FROM python:3.11-slim-bookworm

ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
ARG PIP_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple

ENV DEBIAN_FRONTEND=noninteractive
ENV TZ=Asia/Shanghai

# NOTE: Use Debian official HTTP sources (not Tencent mirrors) because:
#   slim image has no ca-certificates pre-installed, and Tencent mirrors
#   redirect HTTP → HTTPS which fails without TLS certs (chicken-and-egg).
#   Debian official HTTP sources work without TLS. Apt packages are GPG-signed.
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update \
  && apt-get install -y --no-install-recommends curl ca-certificates \
  && ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
  && echo ${TZ} > /etc/timezone \
  && apt-get clean \
  && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY apps/backend/subservices/ocr-worker/ ./ocr-worker/
RUN --mount=type=cache,target=/root/cache/pip \
    pip install --no-cache-dir -i ${PIP_INDEX_URL} ./ocr-worker

EXPOSE 8100

HEALTHCHECK --interval=5s --timeout=5s --retries=20 --start-period=15s \
  CMD curl -fsS http://127.0.0.1:8100/health || exit 1

CMD ["uvicorn", "ocr_worker.server:app", "--host", "0.0.0.0", "--port", "8100"]