# -----------------------------------------------------------------------
# Stage 1: Build
# -----------------------------------------------------------------------
FROM golang:1.22-alpine AS builder

WORKDIR /build

# Copy module files first for layer caching
COPY go.mod ./
RUN go mod download

# Copy source
COPY . .

# Build a static binary (no CGO, no external dependencies)
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -ldflags="-s -w" -o crowdsec-dashy ./cmd/server

# -----------------------------------------------------------------------
# Stage 2: Minimal runtime image
# -----------------------------------------------------------------------
FROM alpine:3.19

# Install ca-certificates for HTTPS LAPI connections
RUN apk --no-cache add ca-certificates tzdata

WORKDIR /app

# Copy binary
COPY --from=builder /build/crowdsec-dashy .

# Copy web assets (templates + static)
COPY web/ ./web/

# Non-root user for security
RUN addgroup -S csui && adduser -S csui -G csui
USER csui

EXPOSE 8080

# Runtime environment — override via docker-compose or -e flags
ENV PORT=:8080 \
    CROWDSEC_API_URL=http://crowdsec:8080 \
    CROWDSEC_API_LOGIN= \
    CROWDSEC_API_PASSWORD= \
    CSCLI_PATH=/usr/local/bin/cscli \
    UI_USERNAME=admin \
    UI_PASSWORD=changeme \
    UI_SESSION_SECRET=please-change-this-to-32-chars!! \
    POLL_INTERVAL_SEC=15

ENTRYPOINT ["/app/crowdsec-dashy"]