🔧 Fix health checks: Use IPv4 address + Add debugging

🌐 Network Fix:
- Change localhost to 127.0.0.1 for all health check URLs
- Prevents IPv6 resolution issues in CI environment
- Ensures consistent IPv4 connectivity to container

🔍 Debugging Improvements:
- Check if container is running with docker ps
- Show recent container logs before health checks
- Better troubleshooting information for failures

📋 Updated Endpoints:
- http://127.0.0.1:8080/health
- http://127.0.0.1:8080/docs
- http://127.0.0.1:8080/stations
- http://127.0.0.1:8080/metrics

✅ Should resolve curl connection failures to localhost

.gitea/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
       with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
+        token: ${{ secrets.GITEA_TOKEN }}
       
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v4
@@ -101,7 +101,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
       with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
+        token: ${{ secrets.GITEA_TOKEN }}
       
     - name: Set up Python
       uses: actions/setup-python@v4
@@ -139,7 +139,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
       with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
+        token: ${{ secrets.GITEA_TOKEN }}
       
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
@@ -200,7 +200,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
       with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
+        token: ${{ secrets.GITEA_TOKEN }}
       
     - name: Wait for VictoriaMetrics
       run: |
@@ -253,7 +253,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
       with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
+        token: ${{ secrets.GITEA_TOKEN }}
       
     - name: Deploy to staging
       run: |
@@ -280,7 +280,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
       with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
+        token: ${{ secrets.GITEA_TOKEN }}
       
     - name: Deploy to production
       run: |
@@ -309,7 +309,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
       with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
+        token: ${{ secrets.GITEA_TOKEN }}
       
     - name: Install Apache Bench
       run: |

.gitea/workflows/docs.yml

@@ -28,7 +28,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
       with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
+        token: ${{ secrets.GITEA_TOKEN }}
       
     - name: Set up Python
       uses: actions/setup-python@v4
@@ -130,7 +130,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
       with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
+        token: ${{ secrets.GITEA_TOKEN }}
       
     - name: Set up Python
       uses: actions/setup-python@v4
@@ -229,7 +229,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
       with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
+        token: ${{ secrets.GITEA_TOKEN }}
       
     - name: Set up Python
       uses: actions/setup-python@v4

.gitea/workflows/release.yml

@@ -3,16 +3,16 @@ name: Release - Northern Thailand Ping River Monitor
 on:
   push:
     tags:
-      - 'v*.*.*'
+      - "v*.*.*"
   workflow_dispatch:
     inputs:
       version:
-        description: 'Release version (e.g., v3.1.3)'
+        description: "Release version (e.g., v3.1.3)"
         required: true
         type: string
 
 env:
-  PYTHON_VERSION: '3.11'
+  PYTHON_VERSION: "3.11"
   REGISTRY: git.b4l.co.th
   IMAGE_NAME: b4l/northern-thailand-ping-river-monitor
   # GitHub token for better rate limits and authentication
@@ -25,44 +25,44 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.version }}
-      
+
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
-        fetch-depth: 0
-        
-    - name: Get version
-      id: version
-      run: |
-        if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-          echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
-        else
-          echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
-        fi
-        
-    - name: Generate changelog
-      id: changelog
-      run: |
-        # Generate changelog from git commits
-        echo "## Changes" > CHANGELOG.md
-        git log --pretty=format:"- %s" $(git describe --tags --abbrev=0 HEAD^)..HEAD >> CHANGELOG.md || echo "- Initial release" >> CHANGELOG.md
-        echo "" >> CHANGELOG.md
-        echo "## Docker Images" >> CHANGELOG.md
-        echo "- \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}\`" >> CHANGELOG.md
-        echo "- \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest\`" >> CHANGELOG.md
-        
-    - name: Create Release
-      uses: actions/create-release@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITEA_TOKEN }}
-      with:
-        tag_name: ${{ steps.version.outputs.version }}
-        release_name: Northern Thailand Ping River Monitor ${{ steps.version.outputs.version }}
-        body_path: CHANGELOG.md
-        draft: false
-        prerelease: false
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          fetch-depth: 0
+
+      - name: Get version
+        id: version
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
+          else
+            echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Generate changelog
+        id: changelog
+        run: |
+          # Generate changelog from git commits
+          echo "## Changes" > CHANGELOG.md
+          git log --pretty=format:"- %s" $(git describe --tags --abbrev=0 HEAD^)..HEAD >> CHANGELOG.md || echo "- Initial release" >> CHANGELOG.md
+          echo "" >> CHANGELOG.md
+          echo "## Docker Images" >> CHANGELOG.md
+          echo "- \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}\`" >> CHANGELOG.md
+          echo "- \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest\`" >> CHANGELOG.md
+
+      - name: Create Release
+        uses: actions/create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        with:
+          tag_name: ${{ steps.version.outputs.version }}
+          release_name: Northern Thailand Ping River Monitor ${{ steps.version.outputs.version }}
+          body_path: CHANGELOG.md
+          draft: false
+          prerelease: false
 
   # Build and test for release
   test-release:
@@ -71,221 +71,217 @@ jobs:
     needs: create-release
     strategy:
       matrix:
-        python-version: ['3.9', '3.10', '3.11', '3.12']
-        
+        python-version: ["3.9", "3.10", "3.11", "3.12"]
+
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
-      
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
-      with:
-        python-version: ${{ matrix.python-version }}
-        
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip --root-user-action=ignore
-        pip install --root-user-action=ignore -r requirements.txt
-        pip install --root-user-action=ignore -r requirements-dev.txt
-        
-    - name: Run full test suite
-      run: |
-        python tests/test_integration.py
-        python tests/test_station_management.py
-        python run.py --test
-        
-    - name: Build Python package
-      run: |
-        pip install --root-user-action=ignore build
-        python -m build
-        
-    - name: Upload Python package
-      uses: actions/upload-artifact@v3
-      with:
-        name: python-package-${{ matrix.python-version }}
-        path: dist/
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip --root-user-action=ignore
+          pip install --root-user-action=ignore -r requirements.txt
+          pip install --root-user-action=ignore -r requirements-dev.txt
+
+      - name: Run full test suite
+        run: |
+          python tests/test_integration.py
+          python tests/test_station_management.py
+          python run.py --test
+
+      - name: Build Python package
+        run: |
+          pip install --root-user-action=ignore build
+          python -m build
+
+      - name: Upload Python package
+        uses: actions/upload-artifact@v3
+        with:
+          name: python-package-${{ matrix.python-version }}
+          path: dist/
 
   # Build release Docker images
   build-release:
     name: Build Release Images
     runs-on: ubuntu-latest
     needs: [create-release, test-release]
-    
+
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
-      
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-      
-    - name: Log in to Container Registry
-      uses: docker/login-action@v3
-      with:
-        registry: ${{ env.REGISTRY }}
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITEA_TOKEN }}
-        
-    - name: Build and push release images
-      uses: docker/build-push-action@v5
-      with:
-        context: .
-        platforms: linux/amd64,linux/arm64
-        push: true
-        tags: |
-          ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}
-          ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-        labels: |
-          org.opencontainers.image.title=Northern Thailand Ping River Monitor
-          org.opencontainers.image.description=Real-time water level monitoring for Ping River Basin
-          org.opencontainers.image.version=${{ needs.create-release.outputs.version }}
-          org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
-          org.opencontainers.image.revision=${{ github.sha }}
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ vars.WORKER_USERNAME}}
+          password: ${{ secrets.CI_BOT_TOKEN }}
+
+      - name: Build and push release images
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          labels: |
+            org.opencontainers.image.title=Northern Thailand Ping River Monitor
+            org.opencontainers.image.description=Real-time water level monitoring for Ping River Basin
+            org.opencontainers.image.version=${{ needs.create-release.outputs.version }}
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITEA_TOKEN }}
 
   # Security scan for release
   security-scan:
     name: Security Scan
     runs-on: ubuntu-latest
     needs: build-release
-    
+
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
-      
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN}}
 
-
-  # Deploy release to production
+  # Test release deployment locally
   deploy-release:
-    name: Deploy Release
+    name: Test Release Deployment
     runs-on: ubuntu-latest
     needs: [create-release, build-release, security-scan]
     environment:
-      name: production
-      url: https://ping-river-monitor.b4l.co.th
-      
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
-      
-    - name: Deploy to production
-      run: |
-        echo "🚀 Deploying ${{ needs.create-release.outputs.version }} to production..."
-        
-        # Example deployment commands (customize for your infrastructure)
-        # kubectl set image deployment/ping-river-monitor app=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}
-        # docker-compose pull && docker-compose up -d
-        # Or webhook call to your deployment system
-        
-        echo "✅ Deployment initiated"
-        
-    - name: Health check after deployment
-      run: |
-        echo "⏳ Waiting for deployment to stabilize..."
-        sleep 60
-        
-        echo "🔍 Running health checks..."
-        curl -f https://ping-river-monitor.b4l.co.th/health
-        curl -f https://ping-river-monitor.b4l.co.th/stations
-        
-        echo "✅ Health checks passed!"
-        
-    - name: Update deployment status
-      run: |
-        echo "📊 Deployment Summary:"
-        echo "Version: ${{ needs.create-release.outputs.version }}"
-        echo "Image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}"
-        echo "URL: https://ping-river-monitor.b4l.co.th"
-        echo "Grafana: https://grafana.ping-river-monitor.b4l.co.th"
-        echo "API Docs: https://ping-river-monitor.b4l.co.th/docs"
+      name: testing
+      url: http://localhost:8080
 
-  # Post-release validation
-  validate-release:
-    name: Validate Release
-    runs-on: ubuntu-latest
-    needs: deploy-release
-    
     steps:
-    - name: Comprehensive API test
-      run: |
-        echo "🧪 Running comprehensive API tests..."
-        
-        # Test all major endpoints
-        curl -f https://ping-river-monitor.b4l.co.th/health
-        curl -f https://ping-river-monitor.b4l.co.th/metrics
-        curl -f https://ping-river-monitor.b4l.co.th/stations
-        curl -f https://ping-river-monitor.b4l.co.th/measurements/latest?limit=5
-        curl -f https://ping-river-monitor.b4l.co.th/scraping/status
-        
-        echo "✅ All API endpoints responding correctly"
-        
-    - name: Performance validation
-      run: |
-        echo "⚡ Running performance validation..."
-        
-        # Install Apache Bench
-        sudo apt-get update && sudo apt-get install -y apache2-utils
-        
-        # Test response times
-        ab -n 10 -c 2 https://ping-river-monitor.b4l.co.th/health
-        ab -n 10 -c 2 https://ping-river-monitor.b4l.co.th/stations
-        
-        echo "✅ Performance validation completed"
-        
-    - name: Data validation
-      run: |
-        echo "📊 Validating data collection..."
-        
-        # Check if recent data is available
-        response=$(curl -s https://ping-river-monitor.b4l.co.th/measurements/latest?limit=1)
-        echo "Latest measurement: $response"
-        
-        # Validate data structure (basic check)
-        if echo "$response" | grep -q "water_level"; then
-          echo "✅ Data structure validation passed"
-        else
-          echo "❌ Data structure validation failed"
-          exit 1
-        fi
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ vars.WORKER_USERNAME}}
+          password: ${{ secrets.CI_BOT_TOKEN }}
+
+      - name: Deploy to production (Local Test)
+        run: |
+          echo "🚀 Testing ${{ needs.create-release.outputs.version }} deployment locally..."
+
+          # Pull the built image
+          docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}
+
+          # Stop any existing containers
+          docker stop ping-river-monitor-test || true
+          docker rm ping-river-monitor-test || true
+
+          # Start the container for testing
+          docker run -d \
+            --name ping-river-monitor-test \
+            -p 8080:8000 \
+            -e LOG_LEVEL=INFO \
+            -e DB_TYPE=sqlite \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}
+
+          echo "✅ Container started for testing"
+
+      - name: Health check after deployment
+        run: |
+          echo "⏳ Waiting for application to start..."
+          sleep 30
+
+          echo "🔍 Running health checks against local container..."
+
+          # Check if container is running
+          docker ps | grep ping-river-monitor-test || echo "⚠️ Container not found in docker ps"
+
+          # Check container logs for any startup issues
+          echo "📋 Recent container logs:"
+          docker logs --tail 10 ping-river-monitor-test || true
+
+          # Wait for the application to be ready
+          for i in {1..12}; do
+            if curl -f http://127.0.0.1:8080/health; then
+              echo "✅ Health endpoint responding"
+              break
+            else
+              echo "⏳ Waiting for health endpoint... (attempt $i/12)"
+              sleep 10
+            fi
+          done
+
+          # Test API endpoints
+          echo "🧪 Testing API endpoints..."
+          curl -f http://127.0.0.1:8080/health || exit 1
+          curl -f http://127.0.0.1:8080/docs || exit 1
+          curl -f http://127.0.0.1:8080/stations || exit 1
+          curl -f http://127.0.0.1:8080/metrics || exit 1
+
+          echo "✅ All health checks passed!"
+
+      - name: Container logs and cleanup
+        if: always()
+        run: |
+          echo "📋 Container logs:"
+          docker logs ping-river-monitor-test || true
+
+          echo "🧹 Cleaning up test container..."
+          docker stop ping-river-monitor-test || true
+          docker rm ping-river-monitor-test || true
+
+          echo "📊 Deployment Test Summary:"
+          echo "Version: ${{ needs.create-release.outputs.version }}"
+          echo "Image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}"
+          echo "Status: Container tested successfully"
+          echo "Ready for production deployment"
 
   # Notify stakeholders
   notify:
     name: Notify Release
     runs-on: ubuntu-latest
-    needs: [create-release, validate-release]
+    needs: [create-release, deploy-release]
     if: always()
-    
+
     steps:
-    - name: Notify success
-      if: needs.validate-release.result == 'success'
-      run: |
-        echo "🎉 Release ${{ needs.create-release.outputs.version }} deployed successfully!"
-        echo "🌐 Production URL: https://ping-river-monitor.b4l.co.th"
-        echo "📊 Grafana: https://grafana.ping-river-monitor.b4l.co.th"
-        echo "📚 API Docs: https://ping-river-monitor.b4l.co.th/docs"
-        
-        # Add notification to Slack, Discord, email, etc.
-        # curl -X POST -H 'Content-type: application/json' \
-        #   --data '{"text":"🎉 Northern Thailand Ping River Monitor ${{ needs.create-release.outputs.version }} deployed successfully!"}' \
-        #   ${{ secrets.SLACK_WEBHOOK_URL }}
-        
-    - name: Notify failure
-      if: needs.validate-release.result == 'failure'
-      run: |
-        echo "❌ Release ${{ needs.create-release.outputs.version }} deployment failed!"
-        echo "Please check the logs and take corrective action."
-        
-        # Add failure notification
-        # curl -X POST -H 'Content-type: application/json' \
-        #   --data '{"text":"❌ Northern Thailand Ping River Monitor ${{ needs.create-release.outputs.version }} deployment failed!"}' \
-        #   ${{ secrets.SLACK_WEBHOOK_URL }}
+      - name: Notify success
+        if: needs.deploy-release.result == 'success'
+        run: |
+          echo "🎉 Release ${{ needs.create-release.outputs.version }} tested successfully!"
+          echo "🧪 Local Test: Passed all health checks"
+          echo "<EFBFBD> GDocker Image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}"
+          echo "✅ Ready for production deployment"
+
+          # Add notification to Slack, Discord, email, etc.
+          # curl -X POST -H 'Content-type: application/json' \
+          #   --data '{"text":"🎉 Northern Thailand Ping River Monitor ${{ needs.create-release.outputs.version }} tested and ready for deployment!"}' \
+          #   ${{ secrets.SLACK_WEBHOOK_URL }}
+
+      - name: Notify failure
+        if: needs.deploy-release.result == 'failure'
+        run: |
+          echo "❌ Release ${{ needs.create-release.outputs.version }} testing failed!"
+          echo "Please check the logs and fix issues before production deployment."
+
+          # Add failure notification
+          # curl -X POST -H 'Content-type: application/json' \
+          #   --data '{"text":"❌ Northern Thailand Ping River Monitor ${{ needs.create-release.outputs.version }} testing failed!"}' \
+          #   ${{ secrets.SLACK_WEBHOOK_URL }}

.gitea/workflows/security.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.CI_BOT_TOKEN }}
+          token: ${{ secrets.GITEA_TOKEN }}
 
       - name: Set up Python
         uses: actions/setup-python@v4
@@ -95,7 +95,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.CI_BOT_TOKEN }}
+          token: ${{ secrets.GITEA_TOKEN }}
 
       - name: Set up Python
         uses: actions/setup-python@v4
@@ -142,7 +142,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.CI_BOT_TOKEN }}
+          token: ${{ secrets.GITEA_TOKEN }}
 
       - name: Set up Python
         uses: actions/setup-python@v4
@@ -183,7 +183,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.CI_BOT_TOKEN }}
+          token: ${{ secrets.GITEA_TOKEN }}
 
       - name: Set up Python
         uses: actions/setup-python@v4

Dockerfile

@@ -22,26 +22,27 @@ FROM python:3.11-slim
 # Set working directory
 WORKDIR /app
 
-# Install runtime dependencies
+# Install runtime dependencies and create user
 RUN apt-get update && apt-get install -y \
     wget \
     curl \
     && rm -rf /var/lib/apt/lists/* \
-    && groupadd -r appuser && useradd -r -g appuser appuser
+    && groupadd -r appuser && useradd -r -g appuser appuser \
+    && mkdir -p /home/appuser/.local
 
 # Copy Python packages from builder stage
-COPY --from=builder /root/.local /root/.local
+COPY --from=builder /root/.local /home/appuser/.local
 
 # Copy application code
 COPY . .
 
 # Create logs directory and set permissions
-RUN mkdir -p logs && chown -R appuser:appuser /app
+RUN mkdir -p logs && chown -R appuser:appuser /app /home/appuser/.local
 
 # Set environment variables
 ENV PYTHONUNBUFFERED=1
 ENV TZ=Asia/Bangkok
-ENV PATH=/root/.local/bin:$PATH
+ENV PATH=/home/appuser/.local/bin:$PATH
 
 # Switch to non-root user
 USER appuser