# syntax=docker/dockerfile:1
# Build:  docker build -t meguri .
# Run:    docker run -p 3000:3000 \
#           -e DATABASE_URL=postgresql://USER:PASSWORD@HOST:5432/meguri \
#           -e MEGURI_PUBLIC_URL=https://meguri.example.internal \
#           -e MEGURI_OIDC_CLIENT_SECRET=... \
#           -v ./instance-config.yaml:/etc/meguri/config.yaml:ro meguri
# The instance configuration (workspaces, group mappings, sign-in) is mounted, never baked in.
# See deploy/instance-config.example.yaml and docs/deployment.md.

FROM rust:1.97-bookworm AS build
WORKDIR /build
# Compile dependencies in their own layer so source edits do not rebuild them.
COPY Cargo.toml Cargo.lock ./
RUN mkdir src && echo 'fn main() {}' > src/main.rs && touch src/lib.rs \
    && cargo build --locked --release && rm -rf src
COPY src ./src
COPY static ./static
RUN touch src/main.rs src/lib.rs && cargo build --locked --release

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/*
COPY --from=build /build/target/release/meguri /usr/local/bin/meguri
COPY static/vendor/ALPINE-LICENSE.md /usr/share/licenses/meguri/alpine-MIT.md
COPY static/vendor/cytoscape.LICENSE /usr/share/licenses/meguri/cytoscape-MIT.md
USER 65532:65532
ENV MEGURI_BIND=0.0.0.0:3000 \
    MEGURI_CONFIG_FILE=/etc/meguri/config.yaml
EXPOSE 3000
ENTRYPOINT ["/usr/local/bin/meguri"]