# syntax=docker/dockerfile:1
#
# mailgoserver + the latest rspamd, bundled in one container. Both processes share this
# container's network namespace, so rspamd's default "normal" worker
# (127.0.0.1:11333, the /checkv2 scanning API — see internal/mailstore/rspamd.go) is
# already exactly what [Rspamd] url defaults to in settings.ini. Just set
# [Rspamd] enabled = true after first boot (see docker-deploy/README.md) and restart.
#
# Build from the repo root:
#   docker build -f docker-deploy/Dockerfile.rspamd -t mailgoserver-rspamd .

FROM golang:1.26-bookworm AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/mailgoserver .

FROM debian:bookworm-slim
# rspamd is installed from its own APT repo (rspamd.com), not Debian's bundled
# package, which tends to lag several releases behind — this is genuinely the latest
# stable release, matching what was asked for.
RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates tzdata curl gnupg lsb-release \
    && mkdir -p /usr/share/keyrings \
    && curl -fsSL https://rspamd.com/apt-stable/gpg.key | gpg --dearmor -o /usr/share/keyrings/rspamd.gpg \
    && echo "deb [signed-by=/usr/share/keyrings/rspamd.gpg] https://rspamd.com/apt-stable/ $(lsb_release -cs) main" \
        > /etc/apt/sources.list.d/rspamd.list \
    && apt-get update && apt-get install -y --no-install-recommends rspamd \
    && rm -rf /var/lib/apt/lists/*

COPY --from=build /out/mailgoserver /usr/local/bin/mailgoserver
COPY docker-deploy/entrypoint-rspamd.sh /usr/local/bin/entrypoint-rspamd.sh
RUN chmod +x /usr/local/bin/entrypoint-rspamd.sh

# /app/data: same as the standalone image (settings.ini, DB, mailstore, keys, certs).
# /var/lib/rspamd: rspamd's own Bayes/fuzzy-hash storage, kept persistent separately so
# rebuilding the image doesn't reset spam-learning state.
WORKDIR /app/data
VOLUME ["/app/data", "/var/lib/rspamd"]

EXPOSE 25 465 143 993 5000 5001

HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
    CMD curl -fs http://127.0.0.1:5000/health || exit 1

ENTRYPOINT ["/usr/local/bin/entrypoint-rspamd.sh"]