# syntax=docker/dockerfile:1

ARG VERSION=dev
ARG BUILD_DATE=unknown

# --- builder: compile statique du binaire Go (CGO off, musl) ---
FROM golang:1.26-alpine AS builder
ENV GOTOOLCHAIN=auto
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
ARG VERSION
RUN CGO_ENABLED=0 GOOS=linux go build \
    -trimpath \
    -ldflags "-s -w -X main.version=${VERSION}" \
    -o /out/vaultdrop-server \
    ./cmd/server/main.go

# --- runtime: mince, Tesseract (fra+eng) embarqué pour l'OCR ---
FROM alpine:3.20
RUN apk add --no-cache \
    ca-certificates \
    tzdata \
    tesseract-ocr \
    tesseract-ocr-data-eng \
    tesseract-ocr-data-fra

WORKDIR /app

ARG VERSION
ARG BUILD_DATE
LABEL org.opencontainers.image.title="vaultdrop-server" \
      org.opencontainers.image.description="VaultDrop backend API (Go/Gin + PostgreSQL) — local-first document vault" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.licenses="AGPL-3.0-only" \
      org.opencontainers.image.source="https://gitlab.com/thirdshop-org/dot" \
      org.opencontainers.image.url="https://thirdshop.fr/en/applications/vault/" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.revision=""

COPY --from=builder /out/vaultdrop-server /usr/local/bin/vaultdrop-server

# UPLOAD_DIR persistant, user non-root
RUN mkdir -p /app/uploads \
    && adduser -D -H -u 10001 vaultdrop \
    && chown vaultdrop:vaultdrop /app/uploads
VOLUME /app/uploads

ENV PORT=8080 \
    UPLOAD_DIR=/app/uploads

USER vaultdrop
EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
    CMD wget -q -O - http://127.0.0.1:8080/api/v1/health || exit 1

ENTRYPOINT ["vaultdrop-server"]