FROM python:3.13-alpine3.23 AS builder
ENV UV_SYSTEM_PYTHON=1

COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /usr/local/bin/uv
COPY pyproject.toml .
RUN uv pip install -r pyproject.toml

FROM python:3.13-alpine3.23

COPY --from=builder /usr/local/lib/python3.13/site-packages /usr/local/lib/python3.13/site-packages

WORKDIR /code

# Set user and group
ARG user=apps
ARG uid=1001
ARG gid=1001

RUN addgroup -S ${user} && adduser -S ${user} -G ${user} -u ${uid} -s /bin/sh

RUN apk add --no-cache gettext pango ttf-dejavu
RUN chown -R ${user}:${user} /code

COPY --chown=${user}:${user} . /code

# SECRET_KEY/ALLOWED_HOSTS provisionales para la construcción de la imagen
# (build.sh carga settings, que ya no traen un valor por defecto para
# ninguna de las dos, ver config/settings/env.py). En producción no se
# heredan: solo existen en esta RUN, no quedan en la imagen final.
RUN apk add --no-cache --virtual .tailwind-runtime libstdc++ libgcc \
    && SECRET_KEY=build-only ALLOWED_HOSTS='*' su ${user} -c "sh ./scripts/build.sh" \
    && apk del .tailwind-runtime

USER ${user}
CMD ["sh", "./scripts/run.sh"]