# R-972: a supported, patched Go and the current Alpine, pinned by version and digest (no moving tag).
# upstream: osv:Go/stdlib
FROM golang:1.27.3-alpine3.24@sha256:b8c9b82affbbb82a020bbcf998dad2ba9516944ac7e883524642a481a9505e9c AS builder

WORKDIR /app

COPY go.mod go.sum* ./
RUN go mod download || true

COPY . .

# R-208: the build args are declared HERE, below the module download. An ARG is part of every later RUN's
# cache key, so declared above `go mod download` a fresh VERSION re-ran the download on every build
# (~440 MB of dead cache each). Pinned by scripts/test_dockerfile_arg_order.py.
ARG VERSION=dev
ARG BUILD_TIME=unknown

RUN go mod tidy && \
    CGO_ENABLED=0 go build \
    -ldflags "-s -w -X main.Version=${VERSION} -X main.BuildTime=${BUILD_TIME}" \
    -o /felhom-hub ./cmd/hub/

# upstream: gap:Alpine's package fixes (Samba among them) are in its secdb, which the watch does not read; BEHIND on the point release is the signal
FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6

RUN apk add --no-cache ca-certificates tzdata

COPY --from=builder /felhom-hub /usr/local/bin/felhom-hub

RUN mkdir -p /data /etc/felhom-hub

# Seed assets: baked into image, copied to PVC on first run
COPY assets/ /usr/share/felhom/assets-seed/

ENV TZ=Europe/Budapest

EXPOSE 8080

ENTRYPOINT ["/usr/local/bin/felhom-hub"]
CMD ["-config", "/etc/felhom-hub/hub.yaml"]