Dockerfile

# OpenStudy FastAPI backend
# Built by ./deploy.sh, run via docker-compose alongside postgres.
#
# Every external image is pinned to an exact version AND digest: the digest
# is what Docker actually pulls, the tag documents it. Bump both together
# (`docker buildx imagetools inspect <image>:<tag>`).
FROM python:3.12.15-slim-trixie@sha256:a0f57064cbdcd6285fa45f51237ab0b35ea8ebaed06a1f5973e89e19dfb86704 AS base

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    UV_LINK_MODE=copy \
    UV_COMPILE_BYTECODE=1

# System deps: curl for HEALTHCHECK, build tools for any source wheels.
# Slim them after the install layer to keep image small.
RUN apt-get update && apt-get install -y --no-install-recommends \
        curl ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Install uv (Astral) for fast dependency resolution.
COPY --from=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a /uv /usr/local/bin/uv

WORKDIR /app

# Install dependencies first for better layer caching.
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen --no-install-project --no-dev

# Copy app source.
COPY app ./app
COPY scripts ./scripts
COPY migrations ./migrations

# Final install (in case pyproject changed locally).
RUN uv sync --frozen --no-dev

# Run as an unprivileged user. uid 1000 matches the owner of STUDY_ROOT
# (/opt/courses) on the host, which n8n's Moodle sync also writes as.
# The venv and source stay root-owned and read-only to the app.
RUN groupadd --system --gid 1000 app \
    && useradd --system --uid 1000 --gid app --home-dir /nonexistent --no-create-home app
ENV UV_NO_CACHE=1
USER app

EXPOSE 8000

# Default command — overridden by compose for migrations runs.
#
# `--proxy-headers --forwarded-allow-ips '*'` makes uvicorn honor
# X-Forwarded-Proto / X-Forwarded-For from the upstream reverse proxy.
# Without this, redirects (e.g. /mcp → /mcp/) come back with `http://`
# scheme instead of `https://`, and any client following them with a
# bearer token (Claude.ai's MCP connector being the painful one) drops
# the token on the downgrade and the request fails. The wildcard is
# safe because openstudy is only reachable from the docker bridge — the
# frontend container Caddy is the only thing that sets these headers.
CMD ["uv", "run", "--no-sync", "uvicorn", "app.main:app", \
     "--host", "0.0.0.0", "--port", "8000", \
     "--proxy-headers", "--forwarded-allow-ips", "*"]