FROM node:22-bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends python3 python3-venv tesseract-ocr tesseract-ocr-eng poppler-utils ffmpeg libgomp1 && rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY content-requirements.txt ./
RUN python3 -m venv /opt/inspection && /opt/inspection/bin/pip install --no-cache-dir -r content-requirements.txt
COPY scanner.mjs audit-journal.mjs managed-gateway.mjs provider-protocols.mjs governance.mjs governance-console.html governance-console.mjs governance-console.css enterprise-directory.mjs enterprise-oidc.mjs content-inspection.mjs extract-content.py inspection-service.mjs ./
RUN mkdir /audit /inspection && chown 10001:10001 /audit && chown 10002:10001 /inspection && chmod 0770 /inspection
USER 10001:10001
ENV NODE_ENV=production GUARD_CONTENT_INSPECTION=enabled GUARD_INSPECTION_SOCKET=/inspection/extractor.sock GUARD_PYTHON=/opt/inspection/bin/python GUARD_WHISPER_MODEL_DIR=/models/whisper HF_HUB_OFFLINE=1
EXPOSE 8443 8444
CMD ["node", "managed-gateway.mjs"]