FROM python:3.12-slim-bookworm

ENV DEBIAN_FRONTEND=noninteractive \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    UV_LINK_MODE=copy \
    HF_HOME=/opt/huggingface \
    SENTENCE_TRANSFORMERS_HOME=/opt/huggingface/sentence-transformers \
    EPICRISIS_AUTO_WARMUP=1 \
    EPICRISIS_WARMUP_RESOURCES=cie10,cups,soat

WORKDIR /app

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
        gnupg \
        gosu \
        procps \
        redis-server \
        redis-tools \
        supervisor \
        tini \
    && mkdir -p /etc/apt/keyrings \
    && curl -fsSL https://pgp.mongodb.com/server-7.0.asc \
        | gpg --dearmor -o /etc/apt/keyrings/mongodb-server-7.0.gpg \
    && echo "deb [ signed-by=/etc/apt/keyrings/mongodb-server-7.0.gpg ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" \
        > /etc/apt/sources.list.d/mongodb-org-7.0.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends mongodb-org-server mongodb-mongosh \
    && rm -rf /var/lib/apt/lists/*

RUN groupadd --system epicrisis \
    && useradd --system --gid epicrisis --home-dir /app --shell /bin/bash epicrisis \
    && mkdir -p /opt/huggingface \
    && chown -R epicrisis:epicrisis /opt/huggingface

RUN python -m pip install --upgrade pip uv

COPY pyproject.toml uv.lock .python-version ./
RUN uv sync --frozen --no-dev

COPY --chown=epicrisis:epicrisis . .

# Los indices no existen en un checkout limpio. Se crean durante el build con el
# usuario sin privilegios, por lo que sus directorios deben existir y ser
# escribibles antes de abandonar root.
RUN mkdir -p \
        /app/faiss_principal_jerarquico \
        /app/cups_faiss \
        /app/soat_faiss \
        /app/soat_procedures_faiss \
    && chown -R epicrisis:epicrisis \
        /app/faiss_principal_jerarquico \
        /app/cups_faiss \
        /app/soat_faiss \
        /app/soat_procedures_faiss

USER epicrisis

RUN /app/.venv/bin/python -m modules.processing.cie10.Carga_estructura \
    && test -s /app/faiss_principal_jerarquico/index.faiss \
    && test -s /app/faiss_principal_jerarquico/index.pkl
RUN /app/.venv/bin/python -m modules.processing.cie10.carga_cups \
    && test -s /app/cups_faiss/index.faiss \
    && test -s /app/cups_faiss/index.pkl
RUN /app/.venv/bin/python -m modules.processing.soat.soat_indexer --pdf Manual-SOAT-2025.pdf --out soat_faiss \
    && test -s /app/soat_faiss/index.faiss \
    && test -s /app/soat_faiss/index.pkl
RUN /app/.venv/bin/python -m modules.processing.soat.soat_procedures_indexer --out soat_procedures_faiss \
    && test -s /app/soat_procedures_faiss/index.faiss \
    && test -s /app/soat_procedures_faiss/index.pkl \
    && AUDIT_LOG_ENABLED=0 /app/.venv/bin/python -m app.scripts.warmup_resources --resource cups --resource soat

USER root

RUN mkdir -p /data /var/log/epicrisis /var/run/epicrisis /etc/epicrisis /docker \
    && chown -R epicrisis:epicrisis /data /var/log/epicrisis /var/run/epicrisis /etc/epicrisis

COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
COPY docker/healthcheck.sh /usr/local/bin/healthcheck.sh
COPY docker/supervisord.conf /etc/supervisor/conf.d/epicrisis.conf

RUN chmod +x /usr/local/bin/entrypoint.sh /usr/local/bin/healthcheck.sh

EXPOSE 7000
VOLUME ["/data"]

HEALTHCHECK --interval=30s --timeout=10s --start-period=90s --retries=5 CMD ["/usr/local/bin/healthcheck.sh"]

ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/entrypoint.sh"]