# syntax=docker/dockerfile:1

# Multi-stage Dockerfile for brewlog.
# Uses chisel to create a minimal Ubuntu rootfs for the runtime image.

# ---------------------------------------------------------------------------
# Builder — Ubuntu with Rust toolchain installed
# ---------------------------------------------------------------------------
FROM ubuntu:26.04 AS builder
ENV RUSTUP_HOME=/usr/local/rustup \
    CARGO_HOME=/usr/local/cargo \
    PATH=/usr/local/cargo/bin:${PATH}
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    build-essential \
    pkg-config \
    libssl-dev \
    mold \
    binutils \
    curl \
    && rm -rf /var/lib/apt/lists/*
RUN curl -sSf https://sh.rustup.rs \
    | sh -s -- -y --profile minimal --default-toolchain 1.94.1

# Install tailwindcss standalone (needed by build.rs)
RUN mkdir -p /usr/local/bin \
    && curl -sL https://github.com/tailwindlabs/tailwindcss/releases/latest/download/tailwindcss-linux-x64 \
    -o /usr/local/bin/tailwindcss && chmod +x /usr/local/bin/tailwindcss

WORKDIR /app
COPY . .

# NB: no `RUN --mount=type=cache` here on purpose. The CI image builder is
# Kaniko (daemonless, no Docker/BuildKit), which does not support BuildKit cache
# mounts — it errors on them. Keep this RUN plain. See README "CI / build".
RUN cargo build --release --locked \
    && mkdir -p /out \
    && cp target/release/brewlog /out/brewlog

# ---------------------------------------------------------------------------
# Chisel — minimal Ubuntu rootfs
# ---------------------------------------------------------------------------
FROM ubuntu:26.04 AS chisel
ARG TARGETARCH=amd64
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl ca-certificates \
    && rm -rf /var/lib/apt/lists/*
RUN curl -sL "https://github.com/canonical/chisel/releases/download/v1.4.1/chisel_v1.4.1_linux_${TARGETARCH}.tar.gz" \
    | tar xz -C /usr/local/bin

RUN mkdir /rootfs && chisel cut --root /rootfs \
    base-files_base \
    base-files_release-info \
    base-passwd_data \
    ca-certificates_data \
    libgcc-s1_libs \
    libc6_libs \
    libssl3t64_libs \
    openssl_bins

RUN useradd --root /rootfs -u 1000 -U -M -s /bin/false brewlog \
    && mkdir -p /rootfs/home/brewlog /rootfs/data \
    && chown 1000:1000 /rootfs/home/brewlog /rootfs/data

# ---------------------------------------------------------------------------
# Runtime — scratch with chisel rootfs
# ---------------------------------------------------------------------------
FROM scratch
COPY --from=chisel /rootfs /
COPY --from=builder /out/brewlog /usr/local/bin/brewlog
USER 1000:1000
ENTRYPOINT ["brewlog", "serve", "--database-url", "sqlite:///data/brewlog.db"]