FROM golang:1.25-bookworm AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
ARG VERSION=dev
RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=${VERSION}" -o /out/vibeproxy ./cmd/vibeproxy
# distroless:nonroot runs as uid:gid 65532:65532 with no shell, so create
# and own /data here — Docker seeds a fresh named volume's permissions
# from the image directory it overlays, which is otherwise root:root.
RUN mkdir -p /out/data && chown 65532:65532 /out/data

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/vibeproxy /usr/local/bin/vibeproxy
COPY --from=build --chown=65532:65532 /out/data /data
VOLUME ["/data"]
# The nonroot container user can't bind ports <1024, so vibeproxy listens
# on 8080/8443 inside the container; map host 80/443 to these in
# docker-compose.yml or `docker run -p`.
EXPOSE 8080 8443 8081
ENV VIBEPROXY_DATA_DIR=/data \
    VIBEPROXY_DB_PATH=/data/vibeproxy.db \
    VIBEPROXY_HTTP_ADDR=:8080 \
    VIBEPROXY_HTTPS_ADDR=:8443 \
    VIBEPROXY_ADMIN_ADDR=:8081
ENTRYPOINT ["/usr/local/bin/vibeproxy"]
CMD ["serve"]
