FROM debian:bookworm-slim

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --system tresor \
    && useradd --system --gid tresor --no-create-home tresor

WORKDIR /app
COPY tresord /usr/local/bin/tresord
COPY tresor /usr/local/bin/tresor
COPY migrations /app/migrations

RUN mkdir -p /data && chown tresor:tresor /data

ENV TRESOR_BIND_ADDR=0.0.0.0:9471
ENV TRESOR_DB_PATH=/data/tresor.db
ENV TRESOR_MIGRATIONS_DIR=/app/migrations/sqlite
ENV TRESOR_AUTH_MODE=oidc
ENV TRESOR_AUTHZ_MODE=regelwerk
ENV TRESOR_KEY_PROVIDER=age-file
ENV TRESOR_AGE_RECIPIENTS_FILE=/run/secrets/tresor-age-recipients
ENV TRESOR_AGE_IDENTITY_FILE=/run/secrets/tresor-age-identity

EXPOSE 9471

HEALTHCHECK --interval=10s --timeout=3s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:9471/health || exit 1

USER tresor

CMD ["tresord"]
