FROM python:3.11-slim

ENV DEBIAN_FRONTEND=noninteractive \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    TZ=Europe/Berlin

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        cron \
        git \
        ca-certificates \
        tzdata \
        util-linux \
    && rm -rf /var/lib/apt/lists/*

RUN groupadd --system bot \
    && useradd --system --gid bot --home /app --shell /usr/sbin/nologin bot

WORKDIR /app

RUN mkdir -p /app/data \
    && chown -R bot:bot /app

COPY requirements.txt /app/requirements.txt
RUN pip install --no-cache-dir --upgrade pip \
    && pip install --no-cache-dir -r /app/requirements.txt

COPY --chown=bot:bot crontab/ /app/crontab/
COPY --chown=bot:bot entrypoint.sh /app/entrypoint.sh
COPY --chown=bot:bot run-bot.sh /app/run-bot.sh
COPY --chown=root:root run-bot.sh /usr/local/bin/run-bot.sh
COPY --chown=bot:bot src/ /app/src/

RUN chmod 0755 /app/entrypoint.sh \
    && chmod 0755 /app/crontab/install-cron.sh \
    && chmod 0755 /app/run-bot.sh \
    && chmod 0755 /usr/local/bin/run-bot.sh \
    && chmod 0644 /app/crontab/tenbackward.cron

ENV PYTHONPATH=/app/src

# Note: entrypoint.sh runs as root so it can install /etc/cron.d/tenbackward
# and exec cron -f. The cron-launched wrapper drops to the unprivileged
# `bot` user before invoking Python.
ENTRYPOINT ["/app/entrypoint.sh"]