"""Entrypoint. Runs the Flask app over plain HTTP on a local port.

TLS is NOT terminated here: a trusted reverse proxy (nginx/caddy/...)
in front handles HTTPS and forwards to this internal HTTP port. The
proxy must be the only thing reachable from outside; bind this app to
127.0.0.1 (or a private interface) only.
"""

import os

from backend.app import app
from backend import storage


def main():
    storage.init_db()

    host = os.environ.get("HOST", "127.0.0.1")
    port = int(os.environ.get("PORT", "8085"))

    app.run(host=host, port=port)


if __name__ == "__main__":
    main()