FROM rust:1-bookworm AS builder

WORKDIR /app

# Cache dependency compilation separately from source changes
COPY Cargo.toml Cargo.lock ./
COPY crates/tresor-core/Cargo.toml crates/tresor-core/
COPY crates/tresor-store/Cargo.toml crates/tresor-store/
COPY crates/tresor-api/Cargo.toml crates/tresor-api/
COPY crates/tresor-cli/Cargo.toml crates/tresor-cli/

# Create stub source files to allow cargo fetch/build of deps only
RUN mkdir -p crates/tresor-core/src crates/tresor-store/src crates/tresor-api/src && \
    mkdir -p crates/tresor-cli/src && \
    echo 'pub mod credential; pub mod crypto; pub mod error; pub mod secret; pub mod store;' > crates/tresor-core/src/lib.rs && \
    touch crates/tresor-core/src/credential.rs crates/tresor-core/src/crypto.rs crates/tresor-core/src/error.rs crates/tresor-core/src/secret.rs crates/tresor-core/src/store.rs && \
    echo 'pub mod migrate; pub mod sqlite_store;' > crates/tresor-store/src/lib.rs && \
    touch crates/tresor-store/src/migrate.rs crates/tresor-store/src/sqlite_store.rs && \
    echo 'pub mod auth; pub mod authz; pub mod key_provider; pub mod routes; pub mod state; pub mod types;' > crates/tresor-api/src/lib.rs && \
    touch crates/tresor-api/src/auth.rs crates/tresor-api/src/authz.rs crates/tresor-api/src/key_provider.rs crates/tresor-api/src/routes.rs crates/tresor-api/src/state.rs crates/tresor-api/src/types.rs && \
    echo 'fn main() {}' > crates/tresor-api/src/main.rs && \
    echo 'fn main() {}' > crates/tresor-cli/src/main.rs && \
    cargo build --release -p tresor-api -p tresor-cli && \
    rm -rf crates/tresor-*/src

# Build actual source
COPY crates/ crates/
COPY migrations/ migrations/
RUN cargo build --release -p tresor-api -p tresor-cli

FROM debian:bookworm-slim

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --system tresor \
    && useradd --system --gid tresor --no-create-home tresor

WORKDIR /app
COPY --from=builder /app/target/release/tresord /usr/local/bin/tresord
COPY --from=builder /app/target/release/tresor /usr/local/bin/tresor
COPY --from=builder /app/migrations /app/migrations

RUN mkdir -p /data && chown tresor:tresor /data

ENV TRESOR_BIND_ADDR=0.0.0.0:9471
ENV TRESOR_DB_PATH=/data/tresor.db
ENV TRESOR_MIGRATIONS_DIR=/app/migrations/sqlite
ENV TRESOR_AUTH_MODE=oidc
ENV TRESOR_AUTHZ_MODE=regelwerk
ENV TRESOR_KEY_PROVIDER=age-file
ENV TRESOR_AGE_RECIPIENTS_FILE=/run/secrets/tresor-age-recipients
ENV TRESOR_AGE_IDENTITY_FILE=/run/secrets/tresor-age-identity

EXPOSE 9471

VOLUME ["/data"]

HEALTHCHECK --interval=10s --timeout=3s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:9471/health || exit 1

USER tresor

CMD ["tresord"]
