FROM python:3.9

# Set working directory
WORKDIR /app

# Ensure logs are visible immediately
ENV PYTHONUNBUFFERED=1

# Install system dependencies (including ca-certificates explicitly)
RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Copy requirements
COPY requirements.txt .

# Install Python dependencies
RUN pip install --no-cache-dir -r requirements.txt

# Copy application code
COPY bot.py .
COPY healthcheck.py .
COPY app.py .

# Environment variables are injected by HF Spaces via Secrets
# Do NOT copy .env - it contains secrets and should never be in the repo

# Create a non-root user for security
RUN useradd -m -u 1000 botuser && chown -R botuser:botuser /app
USER botuser

# Run the bot with dummy server
CMD ["python", "app.py"]