# Builds gitfed-server, gitfed-web, gitfed-tui into a single image.
# gitfed-tui is included so an admin can `kubectl exec` into the pod and
# bootstrap the first account (username/password/admin flag) directly
# against the live admin socket — see deploy/k8s/README.md.
#
# gitfed-renew-cert, gitfed-install and gitfed-ctl are NOT included — all
# three are host-side tools that shell out to docker/k3s/kubectl on the
# machine they manage (gitfed-install before the pod even exists, gitfed-ctl
# to rebuild and redeploy it), none of which exist in this minimal runtime
# image, so they could never run inside the container they help set up.

FROM golang:1.25-bookworm AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN VERSION=$(cat VERSION) && \
    LDFLAGS="-X git.neuromancer.ovh/bastien-mrq/gitfed/internal/version.Version=$VERSION" && \
    CGO_ENABLED=0 go build -ldflags "$LDFLAGS" -o /out/gitfed-server ./cmd/gitfed-server && \
    CGO_ENABLED=0 go build -ldflags "$LDFLAGS" -o /out/gitfed-web    ./cmd/gitfed-web    && \
    CGO_ENABLED=0 go build -ldflags "$LDFLAGS" -o /out/gitfed-tui    ./cmd/gitfed-tui

FROM debian:bookworm-slim
RUN apt-get update && \
    apt-get install -y --no-install-recommends git ca-certificates && \
    rm -rf /var/lib/apt/lists/* && \
    useradd --system --create-home --home-dir /home/gitfed --uid 1000 gitfed && \
    mkdir -p /data && chown gitfed:gitfed /data

COPY --from=builder /out/gitfed-server /out/gitfed-web /out/gitfed-tui /usr/local/bin/

USER gitfed
WORKDIR /home/gitfed
VOLUME /data
# No ENTRYPOINT/CMD: each container in the pod spec picks which binary to
# run (gitfed-server / gitfed-web) against the same image.