# syntax=docker/dockerfile:1
#
# The EchoBark coordination hub — `maylyn hub`. Coordination and relay only: it
# runs no model server, so the image is just the static Go binary plus the CA
# bundle distroless already carries. Kamal builds and pushes this.

ARG GO_VERSION=1.25

FROM golang:${GO_VERSION}-bookworm AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
# Stamped by Kamal from the git ref (see config/deploy.yml builder.args).
ARG VERSION=dev
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath \
      -ldflags "-s -w -X maylyn/config.Version=${VERSION}" \
      -o /out/maylyn .

FROM gcr.io/distroless/static-debian12:latest
COPY --from=build /out/maylyn /usr/local/bin/maylyn

# Hub state — the node identity and signed Circle replicas — lives on a Kamal
# volume mounted here.
ENV MAYLYN_BASE_DIR=/data \
    MAYLYN_SERVE_ADDR=0.0.0.0:8787 \
    MAYLYN_SERVE_WEBAPP=true \
    MAYLYN_NO_REBUILD=1 \
    MAYLYN_NO_AUTO_UPDATE=1 \
    MAYLYN_BOOT_SERVICE=1 \
    HOME=/data

# HOME=/data (above) is load-bearing, not decoration: this distroless image has
# no /etc/passwd for os.UserHomeDir() to fall back to, and EnsureCloudflared
# (backend/cloudflared_setup.go) uses that to find where to self-install the
# cloudflared binary it downloads on first boot — a plain Linux/amd64 binary
# download, no tar/shell needed, which is why it works at all in an image with
# neither. Landing it under /data also means it survives a redeploy instead of
# re-downloading every restart, since /data is the Kamal volume.

EXPOSE 8787
VOLUME ["/data"]
ENTRYPOINT ["/usr/local/bin/maylyn"]
CMD ["hub"]
