FROM python:3.11-slim

# Install ONLY system dependencies needed for video/audio processing
# NO WARP VPN, NO Playwright, NO browser - all downloads go through CF Worker proxy
RUN apt-get update && apt-get install -y --no-install-recommends \
    ffmpeg \
    curl \
    ca-certificates \
    fontconfig \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user (HF Spaces requirement)
RUN useradd -m -u 1000 user

# Set working directory
WORKDIR /app

# Copy requirements first for better caching
COPY requirements.txt .

# Install Python dependencies
RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r requirements.txt

# Copy application code
COPY --chown=user . .

# Install Tahoma font (user-requested) + Montserrat as fallback
# Tahoma is a Microsoft font - download from github.com/dolbydu/font
RUN mkdir -p /usr/share/fonts/truetype/tahoma /usr/share/fonts/truetype/montserrat && \
    curl -sL "https://raw.githubusercontent.com/dolbydu/font/master/Sans/Tahoma/tahoma.ttf" -o /usr/share/fonts/truetype/tahoma/Tahoma-Regular.ttf && \
    curl -sL "https://raw.githubusercontent.com/dolbydu/font/master/Sans/Tahoma/tahomabd.ttf" -o /usr/share/fonts/truetype/tahoma/Tahoma-Bold.ttf && \
    curl -sL "https://github.com/JulietaUla/Montserrat/raw/master/fonts/ttf/Montserrat-Black.ttf" -o /usr/share/fonts/truetype/montserrat/Montserrat-Black.ttf && \
    fc-cache -fv 2>/dev/null || true

# Create directories with proper ownership
RUN mkdir -p /app/tmp /app/models /app/assets && chown -R user:user /app/tmp /app/models /app/assets

# Switch to non-root user
USER user

# Environment variables
ENV PYTHONUNBUFFERED=1
ENV TMPDIR=/app/tmp

# Expose port
EXPOSE 7860

# Health check
HEALTHCHECK --interval=60s --timeout=10s --retries=3 \
    CMD curl -f http://localhost:7860/ping || exit 1

# Force rebuild - clean version without WARP/Playwright
ENV CODE_VERSION=20260618-stealth-clean-v1

# Run directly as user (no WARP, no entrypoint.sh needed)
CMD ["python", "app.py"]