from rust:1.96-slim-trixie as builder

arg TAG='master'

workdir /src
run apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates git build-essential cmake perl pkg-config clang mold \
    && rm -rf /var/lib/apt/lists/*
env RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=mold"
run git clone --depth 1 -b ${TAG} https://tangled.org/did:plc:j5hmlfdrwkvtxm7cjmu7j2is .
run cargo build --release --package knot-server --package knot-migrate
run strip target/release/knot-server target/release/knot-migrate

from debian:trixie-slim
env KNOT_SCAN_PATH=/data/repos
env KNOT_SEALED_KEY_FILE=/data/sealed-keys
env KNOT_SSH_HOST_KEY_FILE=/data/ssh_host_key
env KNOT_MASTER_KEY_ENV=KNOT_MASTER_KEY
expose 5555 2222

label org.opencontainers.image.title='knot'
label org.opencontainers.image.description='data server for tangled'
label org.opencontainers.image.source='https://tangled.org/did:plc:f5s5la5wlofsxidb3zemdune'
label org.opencontainers.image.url='https://tangled.org'
label org.opencontainers.image.vendor='tangled.org'
label org.opencontainers.image.licenses='MIT'

arg UID=1000
arg GID=1000

run apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl \
    && rm -rf /var/lib/apt/lists/*
run groupadd -g $GID -f knot && useradd -u $UID -g $GID -d /data knot
run mkdir -p /data/repos && chown -R $UID:$GID /data
copy --from=builder /src/target/release/knot-server /usr/bin/knot-server
copy --from=builder /src/target/release/knot-migrate /usr/bin/knot-migrate

healthcheck --interval=60s --timeout=30s --start-period=600s --retries=3 \
    cmd curl -f http://localhost:5555/xrpc/_health || exit 1

user knot
entrypoint ["/usr/bin/knot-server"]