# syntax=docker/dockerfile:1.7
# Minimal static-musl image for the d-OAuth-Client BFF + Leptos UI.
#
# Stages: web -> chef -> planner -> builder -> runtime.
# - `web`: builds the Leptos CSR/WASM bundle with a pinned, prebuilt Trunk
#   (which fetches its pinned wasm-bindgen/tailwindcss tools), producing
#   `/app/crates/web/dist`.
# - `chef`: pinned rust toolchain + cargo-chef + musl targets.
# - `planner`: captures the dependency recipe so dependency layers cache.
# - `builder`: cooks dependencies, then builds the locked, fully-static musl
#   `server` binary (rustls `ring` provider only; no aws-lc-sys/OpenSSL).
# - `runtime`: pinned-digest distroless `static-debian12:nonroot` (no shell,
#   no package manager, CA bundle + nonroot /etc/passwd entry included). It
#   carries the BFF binary and the built WASM assets.
#
# BuildKit cache mounts keep the cargo registry/git cache and the target
# directory warm across rebuilds without baking them into any layer.

# syntax=docker/dockerfile:1.7

# Pinned bases (multi-arch index digests; buildx selects per-platform):
# - rust 1.99-bookworm (matches rust-toolchain.toml stable; rustc 1.99.0)
# - distroless static-debian12:nonroot (UID:GID 65532, no shell)
ARG RUST_BASE=docker.io/library/rust:1.99-bookworm@sha256:59037199c44290f2befcdd58dcc540164763fc296950255aaefeef096a1866b0
ARG RUNTIME_BASE=gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
ARG TRUNK_VERSION=0.21.14

# ---------------------------------------------------------------------------
# web: prebuilt Trunk builds the CSR/WASM UI. Trunk downloads its pinned
# wasm-bindgen (0.2.129) and tailwindcss (4.3.3) tools at build time.
# ---------------------------------------------------------------------------
FROM ${RUST_BASE} AS web
ARG TARGETARCH
ARG TRUNK_VERSION
WORKDIR /app
COPY . .
RUN set -eux; \
    rustup target add wasm32-unknown-unknown; \
    case "${TARGETARCH}" in \
      arm64) trunk_target=aarch64-unknown-linux-musl ;; \
      *)     trunk_target=x86_64-unknown-linux-musl ;; \
    esac; \
    curl -fsSL -o /tmp/trunk.tar.gz \
      "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-${trunk_target}.tar.gz"; \
    tar -xzf /tmp/trunk.tar.gz -C /usr/local/bin; \
    rm /tmp/trunk.tar.gz; \
    cd crates/web && trunk build --release

FROM ${RUST_BASE} AS chef
WORKDIR /app
# Reproducible builds: fixed epoch (overridden by bake) and no incremental.
ARG SOURCE_DATE_EPOCH=0
ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH} \
  CARGO_INCREMENTAL=0 \
  CARGO_NET_RETRY=10
RUN cargo install cargo-chef --locked --version 0.1.71 \
  && apt-get update \
  && apt-get install -y --no-install-recommends musl-tools \
  && rm -rf /var/lib/apt/lists/* \
  && rustup target add x86_64-unknown-linux-musl aarch64-unknown-linux-musl wasm32-unknown-unknown

FROM chef AS planner
COPY . .
RUN cargo chef prepare --recipe-path recipe.json

FROM chef AS builder
ARG TARGETARCH
COPY --from=planner /app/recipe.json recipe.json
# Cook (compile) third-party dependencies only: this layer reuses the cache
# unless Cargo.toml/Cargo.lock change.
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    --mount=type=cache,target=/app/target \
    sh -c 'if [ "$TARGETARCH" = "arm64" ]; then export MUSL_TARGET=aarch64-unknown-linux-musl; else export MUSL_TARGET=x86_64-unknown-linux-musl; fi && \
    rustup target add "$MUSL_TARGET" && \
    cargo chef cook --locked --release --target "$MUSL_TARGET" --recipe-path recipe.json --bin server'
COPY . .
# Locked, offline release build of the server binary only. The target dir is
# a cache mount, so the binary is copied out to /app/dist in the same layer.
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    --mount=type=cache,target=/app/target \
    sh -c 'if [ "$TARGETARCH" = "arm64" ]; then export MUSL_TARGET=aarch64-unknown-linux-musl; else export MUSL_TARGET=x86_64-unknown-linux-musl; fi && \
    rustup target add "$MUSL_TARGET" && \
    cargo build --locked --release --target "$MUSL_TARGET" --bin server && \
    mkdir -p /app/dist && \
    cp "/app/target/$MUSL_TARGET/release/server" /app/dist/server'

FROM ${RUNTIME_BASE} AS runtime
WORKDIR /app
# Static BFF binary plus the release WASM assets it serves from dist_dir.
COPY --from=builder /app/dist/server /app/server
COPY --from=web /app/crates/web/dist /app/crates/web/dist
# Single-origin demo bind; the SPA is served from the committed dist path.
# Secret-bearing config/client.json, config/dpop-key.json and config.json are
# mounted at runtime, never baked in.
ENV SERVER_BIND_ADDR=0.0.0.0:3000 \
  SERVER_DIST_DIR=/app/crates/web/dist
# Non-root, exec-form entrypoint (no shell in the image to interpret one).
USER 65532:65532
EXPOSE 3000
# Shell-less self-probe: the `healthcheck` subcommand GETs /healthz over
# loopback and exits 0/1 without starting the HTTP server.
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s CMD ["/app/server","healthcheck"]
ENTRYPOINT ["/app/server"]
LABEL org.opencontainers.image.title="d-OAuth-Client" \
  org.opencontainers.image.description="OAuth 2.1 BFF + Leptos WASM demo client (static musl, non-root, no shell)" \
  org.opencontainers.image.licenses="MIT OR Apache-2.0" \
  org.opencontainers.image.revision="unknown" \
  org.opencontainers.image.vendor="d-oauth"