Dockerfile.api

# syntax=docker/dockerfile:1
# Multi-stage build for jmodguard-api.
# Pins Rust 1.96 (lockfile MSRV; edition 2024). JSON API + OAuth only: do not
# embed frontend/ (Bunny serves that from Storage/CDN). linux/amd64 manifest
# digest for rust:1.96-bookworm (must match the FROM line below).
# Local: docker build --secret id=github_token,env=GITHUB_TOKEN -f Dockerfile.api .
FROM rust:1.96-bookworm@sha256:d99f7b31f49909348dc59b51f3c95d1efded1701ffb222f095aaab7de3c4abd8 AS builder
WORKDIR /app
# git and the rust-toolchain.toml toolchain are installed before source COPY
# so those layers stay cached when only application source changes.
RUN apt-get update \
    && apt-get install -y --no-install-recommends git \
    && rm -rf /var/lib/apt/lists/*
COPY rust-toolchain.toml ./
RUN rustup show
COPY Cargo.toml Cargo.lock LICENSE.md ./
COPY src ./src
COPY crates ./crates
COPY deploy ./deploy
COPY migrations ./migrations
COPY vendor ./vendor
COPY scripts/bootstrap-container.sh ./scripts/bootstrap-container.sh
RUN --mount=type=secret,id=github_token,required=true \
    GIT_CONFIG_COUNT=1 \
    GIT_CONFIG_KEY_0=credential.helper \
    GIT_CONFIG_VALUE_0='!f() { echo username=x-access-token; echo password=$(cat /run/secrets/github_token); }; f' \
    CARGO_NET_GIT_FETCH_WITH_CLI=true \
    cargo fetch --locked
ARG SOURCE_SHA=unknown
RUN JMODGUARD_BUILD_SHA=${SOURCE_SHA} CARGO_NET_GIT_FETCH_WITH_CLI=true \
    cargo build --locked --release -p jmodguard-api -p jmodguard-updater --no-default-features \
    && mkdir -p /app/release/bin /app/release/share/jmodguard \
    && cp target/release/jmodguard-api target/release/jmodguard-launcher /app/release/bin/ \
    && cp scripts/bootstrap-container.sh /app/release/bin/jmodguard-bootstrap \
    && cp LICENSE.md /app/release/share/jmodguard/LICENSE.md \
    && cd /app/release \
    && sha256sum bin/jmodguard-api bin/jmodguard-launcher > share/jmodguard/files.sha256 \
    && mkdir -p /app/oci-layer/usr/local/bin /app/oci-layer/usr/local/share/jmodguard \
    && cp -a bin/. /app/oci-layer/usr/local/bin/ \
    && cp -a share/jmodguard/. /app/oci-layer/usr/local/share/jmodguard/

FROM debian:bookworm-slim@sha256:5ae3c39ebd15e229dcedd5cee596b2497182493d41ff162e824ba13fc1b2b867
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --system --uid 10001 --home /data --shell /usr/sbin/nologin jmodguard \
    && mkdir -p /data \
    && chown jmodguard:jmodguard /data
WORKDIR /data
COPY --from=builder /app/oci-layer/ /
ARG SOURCE_SHA=unknown
VOLUME ["/data"]
USER 10001
ENV JMODGUARD_DB_PATH=/data/jmodguard.db
ENV JMODGUARD_CONFIG=/data/config.toml
ENV JMODGUARD_WEB_BIND=0.0.0.0:8080
ENV JMODGUARD_LOG_DIRECTORY=""
# Fail closed unless Bunny/portable remote credentials are present.
ENV JMODGUARD_REQUIRE_REMOTE_DB=1
ENV JMODGUARD_BASE_SHA=${SOURCE_SHA}
ENV JMODGUARD_BASE_ABI=debian-bookworm-amd64
ENV JMODGUARD_ROLE=api
ENV JMODGUARD_SELF_UPDATE=0
EXPOSE 8080
ENTRYPOINT ["/bin/sh", "/usr/local/bin/jmodguard-bootstrap"]