FROM rust:1.97.0-bookworm@sha256:8fa55b2f3ddf97471ab6a767bfa3f37e6bad0986ba823e75fea57e2a2a5c3073 AS source

RUN apt-get update \
    && apt-get install --yes --no-install-recommends libssl-dev pkg-config \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /source
COPY Cargo.toml Cargo.lock build.rs ./
COPY src/ ./src/
COPY templates/ ./templates/
COPY static/ ./static/
COPY LICENSE ./LICENSE

FROM source AS test
RUN cargo test --locked --bin pirsec_lookup

FROM source AS builder
RUN cargo build --locked --release --bin pirsec_lookup

FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171

RUN apt-get update \
    && apt-get install --yes --no-install-recommends ca-certificates libssl3 \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --gid 10001 crackstation \
    && useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin crackstation

COPY --from=builder /source/target/release/pirsec_lookup /usr/local/bin/pirsec-crackstation
COPY LICENSE /usr/share/licenses/crackstation-rust/AGPL-3.0.txt

ENV CRACKSTATION_DATA_DIR=/data \
    CRACKSTATION_BACKEND_RATE_LIMIT_ENABLED=true \
    CRACKSTATION_CRACKCRYPT_ENABLED=false \
    CRACKSTATION_HIBP_ENABLED=false \
    HEALTHCHECK_ADDR=127.0.0.1:3000 \
    LISTEN_ADDR=0.0.0.0:3000

USER 10001:10001
EXPOSE 3000
ENTRYPOINT ["/usr/local/bin/pirsec-crackstation"]
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 CMD ["/usr/local/bin/pirsec-crackstation", "--healthcheck"]
