# muninn-gate — WG-internal HTTP front door for the Muninn ingestion queue (#377).
# No Dockerfile in the upstream repo (vh/muninn-gate); this is infra-ops's.
# muninn-dispatch is pinned in pyproject (currently ==0.1.5, from vh/muninn-gate
# main; bumped from 0.1.4 for the concept_schema/concept_schema_source fields)
# and comes from the internal Gitea PyPI index "gitea"; the read token (vh) is
# passed as a BuildKit secret (never baked into a layer). Also tag the image with
# the source SHA for traceability, since the gate version (0.0.14) is unchanged.
#
#   DOCKER_BUILDKIT=1 docker build \
#     --secret id=gitea_pw,src=<vh-token-file> \
#     -t muninn-gate:0.0.14 -t muninn-gate:<src-sha> .
FROM python:3.11-slim

RUN pip install --no-cache-dir uv==0.11.* \
 && useradd --system --uid 10014 --create-home --home-dir /home/gate gate

WORKDIR /app
COPY pyproject.toml README.md uv.lock ./
COPY src ./src

# Install the app + deps. muninn-dispatch resolves only from the "gitea" index
# (pinned via [tool.uv.sources]); everything else from PyPI.
RUN --mount=type=secret,id=gitea_pw \
    UV_INDEX_GITEA_USERNAME=vh \
    UV_INDEX_GITEA_PASSWORD="$(cat /run/secrets/gitea_pw)" \
    uv pip install --system --no-cache .

# The launcher (compose) owns the bind — no CMD here. The app carries `bind`
# for observability only; --host/--port passed by compose are authoritative.
USER gate