# syntax=docker/dockerfile:1
# Requires --build-context server_notices=<prepared server-notices directory>.
# See docs/linux-packaging.md. Missing/stale notices fail before application build.
FROM rust:1.90-bookworm AS builder
RUN apt-get update && apt-get install -y --no-install-recommends python3 \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /src
COPY Cargo.toml Cargo.lock ./
COPY LICENSE ./LICENSE
COPY build ./build
COPY crates ./crates
COPY docs/openapi.json ./docs/openapi.json
COPY scripts/package-artifacts.py ./scripts/package-artifacts.py
COPY --from=server_notices / /tmp/server-notices/
RUN python3 scripts/package-artifacts.py verify-notices \
    --directory /tmp/server-notices --repository /src --target x86_64-unknown-linux-gnu
RUN cargo build --release --locked -p oa-server

FROM debian:bookworm-slim
RUN groupadd --gid 10001 arcadia \
    && useradd --uid 10001 --gid 10001 --no-create-home --home-dir /data arcadia \
    && mkdir /data \
    && chown 10001:10001 /data
COPY --from=builder /src/target/release/arcadia-server /usr/local/bin/arcadia-server
COPY --from=builder /tmp/server-notices/ /usr/share/doc/arcadia-server/
USER 10001:10001
VOLUME ["/data"]
EXPOSE 8787
ENTRYPOINT ["/usr/local/bin/arcadia-server"]
CMD ["--bind", "0.0.0.0:8787", "--data-dir", "/data", "--token-file", "/run/secrets/arcadia-token"]