# --- Build Stage ---
FROM golang:1.26 AS builder
WORKDIR /app

# Shared modules (git.dcntrlized.org/dcntrlized/dcntrlized-auth) are served by
# the dev Gitea Go module proxy. Override via --build-arg in production.
ARG GOPROXY_VALUE=http://192.168.122.183:3000/api/packages/Dcntrlized/go
ARG GONOSUMDB_VALUE=git.dcntrlized.org
ENV GOPROXY=${GOPROXY_VALUE},https://proxy.golang.org,direct
ENV GONOSUMDB=${GONOSUMDB_VALUE}

COPY src/go.mod src/go.sum ./
RUN go mod download

COPY src/ ./

# Build the whole main package (not just main.go): task-2/task-4 add files to
# package main (and any embed directive would need it), so a single-file build
# is not safe.
RUN CGO_ENABLED=0 GOOS=linux go build -o server .

# --- Run Stage ---
FROM alpine:latest
WORKDIR /root/

ARG IMAGE_VERSION=dev
ARG IMAGE_REVISION=

LABEL org.dcntrlized.service=alarm
LABEL org.dcntrlized.port=8080
LABEL org.opencontainers.image.version=$IMAGE_VERSION
LABEL org.opencontainers.image.revision=$IMAGE_REVISION

COPY --from=builder /app/server .

# 8080 is the service's ONLY port: the API (/_manifest, /auth/*, /action/*) and
# the /ws/alarm WebSocket share it, plaintext in-container (the operator's TLS
# proxy fronts alarm.dcntrlized.org in prod).
EXPOSE 8080

CMD ["./server"]