentence-transformers/scikit-learn/
# scipy all ship prebuilt wheels for this image, so no extra build toolchain
# is needed. Playwright's Python package installs, but its browser binary is
# NOT installed here - it's only a last-resort image-search fallback
# (see requirements.txt); run `playwright install chromium` in the container
# if you need that specific fallback tier.
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY app ./app
COPY cli ./cli
COPY scripts ./scripts
COPY data ./data

EXPOSE 8000
# --proxy-headers/--forwarded-allow-ips: this container is never reached
# directly - nginx (and, in prod, Caddy) sit in front of it. Without these,
# uvicorn ignores X-Forwarded-Proto and reports every request as plain http,
# so any redirect or generated absolute URL would downgrade an https request.
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", \
     "--proxy-headers", "--forwarded-allow-ips", "*"]