FROM python:3.11-slim

# Install Cloudflare WARP
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    ca-certificates \
    gpg \
    && curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | gpg --dearmor -o /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg \
    && echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ bookworm main" > /etc/apt/sources.list.d/cloudflare-client.list \
    && apt-get update \
    && apt-get install -y cloudflare-warp \
    && rm -rf /var/lib/apt/lists/*

# Install Python dependencies
RUN pip install --no-cache-dir fastapi uvicorn httpx[socks]

# Create non-root user (HF Spaces requirement)
RUN useradd -m -u 1000 user

# Copy app
WORKDIR /app
COPY --chown=user . .

# MUST run as root for warp-svc
# entrypoint.sh handles starting WARP then dropping to user

# Environment
ENV PYTHONUNBUFFERED=1

EXPOSE 7860

# Copy and use entrypoint
COPY entrypoint.sh /app/entrypoint.sh
RUN chmod +x /app/entrypoint.sh

ENTRYPOINT ["/app/entrypoint.sh"]