FROM python:3.12-slim

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY main.py .

# TLS certs are injected at runtime via a volume mount:
#   ./certs/server.key  — private key for api.medium.com
#   ./certs/server.crt  — cert signed by our local CA
# Run setup.sh once to generate them.
CMD ["uvicorn", "main:app", \
     "--host", "0.0.0.0", \
     "--port", "443", \
     "--ssl-keyfile", "/certs/server.key", \
     "--ssl-certfile", "/certs/server.crt", \
     "--log-level", "info"]