FROM debian:bullseye-slim

ENV DEBIAN_FRONTEND=noninteractive
ENV TZ=Europe/Rome

RUN apt-get update && apt-get install -y \
    liquidsoap \
    ffmpeg \
    python3 \
    python3-pip \
    curl \
    tzdata \
    libcairo2 \
    && apt-get clean && rm -rf /var/lib/apt/lists/*

RUN pip3 install --no-cache-dir \
    python-telegram-bot==20.7 \
    httpx \
    huggingface_hub \
    mutagen \
    cairosvg \
    requests

COPY start.sh           /app/start.sh
COPY radio.liq          /app/radio.liq
COPY artwork_updater.py /app/artwork_updater.py
COPY run_artwork.sh     /app/run_artwork.sh
COPY index.html         /app/index.html
COPY manifest.webmanifest /app/manifest.webmanifest
COPY sw.js              /app/sw.js
COPY pwa-icon-180.png   /app/pwa-icon-180.png
COPY pwa-icon-192.png   /app/pwa-icon-192.png
COPY pwa-icon-512.png   /app/pwa-icon-512.png
COPY widget.html        /app/widget.html
COPY bot.py             /app/bot.py
COPY contributor_scheduler.py /app/contributor_scheduler.py
COPY migrate_music.py /app/migrate_music.py
COPY jamendo_downloader.py /app/jamendo_downloader.py
COPY jingle_scheduler.py   /app/jingle_scheduler.py
COPY events_scraper.py     /app/events_scraper.py
COPY cinema_scraper.py     /app/cinema_scraper.py
COPY backup_scheduler.py   /app/backup_scheduler.py
# Copia bot_data/ (contiene cineforum.json e altri file di stato iniziali)
COPY bot_data/          /app/bot_data/

RUN chmod +x /app/start.sh /app/run_artwork.sh

# Sicurezza: crea utente non privilegiato per eseguire i processi
RUN groupadd -r kossuth && \
    useradd -r -g kossuth -d /app -s /sbin/nologin kossuth && \
    mkdir -p /app/music /app/hls /app/bot_data /app/contrib_audio /tmp && \
    chown -R kossuth:kossuth /app && \
    chmod -R 755 /app

USER kossuth

EXPOSE 7860

CMD ["/app/start.sh"]