# syntax=docker/dockerfile:1

# --- Build stage -----------------------------------------------------------
FROM golang:1.25-alpine AS build
WORKDIR /src

# Cache modules independently of source.
COPY go.mod go.sum ./
RUN go mod download

COPY . .
# CGO disabled → a fully static binary (boltdb is pure Go), so it runs on scratch.
# The command lives in ./cmd/nostermd; internal/* holds the relay packages.
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/nostermd ./cmd/nostermd
# Stage an empty data dir we can copy in with the correct nonroot ownership.
RUN mkdir -p /out/data

# --- Runtime stage ---------------------------------------------------------
FROM gcr.io/distroless/static-debian12:nonroot AS runtime

# Binary + a data dir pre-owned by the distroless nonroot uid (65532), so the
# unprivileged process can write the boltdb file to the mounted volume.
COPY --from=build --chown=65532:65532 /out/nostermd /nostermd
COPY --from=build --chown=65532:65532 /out/data /data

# Persisted event storage (mount a volume here in production).
VOLUME ["/data"]
ENV RELAY_DATA_DIR=/data \
	RELAY_ADDR=:3334

USER 65532:65532
EXPOSE 3334
ENTRYPOINT ["/nostermd"]