# syntax=docker/dockerfile:1
FROM golang:1.25-alpine AS builder

RUN apk add --no-cache git

WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download

COPY . .

ARG GIT_COMMIT=unknown

# Build both binaries as static; Commit matches ship.sh / local -ldflags.
RUN CGO_ENABLED=0 go build -ldflags="-s -w -X github.com/nixc/reverse-ssh-traefik/internal/buildinfo.Commit=${GIT_COMMIT}" -o /tunnel-server ./cmd/server/
RUN CGO_ENABLED=0 go build -ldflags="-s -w -X github.com/nixc/reverse-ssh-traefik/internal/buildinfo.Commit=${GIT_COMMIT}" -o /tunnel-client ./cmd/client/

# --- Server image ---
FROM alpine:3.21 AS server

RUN apk add --no-cache ca-certificates \
	&& addgroup -S tunnel \
	&& adduser -S -D -H -u 10001 -G tunnel tunnel \
	&& mkdir -p /keys /etc/traefik/dynamic \
	&& chown -R tunnel:tunnel /keys /etc/traefik/dynamic

COPY --from=builder /tunnel-server /usr/local/bin/tunnel-server

EXPOSE 2222
EXPOSE 10000-10100

USER tunnel

ENTRYPOINT ["tunnel-server"]

# --- Client image ---
FROM alpine:3.21 AS client

RUN apk add --no-cache ca-certificates \
	&& addgroup -S tunnel \
	&& adduser -S -D -H -u 10001 -G tunnel tunnel \
	&& mkdir -p /keys \
	&& chown -R tunnel:tunnel /keys

COPY --from=builder /tunnel-client /usr/local/bin/tunnel-client

USER tunnel

ENTRYPOINT ["tunnel-client"]