# syntax=docker/dockerfile:1

# Bun bundles the web SPA from inside web/build.rs. Take the binary from the
# official image instead of running the network installer: the installer pulls
# its archive from GitHub releases, which regularly times out here.
FROM oven/bun:1-slim AS bun

FROM rust:1-bookworm AS rust-deps

RUN apt-get update && apt-get install -y --no-install-recommends \
        pkg-config \
        libssl-dev \
        cmake \
        perl \
        git \
        curl \
        ca-certificates \
        unzip \
        protobuf-compiler \
    && rm -rf /var/lib/apt/lists/*

COPY --from=bun /usr/local/bin/bun /usr/local/bin/bun

WORKDIR /build

COPY Cargo.toml Cargo.lock ./


FROM rust-deps AS builder
COPY lib ./lib
COPY app ./app
COPY web ./web

RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    --mount=type=cache,target=/build/target \
    rm -rf /build/target/release/build/web-* \
           /build/target/release/deps/web-* 2>/dev/null; \
    cargo build --release --workspace --bins && \
    mkdir -p /out && \
    for b in apihost migrate openapi; do \
        cp "target/release/$b" /out/; \
    done

########## runtime ##########
FROM debian:bookworm-slim

# ca-certificates: outbound TLS; git: available for manual maintenance
RUN apt-get update && apt-get install -y --no-install-recommends \
        git \
        ca-certificates \
        libssl3 \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --system --create-home --uid 10001 gitdata \
    && mkdir -p /opt/gitdata/repos /opt/gitdata/objects \
    && chown -R gitdata:gitdata /opt/gitdata

WORKDIR /app

COPY --chown=gitdata:gitdata config/default.toml config/default.toml
COPY --from=builder /out/apihost /out/migrate /out/openapi /usr/local/bin/

USER gitdata

EXPOSE 3000

CMD ["apihost"]