admin / Syanpse-Vanguard

# Single image, many roles (selected by the compose `command`). Keeps the SBOM
# small — a homelab pulls one image for the whole backend.
FROM python:3.12-slim AS base

ENV PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PYTHONDONTWRITEBYTECODE=1

WORKDIR /app

RUN apt-get update \
 && apt-get install -y --no-install-recommends curl \
 && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install -r requirements.txt

COPY sv ./sv
COPY pyproject.toml .

# Non-root runtime
RUN useradd -r -u 10001 sv \
 && mkdir -p /var/lib/synapse-vanguard /var/spool/sv \
 && chown -R sv:sv /var/lib/synapse-vanguard /var/spool/sv
USER sv

# Default = consolidated app (API + web UI + ingest + normalizer) on 5500.
EXPOSE 5500
CMD ["uvicorn", "sv.main:app", "--host", "0.0.0.0", "--port", "5500"]