ARG PYTHON_IMAGE=python:3.12-slim-bookworm@sha256:6a0e06f5ba0b373d051aabd3fffb9b873f27f9a2a3a14bcbe37dee6f0e3bbc70
FROM ${PYTHON_IMAGE} AS runtime
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PIP_NO_CACHE_DIR=1 FORWARDED_ALLOW_IPS=172.29.247.1
WORKDIR /opt/titomx
COPY requirements.lock ./
RUN python -m pip install --require-hashes --only-binary=:all: -r requirements.lock \
    && groupadd --gid 10001 titomx && useradd --uid 10001 --gid 10001 --no-create-home titomx \
    && mkdir -p /var/lib/titomx-node && chown 10001:10001 /var/lib/titomx-node
COPY --chown=10001:10001 app ./app
USER 10001:10001
EXPOSE 18080
CMD ["python", "-m", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "18080", "--workers", "1", "--no-access-log", "--proxy-headers"]

FROM ${PYTHON_IMAGE} AS core-download
ARG TARGETARCH
COPY tools/fetch_core.py /tmp/fetch_core.py
RUN python /tmp/fetch_core.py --arch ${TARGETARCH} --output /usr/local/bin/sing-box

FROM runtime AS agent
COPY --from=core-download /usr/local/bin/sing-box /usr/local/bin/sing-box
EXPOSE 18081
CMD ["python", "-m", "uvicorn", "app.agent:app", "--host", "0.0.0.0", "--port", "18081", "--workers", "1", "--no-access-log", "--no-proxy-headers"]
