# NetDesk signaling/relay server — container image.
# Build context is the repo root (so it can copy server/):
#   docker build -f docker/Dockerfile -t netdesk-server .
# or just `docker compose up -d --build` from docker/.
FROM python:3.12-slim

# aiohttp + cryptography (the server's only third-party deps). Pinned to the
# versions the production host runs.
RUN pip install --no-cache-dir aiohttp==3.9.1 cryptography==41.0.7

WORKDIR /app/server
# Server code + the web assets it serves (web/ is resolved relative to the
# script, so it must sit next to netdesk_server.py).
COPY server/netdesk_server.py /app/server/netdesk_server.py
COPY server/web /app/server/web

# Persistent state (accounts.db, audit.log, files/) lives on a mounted volume,
# kept OUT of the image + the code dir via ND_DATA_DIR (see _nd_data_root()).
ENV ND_DATA_DIR=/data
RUN mkdir -p /data
VOLUME ["/data"]

COPY docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN chmod +x /usr/local/bin/docker-entrypoint.sh

# The server listens on 8443 (plain HTTP/WS; terminate TLS at a reverse proxy,
# or pass ND_CERT/ND_KEY to enable TLS in-process).
EXPOSE 8443
ENTRYPOINT ["docker-entrypoint.sh"]