# SPDX-FileCopyrightText: 2026 Echolot contributors
# SPDX-License-Identifier: GPL-3.0-or-later
# syntax=docker/dockerfile:1

FROM golang:1.26-alpine AS build
WORKDIR /src
COPY go.mod ./
RUN go mod download
COPY . .
ARG VERSION=dev
RUN CGO_ENABLED=0 go build -trimpath \
      -ldflags "-s -w -X main.Version=${VERSION}" \
      -o /out/echolot-server ./cmd/echolot-server

# Distroless static: no shell, no package manager; the server is pure Go.
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/echolot-server /echolot-server
# State (device store + generated TLS) must persist across container restarts.
ENV ECHOLOT_STATE_DIR=/state
VOLUME ["/state"]
# Ports are documentation only — run with network_mode: host (see compose.yaml):
# the data plane must see real client source addresses/TTLs, and Docker's
# userland NAT would falsify exactly what this server exists to observe.
EXPOSE 8441/tcp 8442/udp 8443/tcp
ENTRYPOINT ["/echolot-server"]