# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
#
# Multi-stage, no Nix. The `vendored` feature statically links libgit2, so the
# runtime image needs no system libgit2. The Nix build (flake.nix) is the
# alternative; `packages.container` produces an equivalent image natively.

# ---- Builder ----
FROM rustlang/rust:nightly-slim AS builder

# pkg-config + libssl-dev for native-tls (mail); cmake + a C/C++ toolchain for
# aws-lc-sys (SSH and the S3 client's aws-lc-rs TLS, which builds C++ sources);
# git for build scripts.
RUN apt-get update && apt-get install -y --no-install-recommends \
        pkg-config libssl-dev cmake g++ git ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build

# Cache the dependency layer: build a stub crate graph first, then the real source.
COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
COPY crates ./crates
COPY src ./src
COPY migrations ./migrations
COPY assets ./assets

RUN cargo build --release --features vendored \
    && /build/target/release/fabrica --version

# ---- Runtime ----
FROM debian:stable-slim

# git is mandatory for pack transport; tini for signal handling; libssl3 for
# native-tls. Verify git is present at build time so a missing plumbing binary is
# a build failure, not a runtime surprise.
RUN apt-get update && apt-get install -y --no-install-recommends \
        git ca-certificates tini libssl3 \
    && rm -rf /var/lib/apt/lists/* \
    && git --version

RUN useradd --uid 10001 --system --home-dir /var/lib/fabrica --shell /usr/sbin/nologin fabrica \
    && install -d -o fabrica -g fabrica -m 0750 /var/lib/fabrica

COPY --from=builder /build/target/release/fabrica /usr/local/bin/fabrica
RUN fabrica --version && git --version

USER fabrica
# The data directory is created and owned by the fabrica user above so first-run
# generation (signing secret, SQLite database, repos) can write to it. A bind
# mount overrides this ownership — chown it to uid 10001 on the host.
VOLUME /var/lib/fabrica
EXPOSE 8080 2222

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
    CMD ["fabrica", "doctor", "--quiet"]

ENTRYPOINT ["/usr/bin/tini", "--", "fabrica"]
CMD ["serve"]