ARG PYTHON_IMAGE=python:3.14-alpine
FROM ${PYTHON_IMAGE} AS certificates

RUN apk add --no-cache openssl \
    && install -d -m 0755 /certificates \
    && openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 3650 \
      -subj "/CN=manuals.playstation.net" \
      -addext "subjectAltName=DNS:manuals.playstation.net" \
      -keyout /certificates/manuals.key \
      -out /certificates/manuals.crt \
    && chmod 0600 /certificates/manuals.key

FROM ${PYTHON_IMAGE}

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PORT=8080

WORKDIR /srv

COPY payloads.sha256 /tmp/payloads.sha256
COPY app/index.html /srv/public/index.html
COPY app/src /srv/public/src
COPY app/offsets /srv/public/offsets
COPY app/payloads /srv/public/payloads
COPY docker/server.py /srv/server.py
COPY docker/guide_gateway.py /srv/guide_gateway.py
COPY docker/nanodns.ini /srv/nanodns.ini
COPY --from=certificates /certificates /srv/certificates

RUN cd /srv/public && sha256sum -c /tmp/payloads.sha256 \
    && rm /tmp/payloads.sha256 \
    && chown -R 65532:65532 /srv

USER 65532:65532

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/', timeout=2).close()"]

CMD ["python", "/srv/server.py"]