FROM python:3.11-slim

WORKDIR /server

# Install system dependencies including Easy-RSA for certificate generation
RUN apt-get update && apt-get install -y \
    gcc \
    libmariadb-dev \
    pkg-config \
    iptables \
    easy-rsa \
    && rm -rf /var/lib/apt/lists/* \
    && ln -s /usr/share/easy-rsa/easyrsa /usr/local/bin/easyrsa

# Copy requirements first for better caching
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy application code as package
COPY app/ /server/app/

# Create non-root user
RUN useradd -m -u 1000 appuser
# Note: Running as root for iptables access, but API endpoints are protected

EXPOSE 8000

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload"]