ARG PYTHON_IMAGE=python:3.12.13-slim-bookworm@sha256:4766d8b510c428e595d74b9cc5bbb2fae8e26316fffb4adc89908d79aacd58a2
ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.12.10@sha256:2bb3ebca0a796a155094a27773d290c4b074572e6107f171d88d086682fd2500

FROM ${UV_IMAGE} AS uv
FROM ${PYTHON_IMAGE} AS build

COPY --from=uv /uv /uvx /usr/local/bin/

ARG LUMMENNA_VERSION=1.0.1rc4
ARG LUMMENNA_SOURCE_URL=https://lummenna.com/downloads/lummenna-1.0.1rc4.tar.gz
ARG LUMMENNA_SOURCE_SHA256=5beeb639de3a9517fba4938d00ab61b6f70f7434e36f13b4f22cdc98421201f6

ENV DEBIAN_FRONTEND=noninteractive \
    UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_NO_CACHE=1 \
    UV_PROJECT_ENVIRONMENT=/opt/lummenna \
    UV_PYTHON_DOWNLOADS=never

RUN apt-get update \
    && apt-get install -y --no-install-recommends build-essential ca-certificates cmake curl \
    && source_archive="/tmp/lummenna-${LUMMENNA_VERSION}.tar.gz" \
    && curl --fail --show-error --silent --location "$LUMMENNA_SOURCE_URL" --output "$source_archive" \
    && printf '%s  %s\n' "$LUMMENNA_SOURCE_SHA256" "$source_archive" | sha256sum --check --strict \
    && mkdir /tmp/lummenna-source \
    && tar --extract --gzip --file "$source_archive" --directory /tmp/lummenna-source --strip-components=1 \
    && cd /tmp/lummenna-source \
    && uv sync --locked --no-dev --no-editable --extra export --extra mcp \
    && /opt/lummenna/bin/python -c "import lummenna; import mcp" \
    && rm -rf /tmp/lummenna-source "$source_archive"

FROM ${PYTHON_IMAGE}

LABEL org.opencontainers.image.title="Lummenna Community Sidecar"
LABEL org.opencontainers.image.version="1.0.1rc4"
LABEL org.opencontainers.image.source="https://lummenna.com/community"
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"

ENV PATH=/opt/lummenna/bin:$PATH \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    LUMMENNA_API_HOST=0.0.0.0 \
    LUMMENNA_API_PORT=8848 \
    LUMMENNA_STORE_PATH=/data/store \
    LUMMENNA_MODEL_PATH=/data/models \
    HF_HOME=/data/models/.cache/huggingface \
    LUMMENNA_SOVEREIGN=true

COPY --from=build /opt/lummenna /opt/lummenna

RUN groupadd --gid 10001 lummenna \
    && useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin lummenna \
    && mkdir -p /data/store /data/models \
    && chown -R lummenna:lummenna /data \
    && printf '%s\n' \
       '#!/bin/sh' \
       'set -eu' \
       ': "${LUMMENNA_API_KEY:?LUMMENNA_API_KEY is required}"' \
       'exec "$@"' \
       > /usr/local/bin/lummenna-entrypoint \
    && chmod 0755 /usr/local/bin/lummenna-entrypoint

USER 10001:10001

VOLUME ["/data/store", "/data/models"]
EXPOSE 8848
STOPSIGNAL SIGTERM

HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8848/health')" || exit 1

ENTRYPOINT ["/usr/local/bin/lummenna-entrypoint"]
CMD ["lummenna", "serve", "--host", "0.0.0.0", "--port", "8848"]