# Candidate package: lifecycle and paid-provider acceptance remain pending.
# Source is immutable; the base image is pinned by multi-arch index digest.
FROM ghcr.io/astral-sh/uv:python3.14-bookworm-slim@sha256:7cf77f594be8042dab6daa9fe326f90962252268b4f120a7f5dccce4d947e6c1

RUN apt-get update && apt-get install -y --no-install-recommends \
    git build-essential pkg-config libffi-dev libsecp256k1-dev \
    autoconf automake libtool \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /opt/routstr
# Routstr Core main at 8ce9ef69 (2026-10-24): v0.5.0 plus 87 commits, among
# them the X-Cashu refunds on upstream failure (#829, #872). No release is
# tagged after v0.5.0 yet. Do not substitute latest or a moving branch.
RUN git init . \
    && git remote add origin https://github.com/Routstr/routstr-core.git \
    && git fetch --depth 1 origin 8ce9ef69fc1b5ecd6f92f1baf54d8c2620ea0e89 \
    && git checkout --detach FETCH_HEAD \
    && test "$(git rev-parse HEAD)" = 8ce9ef69fc1b5ecd6f92f1baf54d8c2620ea0e89 \
    && uv sync --frozen --no-dev --no-install-project \
    && rm -rf .git
# alembic.ini's script_location is cwd-relative, but cwd is /data below.
RUN sed -i 's|^script_location = migrations$|script_location = %(here)s/migrations|' alembic.ini \
    && grep -qx 'script_location = %(here)s/migrations' alembic.ini

ENV PYTHONPATH=/opt/routstr \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    GIT_COMMIT=8ce9ef69fc1b5ecd6f92f1baf54d8c2620ea0e89 \
    GIT_TAG=

# Upstream's .wallet and logs paths are relative to cwd. Keep them beside
# keys.db and the encryption key, not on the read-only application filesystem.
WORKDIR /data
EXPOSE 8000
# Starts uvicorn, then applies the node wallet's mints/payout address and the
# install-default model price through Routstr's own admin API.
COPY archy-start.py /opt/archy/archy-start.py
CMD ["/opt/routstr/.venv/bin/python", "/opt/archy/archy-start.py"]