# Standalone scraper microservice.
# Build context: monorepo root (so we can access pyproject.toml + uv.lock + sibling workspace packages).
# Coolify config: base_directory=/, dockerfile_location=/packages/matrx-scraper/Dockerfile.

FROM python:3.13-slim AS base

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    UV_LINK_MODE=copy \
    UV_COMPILE_BYTECODE=1 \
    PLAYWRIGHT_BROWSERS_PATH=/ms-playwright

# System deps: Coolify's generated healthcheck uses wget while the image's own
# Docker healthcheck uses curl. Keep both available. Playwright browser deps are
# installed later by `playwright install --with-deps`.
RUN apt-get update && apt-get install -y --no-install-recommends \
        curl \
        wget \
        ca-certificates \
    && rm -rf /var/lib/apt/lists/*

RUN pip install --no-cache-dir uv

WORKDIR /app

# uv sync needs the workspace root pyproject.toml + uv.lock and ALL workspace
# members listed in [tool.uv.workspace] members. We copy the whole packages/
# directory (~10 MB) — partial copies break workspace resolution.
COPY pyproject.toml uv.lock ./
COPY packages/ ./packages/

# Install matrx-scraper plus its [server] extras, using the frozen uv.lock
# from the workspace root. `--package matrx-scraper` focuses sync on this
# workspace member only — the heavy aidream-current root project is NOT
# installed. --no-dev skips dev-only tooling.
RUN uv sync --frozen --no-dev --package matrx-scraper --extra server

# Playwright Chromium + its OS deps. Largest layer; isolated for caching.
RUN uv run --no-sync playwright install --with-deps chromium
RUN chmod -R a+rX /ms-playwright

# Default to 8001 to match the existing Coolify Traefik labels and avoid
# proxy reconfiguration. ServerConfig.from_env() respects PORT.
ENV PORT=8001 \
    HOST=0.0.0.0

EXPOSE 8001

# /health/ready confirms DB pool + cache are wired before traffic flows.
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD curl -fsS http://localhost:8001/health/ready >/dev/null || exit 1

CMD ["uv", "run", "--no-sync", "python", "-m", "matrx_scraper.server"]


# One persistent-browser worker. Build with: --target browser-worker
FROM base AS browser-worker

RUN apt-get update && apt-get install -y --no-install-recommends \
        xvfb x11-utils pulseaudio \
    && rm -rf /var/lib/apt/lists/*

RUN groupadd --gid 1000 browser-worker \
    && useradd --uid 1000 --gid 1000 --create-home --home-dir /home/browser-worker browser-worker \
    && command -v runuser >/dev/null

ARG SELKIES_VERSION=1.6.2
ARG SELKIES_SHA256=4adbb9589604e453afc00e4ceb3f04e188711fcb41d75316d0ba8c9baa070cee
RUN curl -fsSL \
        "https://github.com/selkies-project/selkies/releases/download/v${SELKIES_VERSION}/selkies-gstreamer-portable-v${SELKIES_VERSION}_amd64.tar.gz" \
        -o /tmp/selkies.tar.gz \
    && echo "${SELKIES_SHA256}  /tmp/selkies.tar.gz" | sha256sum -c - \
    && tar -xzf /tmp/selkies.tar.gz -C /opt \
    && test -x /opt/selkies-gstreamer/selkies-gstreamer-run \
    && rm /tmp/selkies.tar.gz

ENV DISPLAY=:99 \
    BROWSER_WORKER_PORT=8002 \
    HOME=/home/browser-worker \
    XDG_RUNTIME_DIR=/tmp/browser-worker-runtime

COPY packages/matrx-scraper/docker/browser-worker-entrypoint.sh /usr/local/bin/browser-worker-entrypoint
RUN chmod +x /usr/local/bin/browser-worker-entrypoint

# The entrypoint starts as root only long enough to initialize root-owned
# Fargate volume mount points, then immediately execs as browser-worker.
USER root

EXPOSE 8002
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD curl -fsS http://localhost:8002/health >/dev/null || exit 1
ENTRYPOINT ["/usr/local/bin/browser-worker-entrypoint"]
CMD []


# Coolify's scraper-service application builds this Dockerfile without an
# explicit target. Keep the ordinary scraper image as the final/default stage;
# browser-worker is opt-in via `--target browser-worker` only.
FROM base AS scraper-service
