# syntax=docker/dockerfile:1

# Build context is the REPO ROOT (see docker-compose.yml / CI workflow):
#   docker build -f Dockerfile .

# Build stage
# Build stage runs on the builder's native platform; the binary is
# cross-compiled for the target, so arm64 doesn't pay QEMU emulation time.
FROM --platform=$BUILDPLATFORM golang:alpine AS build
ARG TARGETOS TARGETARCH
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -trimpath -ldflags="-s -w" -o /out/server ./cmd/server
# Runtime stage (alpine + busybox so the docker-compose healthcheck can use wget)
FROM alpine:3.20
RUN apk add --no-cache ca-certificates wget \
    && adduser -D -u 10001 appuser \
    && mkdir -p /data/uploads \
    && chown -R appuser:appuser /data/uploads
USER appuser
WORKDIR /app
COPY --from=build /out/server /app/server
# OpenAPI spec served on /openapi.yaml and /docs (Scalar). Baked in so the
# container is self-contained; override with OPENAPI_PATH to use your own.
COPY docs/openapi.yaml /app/openapi.yaml
ENV OPENAPI_PATH=/app/openapi.yaml
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD wget -qO- http://localhost:8080/health || exit 1
ENTRYPOINT ["/app/server"]