# syntax=docker/dockerfile:1
#
# Standalone mailgoserver image — SMTP + IMAP + admin dashboard + webmail, no rspamd.
# The built-in heuristic spam score (internal/mailstore/spam.go) always runs regardless;
# this is for anyone who doesn't want rspamd's extra dependency. See Dockerfile.rspamd
# for the bundled variant.
#
# Build from the repo root:
#   docker build -f docker-deploy/Dockerfile -t mailgoserver .

FROM golang:1.26-bookworm AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
# modernc.org/sqlite and every other dependency here are pure Go (no cgo), so a fully
# static binary is just CGO_ENABLED=0 — no libc/gcc needed in the runtime image.
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/mailgoserver .

FROM debian:bookworm-slim
# ca-certificates: outbound direct-to-MX delivery verifies remote STARTTLS certs.
# tzdata: [Server] time_zone (e.g. "Europe/London") needs the real IANA zone
# database — time.LoadLocation silently falls back to UTC without it.
# curl: used by the HEALTHCHECK below.
RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates tzdata curl \
    && rm -rf /var/lib/apt/lists/*

COPY --from=build /out/mailgoserver /usr/local/bin/mailgoserver

# Everything persistent — the auto-generated settings.ini, the SQLite DB, encrypted
# mailbox storage, DKIM/mailstore master keys, TLS certs, the app secret — lives under
# whatever directory the process is started from (see config.Load / main.go's
# os.Getwd()). One volume here covers all of it; no need to enumerate subpaths.
WORKDIR /app/data
VOLUME ["/app/data"]

# Defaults from internal/config/config.go's generated settings.ini: SMTP 25, direct-TLS
# SMTP 465, IMAP 143, direct-TLS IMAP 993 (the actual standard ports — binding them
# needs no setcap/capability here since this container runs as root), admin/webmail
# HTTP 5000, HTTPS 5001 (deliberately non-privileged; put a reverse proxy or the host's
# own 80/443 in front if you want those too).
EXPOSE 25 465 143 993 5000 5001

# --host 0.0.0.0 is required: the binary's own default is 127.0.0.1, which would only
# be reachable from inside this container, never through a published port.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD curl -fs http://127.0.0.1:5000/health || exit 1

ENTRYPOINT ["mailgoserver", "--host", "0.0.0.0"]