# Stage 1: Build
FROM rust:1.99.1-slim-trixie@sha256:aab42391a986424e22d6a3ec14f37bc6dd3dacff4d457ca7cccd781e02297cc6 AS builder

WORKDIR /build

# Pre-build dependencies (cached unless Cargo.toml/Cargo.lock change)
COPY Cargo.toml Cargo.lock ./
RUN mkdir src && echo "fn main() {}" > src/main.rs && cargo build --release --locked --jobs 4 && rm -rf src

# Ship the exact corresponding source with the public application (AGPL-3.0).
# .dockerignore excludes Git internals, local databases, secrets and build output.
COPY . .
RUN tar --exclude='./target' -czf /calrs-source.tar.gz . \
    && touch src/main.rs && cargo build --release --locked --jobs 4

# Stage 2: Runtime
FROM debian:trixie-slim@sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad

RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/*

RUN useradd -r -s /bin/false -m -d /var/lib/calrs calrs

COPY --from=builder /build/target/release/calrs /usr/local/bin/calrs
COPY templates/ /opt/calrs/templates/
COPY --from=builder /calrs-source.tar.gz /opt/calrs/source.tar.gz

WORKDIR /opt/calrs
USER calrs

ENV CALRS_DATA_DIR=/var/lib/calrs
EXPOSE 3000

ENTRYPOINT ["calrs"]
CMD ["serve", "--host", "0.0.0.0", "--port", "3000"]
