# syntax=docker/dockerfile:1
FROM rust:1.99-trixie AS build
WORKDIR /build
COPY . .
RUN if [ ! -f Cargo.lock ]; then cargo generate-lockfile; fi \
    && cargo build --locked --release

FROM debian:trixie-slim AS runtime
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates python3 python3-venv python3-pip openssl certbot \
        python3-certbot-dns-cloudflare python3-certbot-dns-ovh python3-certbot-dns-rfc2136 \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --system --gid 10001 rustproxy \
    && useradd --system --uid 10001 --gid rustproxy --home /var/lib/rustproxy --shell /usr/sbin/nologin rustproxy \
    && install -d -o rustproxy -g rustproxy -m 0700 /var/lib/rustproxy \
    && install -d -o rustproxy -g rustproxy -m 0750 /var/log/rustproxy
COPY --from=build /build/target/release/rust-proxy /usr/local/bin/rust-proxy
USER rustproxy:rustproxy
ENV RUST_PROXY_DATA_DIR=/var/lib/rustproxy \
    RUST_PROXY_PROXY_LISTEN=0.0.0.0:8080 \
    RUST_PROXY_ADMIN_LISTEN=127.0.0.1:9090 \
    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
VOLUME ["/var/lib/rustproxy"]
EXPOSE 8080 8443 9090
ENTRYPOINT ["/usr/local/bin/rust-proxy"]
CMD ["serve"]