# Build from the repository root, so the workspace (and its lockfile) is in
# the context:
#
#   docker build -f crates/mtgc-server/Dockerfile -t mtgc-server .

FROM rust:1-bookworm AS build
WORKDIR /src
COPY . .
RUN cargo build --release --locked -p mtgc-server \
 && cp target/release/mtgc-server /mtgc-server

FROM debian:bookworm-slim
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates \
 && rm -rf /var/lib/apt/lists/* \
 && groupadd --system --gid 10001 mtgc \
 && useradd --system --uid 10001 --gid 10001 --home /data mtgc \
 && mkdir /data && chown 10001:10001 /data
COPY --from=build /mtgc-server /usr/local/bin/mtgc-server
# Numeric, so Kubernetes can verify `runAsNonRoot` (it can't resolve names),
# and with a fixed group so `fsGroup: 10001` grants a mounted volume to it.
USER 10001:10001
VOLUME /data
ENV MTGC_DB=/data/mtgc-server.db \
    MTGC_BIND=0.0.0.0:8080
EXPOSE 8080
CMD ["mtgc-server"]