# Deploy artifact (NOT part of the downloadable code tar — the deploy story lives in the post).
# ONE Ignite app serves the whole ITSM suite: seven component routers on one FastAPI, one
# bucket, one URL — and one writer to the masters five of them share.
#
# Build context is the code/ directory (the components are siblings):
#     docker build -f itsm-suite-app/v1/Dockerfile -t itsm-suite .
# Ignite builds it the same way with Kaniko on `ignite app deploy … --dockerfile-path`.
#
# No node stage: the ITSM suite is API-first — there is no web/ in v1. When one is added, it
# goes in web/ and gets a Vite build stage ahead of this one, exactly like crm-suite-app.
#
# THE SLA CLOCK NEEDS A TICKER. Ignite has no scheduler, so deploy this app one of two ways
# and say which in the post: pinned always-on (`--reserved 1 --max-replicas 1`) with the pod
# driving POST /sla-management/sla/tick on its own interval, or scale-to-zero with an external scheduler
# calling that route. A clock that only advances on a page load is not a clock.

FROM python:3.12-slim
WORKDIR /app
COPY itsm-suite-app/v1/requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt
# ONE system: the app + the ONE canonical schema + the shared data/auth layer + the workflow
# modules. (The code/itsm-*/v1 teaching packages are NOT part of the image — the suite is
# self-contained.)
# Every module, not a hand-maintained list. The casting app shipped an explicit list, a new
# module was added without updating it, and the pod crash-looped on ModuleNotFoundError
# *behind a healthy gateway* — the front door still answered 401, so it looked deployed.
# A glob cannot drift from the source tree.
COPY itsm-suite-app/v1/*.py ./
COPY itsm-suite-app/v1/modules/ ./modules/
ENV PORT=8080
EXPOSE 8080
# Ignite runs pods with runAsNonRoot: the image MUST declare a NUMERIC uid — the kubelet
# cannot resolve a username against /etc/passwd, so `USER appuser` fails admission with
# "image will run as root", and it fails AFTER a successful pull. 8080 is unprivileged, so
# nothing else has to change.
RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin app \
 && chown -R 10001:10001 /app
USER 10001
CMD ["sh", "-c", "uvicorn main:app --host 0.0.0.0 --port ${PORT:-8080}"]
