# syntax=docker/dockerfile:1
FROM python:3.14-slim AS base

# bcrypt is needed for htpasswd auth; kept out of the default deps because the
# CLI does not need it.
RUN pip install --no-cache-dir bcrypt

WORKDIR /app
COPY pyproject.toml README.md ./
COPY src ./src
RUN pip install --no-cache-dir .

# The vault is bind-mounted at /vault; the sidecar index lives at /data so it is
# never written inside the user's notes.
ENV MDCALDAV_CONFIG=/config/mdcaldav.toml \
    PYTHONUNBUFFERED=1

EXPOSE 5232

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD python -c "import urllib.request,sys; \
sys.exit(0 if urllib.request.urlopen('http://localhost:5232/', timeout=4).status < 500 else 1)" \
    || exit 1

# Stock Radicale loads our storage plugin by name. Running Radicale directly
# (rather than `mdcaldav serve`) keeps every Radicale option available.
CMD ["radicale", "--config", "/config/radicale.conf"]