# syntax=docker/dockerfile:1.7
# Build stage — cached deps, then app sources.
FROM rust:1-bookworm AS builder
WORKDIR /app

ENV CARGO_TERM_COLOR=always
ENV CARGO_INCREMENTAL=0

COPY Cargo.toml Cargo.lock ./
# Touch a stub main to allow dependency-only build for caching.
RUN mkdir -p src && echo 'fn main() {}' > src/main.rs \
    && cargo build --release \
    && rm -rf src target/release/deps/smgw_pki_automator*

COPY src ./src
COPY migrations ./migrations
RUN cargo build --release

# Runtime stage — minimal Debian with TLS + xmlsec1 (for InitialConfigBuilder),
# softhsm2 libs available at runtime when needed.
FROM debian:bookworm-slim AS runtime
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
        libssl3 \
        xmlsec1 \
        libsofthsm2 \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /opt/smgw
COPY --from=builder /app/target/release/smgw-pki-automator /usr/local/bin/smgw-pki-automator

ENV RUST_LOG=info
ENV BIND_ADDR=0.0.0.0:8443
EXPOSE 8443
ENTRYPOINT ["/usr/local/bin/smgw-pki-automator"]