# One binary, a mounted site root, nothing else (ADR-0010).
#
# The site root is deliberately *not* copied in: it is somebody's content repository with its own git history
# (ADR-0011), so it arrives as a volume and the image stays the engine alone. That also means this image is the
# same for every site.

FROM golang:1.26 AS build
WORKDIR /src
# Modules first, so a content-only change never invalidates the dependency layer.
COPY go.mod go.sum ./
RUN go mod download
COPY . .
# Static, so the final image needs no libc and nothing to keep patched.
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /khosra ./cmd/khosra

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /khosra /khosra

# The site root is read-only to the engine: it only ever writes derivatives, and those go to the cache.
VOLUME ["/site", "/cache"]
ENV KHOSRA_SITE=/site
EXPOSE 8080

# Listens on every interface, because inside a container localhost is only the container.
ENTRYPOINT ["/khosra"]
CMD ["-addr", "0.0.0.0:8080", "-cache", "/cache"]