# The Tarleaks ERP attendance bridge in a container (any Docker host on the
# office network). Build from tools/attendance-bridge:
#   docker build -f attendance_bridge/service/Dockerfile -t tarleaks-attendance-bridge .
# Run (bridge.ini and keys mounted read-only; state kept in a volume):
#   docker run -d --name tarleaks-bridge --restart unless-stopped \
#     -v /srv/tarleaks-bridge/bridge.ini:/etc/tarleaks-bridge/bridge.ini:ro \
#     -v /srv/tarleaks-bridge/keys:/run/secrets/tarleaks:ro \
#     -v tarleaks-bridge-state:/var/lib/tarleaks-bridge \
#     tarleaks-attendance-bridge
# In bridge.ini use token_file = /run/secrets/tarleaks/<machine>.key and
#   [bridge] state_dir = /var/lib/tarleaks-bridge/state, log_file = none (logs go to docker logs).
# The adms_relay adapter needs --network host (it listens on the office LAN address).
FROM ghcr.io/tarekeesa/base/python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
WORKDIR /opt/bridge
COPY requirements.txt requirements-zk.txt ./
RUN pip install --no-cache-dir --require-hashes -r requirements.txt
# Optional ZK TCP support (pyzk, GPL-2.0): build with --build-arg WITH_ZK=1
ARG WITH_ZK=0
RUN if [ "$WITH_ZK" = "1" ]; then pip install --no-cache-dir --require-hashes -r requirements-zk.txt; fi
COPY attendance_bridge ./attendance_bridge
RUN useradd --system --uid 10001 --home /var/lib/tarleaks-bridge bridge \
 && install -d -o bridge -g bridge -m 0700 /var/lib/tarleaks-bridge
USER bridge
ENTRYPOINT ["python", "-m", "attendance_bridge", "--config", "/etc/tarleaks-bridge/bridge.ini"]
CMD ["run"]
