FROM python:3.12-slim-bullseye

RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
    curl gnupg ca-certificates unixodbc unixodbc-dev openssl \
 && rm -rf /var/lib/apt/lists/*

# Microsoft repo for Debian 11 (bullseye)
RUN mkdir -p /etc/apt/keyrings \
 && curl -fsSL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor -o /etc/apt/keyrings/microsoft-prod.gpg \
 && echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/microsoft-prod.gpg] https://packages.microsoft.com/debian/11/prod bullseye main" \
    > /etc/apt/sources.list.d/microsoft-prod.list \
 && apt-get update \
 && ACCEPT_EULA=Y apt-get install -y msodbcsql17 \
 && rm -rf /var/lib/apt/lists/*

# Loosen OpenSSL policy so very old servers/certs work
RUN printf '%s\n' \
  'openssl_conf = default_conf' \
  '' \
  '[default_conf]' \
  'ssl_conf = ssl_sect' \
  '' \
  '[ssl_sect]' \
  'system_default = system_default_sect' \
  '' \
  '[system_default_sect]' \
  'MinProtocol = TLSv1' \
  'CipherString = DEFAULT@SECLEVEL=1' \
  > /etc/ssl/openssl_loose.cnf
ENV OPENSSL_CONF=/etc/ssl/openssl_loose.cnf

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY app ./app

EXPOSE 8000
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]