FROM ghcr.io/astral-sh/uv:0.9.30@sha256:538e0b39736e7feae937a65983e49d2ab75e1559d35041f9878b7b7e51de91e4 AS uv

FROM docker.io/library/python:3.11.9-slim-bookworm@sha256:8fb099199b9f2d70342674bd9dbccd3ed03a258f26bbd1d556822c6dfc60c317 AS python-build

COPY --from=uv /uv /usr/local/bin/uv
COPY artifact/hermes-agent /opt/livingip/leoclean-nosend/artifact/hermes-agent

RUN /usr/local/bin/uv venv \
      --python /usr/local/bin/python3.11 \
      --no-project \
      /opt/livingip/leoclean-nosend/venv \
  && VIRTUAL_ENV=/opt/livingip/leoclean-nosend/venv /usr/local/bin/uv sync \
      --directory /opt/livingip/leoclean-nosend/artifact/hermes-agent \
      --active \
      --frozen \
      --no-dev \
      --extra cron \
      --no-editable \
  && /usr/local/bin/uv pip check --python /opt/livingip/leoclean-nosend/venv/bin/python

FROM docker.io/library/postgres:16.14-bookworm@sha256:92620daddcd947f8d5ab5ba66e848702fe443d87fed30c4cea8e389fd78dfc55

ARG TELEO_REVISION
ARG ARTIFACT_SHA256
ARG IDENTITY_SHA256
ARG INPUT_SHA256

LABEL org.opencontainers.image.source="https://github.com/living-ip/teleo-infrastructure" \
      org.opencontainers.image.revision="${TELEO_REVISION}" \
      livingip.artifact.sha256="${ARTIFACT_SHA256}" \
      livingip.identity.sha256="${IDENTITY_SHA256}" \
      livingip.input.sha256="${INPUT_SHA256}" \
      livingip.runtime="leoclean-nosend" \
      livingip.target="gcp-staging"

COPY --from=python-build /usr/local /usr/local
COPY --from=python-build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=python-build /opt/livingip/leoclean-nosend/venv /opt/livingip/leoclean-nosend/venv
COPY artifact /opt/livingip/leoclean-nosend/artifact
COPY identity /opt/livingip/leoclean-nosend/identity
COPY identity-sources /opt/livingip/leoclean-nosend/identity-sources
COPY scripts /opt/livingip/leoclean-nosend/scripts
COPY entrypoint.py /opt/livingip/leoclean-nosend/entrypoint.py
COPY package_contract.py /opt/livingip/leoclean-nosend/package_contract.py
COPY artifact-receipt.json /opt/livingip/leoclean-nosend/metadata/artifact-receipt.json
COPY image-input.json /opt/livingip/leoclean-nosend/metadata/image-input.json
COPY Dockerfile /opt/livingip/leoclean-nosend/metadata/Dockerfile
COPY cloudsql-server-ca.pem /usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem

RUN ln -s /usr/local/bin/python3.11 /usr/bin/python3 \
  && test -d /usr/lib/ssl \
  && if [ ! -L /usr/lib/ssl/cert.pem ] && [ ! -e /usr/lib/ssl/cert.pem ]; then \
       ln -s /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem; \
     fi \
  && test "$(readlink -f /usr/lib/ssl/cert.pem)" = "/etc/ssl/certs/ca-certificates.crt" \
  && mkdir -p /usr/local/libexec/livingip/leoclean-kb/gcloud-config \
  && chmod 0755 /usr/local/libexec/livingip/leoclean-kb \
  && chmod 0555 /usr/local/libexec/livingip/leoclean-kb/gcloud-config \
  && chmod 0444 /usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem \
  && chmod 0555 /opt/livingip/leoclean-nosend/entrypoint.py \
  && chmod 0444 /opt/livingip/leoclean-nosend/package_contract.py \
  && find /opt/livingip/leoclean-nosend/identity -type f -exec chmod 0444 {} + \
  && case "$TELEO_REVISION" in (*[!0-9a-f]*|'') exit 65;; esac \
  && test "${#TELEO_REVISION}" -eq 40 \
  && for digest in "$ARTIFACT_SHA256" "$IDENTITY_SHA256" "$INPUT_SHA256"; do \
       case "$digest" in (*[!0-9a-f]*|'') exit 65;; esac; \
       test "${#digest}" -eq 64; \
     done \
  && test "$(/usr/local/bin/python3.11 -c 'import platform; print(platform.python_version())')" = "3.11.9" \
  && test "$(/usr/local/bin/python3.11 -c 'import ssl; print(ssl.get_default_verify_paths().cafile)')" = "/usr/lib/ssl/cert.pem" \
  && test "$(/usr/local/bin/python3.11 -c 'import ssl; print(ssl.get_default_verify_paths().cafile)')" != "/usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem" \
  && /usr/local/bin/python3.11 -c 'import ssl; assert ssl.create_default_context().cert_store_stats().get("x509_ca", 0) > 0' \
  && /usr/bin/psql --version | grep -Eq '^psql \(PostgreSQL\) 16[.]14([[:space:]]|$)' \
  && test "$(sha256sum /usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem | cut -d ' ' -f 1)" = "80701e768f0e1f6b9d621aa0b53f6e851daaa276c6d9a8e51a300fbc015539cb" \
  && /opt/livingip/leoclean-nosend/venv/bin/python /opt/livingip/leoclean-nosend/entrypoint.py \
       verify-build "$TELEO_REVISION" "$ARTIFACT_SHA256" "$IDENTITY_SHA256" "$INPUT_SHA256"

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONNOUSERSITE=1 \
    PYTHONSAFEPATH=1

STOPSIGNAL SIGTERM

HEALTHCHECK --interval=15s --timeout=10s --start-period=30s --retries=4 \
  CMD ["/opt/livingip/leoclean-nosend/venv/bin/python", "/opt/livingip/leoclean-nosend/entrypoint.py", "health"]

ENTRYPOINT ["/opt/livingip/leoclean-nosend/venv/bin/python", "/opt/livingip/leoclean-nosend/entrypoint.py"]
CMD ["service"]