# syntax=docker/dockerfile:1.7

# ---- Build stage --------------------------------------------------------
FROM golang:1.25-alpine AS build

WORKDIR /src

# Pure-Go SQLite (modernc.org/sqlite) means we can keep CGO off and build a
# fully static binary that runs on distroless/static.
ENV CGO_ENABLED=0 \
    GOOS=linux \
    GOFLAGS="-trimpath"

# Cache module downloads in a separate layer.
COPY go.mod go.sum* ./
RUN go mod download

COPY . .

ARG VERSION=dev
RUN go build -ldflags="-s -w -X main.version=${VERSION}" \
    -o /out/restic-manager-server \
    ./cmd/server

# ---- Runtime stage ------------------------------------------------------
FROM gcr.io/distroless/static-debian12:nonroot

LABEL org.opencontainers.image.source="https://gitea.dcglab.co.uk/steve/restic-manager"
LABEL org.opencontainers.image.licenses="PolyForm-Noncommercial-1.0.0"

USER nonroot:nonroot
WORKDIR /

COPY --from=build /out/restic-manager-server /usr/local/bin/restic-manager-server

EXPOSE 8443
ENTRYPOINT ["/usr/local/bin/restic-manager-server"]