always require OIDC_OP_ISSUER and OIDC_OP_SESSION_SECRET to be set when using compose

run uvicorn directly instead of via uv

Dockerfile

@@ -6,7 +6,7 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     UV_COMPILE_BYTECODE=1 \
     UV_LINK_MODE=copy
 
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+COPY --from=ghcr.io/astral-sh/uv:0.11.29 /uv /uvx /bin/
 
 WORKDIR /app
 
@@ -17,17 +17,19 @@ RUN uv sync --frozen --no-install-project --no-dev
 # ---- Dev stage: hot-reload for local development ----
 FROM base AS dev
 
-# Also install dev dependencies
+# Also install dev dependencies. The project source is bind-mounted at runtime.
 RUN uv sync --frozen --no-install-project
 
 # Source is bind-mounted at runtime via docker-compose
 ENV OIDC_OP_ISSUER=http://localhost:8000 \
     OIDC_OP_DEBUG=true \
-    OIDC_OP_SESSION_HTTPS_ONLY=false
+    OIDC_OP_SESSION_HTTPS_ONLY=false \
+    PATH="/app/.venv/bin:$PATH" \
+    PYTHONPATH=/app/src
 
 EXPOSE 8000
 
-CMD ["uv", "run", "uvicorn", "porchlight.app:create_app", \
+CMD ["uvicorn", "porchlight.app:create_app", \
      "--factory", "--host", "0.0.0.0", "--port", "8000", \
      "--reload", "--reload-dir", "/app/src"]
 
@@ -39,10 +41,21 @@ COPY README.md ./
 COPY src/ src/
 RUN uv sync --frozen --no-dev
 
-ENV OIDC_OP_ISSUER=http://localhost:8000
+# Use the venv built above directly — avoids `uv run` re-syncing (and
+# needing network access to re-resolve/rebuild) at container startup.
+ENV PATH="/app/.venv/bin:$PATH"
+
+RUN groupadd --system porchlight \
+    && useradd --system --gid porchlight --home-dir /app porchlight \
+    && mkdir -p /app/data \
+    && chown porchlight:porchlight /app/data \
+    && mkdir -p /app/config \
+    && chown porchlight:porchlight /app/config
+
+USER porchlight
 
 EXPOSE 8000
 
-CMD ["uv", "run", "uvicorn", "porchlight.app:create_app", \
+CMD ["uvicorn", "porchlight.app:create_app", \
      "--factory", "--host", "0.0.0.0", "--port", "8000", \
      "--workers", "4"]

docker-compose.yml

@@ -6,8 +6,8 @@ services:
     ports:
       - "8000:8000"
     environment:
-      OIDC_OP_ISSUER: "http://localhost:8000"
-      OIDC_OP_SESSION_SECRET: "change-me-in-production"
+      OIDC_OP_ISSUER: "${OIDC_OP_ISSUER:?set OIDC_OP_ISSUER to the public HTTPS URL}"
+      OIDC_OP_SESSION_SECRET: "${OIDC_OP_SESSION_SECRET:?set OIDC_OP_SESSION_SECRET to a random secret}"
     volumes:
       - app-data:/app/data
     profiles: