# Service image (uv-based). DATABASE_URL and every secret come from the k8s
# Deployment env/secrets at runtime — never baked in.
FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim

WORKDIR /app

ENV UV_LINK_MODE=copy \
    UV_COMPILE_BYTECODE=1 \
    PYTHONUNBUFFERED=1

# `git`: pyproject.toml depends on `sowai-fiscal` via `git+https` (Gitea
# interno, EMENDA F1 do spec) -- `uv sync --frozen` needs the `git` binary
# at build time to fetch/pin it. The base `-slim` image does not ship it
# (mesma lição C1 que o Dockerfile do auto documenta: quando ele passou a
# depender de `sowai-fiscal`, precisou do mesmo apt-get install).
# SEM WeasyPrint (nem outras libs nativas) por ora -- DANFE (PDF) só chega
# na F4; nada aqui as usa ainda.
RUN apt-get update -qq \
    && apt-get install -y -qq --no-install-recommends git \
    && rm -rf /var/lib/apt/lists/*

# Dependency layer (cached unless pyproject/uv.lock change).
# `--no-install-project`: at this point only pyproject.toml/uv.lock have
# been COPYed -- `src/fiscal_svc` (the project's own package, installed
# editable via hatchling per pyproject.toml's `[build-system]`) does not
# exist in this layer yet, so installing the PROJECT itself here would fail
# (nothing to build). This layer installs every THIRD-PARTY dependency only,
# which is what makes it cacheable across source-only changes.
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen --no-dev --no-install-project

# Application code, then install the project itself (fast: every dependency
# is already resolved/installed by the layer above).
COPY . .
RUN uv sync --frozen --no-dev

EXPOSE 8140

CMD ["uv", "run", "uvicorn", "fiscal_svc.main:app", "--host", "0.0.0.0", "--port", "8140"]