# Development only. Not for production use.
# Unlike knot2/Containerfile (distroless), this image keeps a shell: localinfra
# only learns alice's DID at bootstrap, so the entrypoint has to read it.

FROM docker.io/library/rust:1.96-slim-trixie AS builder
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates build-essential cmake perl pkg-config clang mold \
    && rm -rf /var/lib/apt/lists/*
ENV RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=mold"
WORKDIR /src
COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
COPY crates ./crates
COPY bobbin/crates ./bobbin/crates
COPY shuttle ./shuttle
COPY gitmirror ./gitmirror
COPY lexicons ./lexicons
COPY knot2/crates ./knot2/crates
COPY knot2/third_party ./knot2/third_party
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/src/target \
    cargo build --release --package knot-server && \
    cp target/release/knot-server /usr/local/bin/knot-server
RUN strip /usr/local/bin/knot-server

FROM debian:trixie-slim
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl \
    && rm -rf /var/lib/apt/lists/*
COPY --from=builder /usr/local/bin/knot-server /usr/local/bin/knot-server

COPY <<'EOF' /usr/local/bin/knot-entrypoint.sh
#!/bin/sh
set -eu
# trust caddy's `tls internal` root system-wide, so `knot-server admin` verifies it.
if [ -f /etc/ssl/certs/tngl.crt ]; then
  cp /etc/ssl/certs/tngl.crt /usr/local/share/ca-certificates/tngl.crt
  update-ca-certificates >/dev/null
fi
[ -z "${KNOT_ADMINS:-}" ] && [ -r /shared/owner-did ] && \
    export KNOT_ADMINS="$(cat /shared/owner-did)"
: "${KNOT_ADMINS:?set via env or /shared/owner-did}"

# the knot creates its host key and sealed store (parent dirs and all) on
# demand, but scan_path has to already exist before it will start
mkdir -p "${KNOT_SCAN_PATH:-/home/git/repositories}"

exec /usr/local/bin/knot-server
EOF
RUN chmod +x /usr/local/bin/knot-entrypoint.sh

EXPOSE 5555 2222
ENTRYPOINT ["/usr/local/bin/knot-entrypoint.sh"]