FROM --platform=$BUILDPLATFORM kefu.bix-i.it.com/customer-service/golang@sha256:1e0126852075c9c60731c8ba49088448b91f63e2aed97ca9d1a9791622a05946 AS builder

ARG TARGETOS=linux
ARG TARGETARCH
ARG VERSION
ARG REVISION
ARG SOURCE_DATE_EPOCH
ARG CREATED

ENV CGO_ENABLED=0 \
    GOTOOLCHAIN=local \
    GOPROXY=off \
    GOSUMDB=off \
    GOFLAGS=-mod=vendor \
    TZ=UTC

WORKDIR /src

COPY go.mod go.sum ./
COPY vendor ./vendor
COPY build/vendor.sha256 build/frontend-dist.sha256 ./build/
COPY scripts/release-stuff.sh ./scripts/release-stuff.sh
COPY scripts/verify-release-inputs.sh ./scripts/verify-release-inputs.sh
COPY scripts/verify-agpl-source-offer.sh ./scripts/verify-agpl-source-offer.sh
COPY tools/stuffbin ./tools/stuffbin
COPY cmd ./cmd
COPY internal ./internal
COPY frontend/dist ./frontend/dist
COPY i18n ./i18n
COPY static ./static
COPY schema.sql ./schema.sql

RUN --network=none set -eu; \
    test -n "$TARGETARCH"; \
    test -n "$VERSION"; \
    test -n "$REVISION"; \
    test -n "$SOURCE_DATE_EPOCH"; \
    test -n "$CREATED"; \
    grep -F 'github.com/knadh/stuffbin v1.3.0' vendor/modules.txt; \
    ALLOW_HOST_VERIFIED_NODE_BUNDLE=1 sh ./scripts/verify-release-inputs.sh; \
    mkdir -p /out

RUN --network=none GOOS="$TARGETOS" GOARCH="$TARGETARCH" \
    go build -mod=vendor -trimpath -buildvcs=false \
      -ldflags="-s -w -buildid= -X main.buildString=${VERSION}-${REVISION}-${TARGETOS}-${TARGETARCH} -X main.versionString=${VERSION} -X github.com/abhinavxd/libredesk/internal/version.Version=${VERSION}" \
      -o /out/customer-service ./cmd

RUN --network=none go build -mod=vendor -trimpath -buildvcs=false \
      -ldflags='-s -w -buildid=' \
      -o /out/stuffbin ./tools/stuffbin

RUN --network=none set -eu; \
    mkdir -p .release-tools; \
    mv /out/stuffbin .release-tools/stuffbin; \
    sha256sum .release-tools/stuffbin | awk '{print $1}' > .release-tools/stuffbin.sha256; \
    chmod 0500 .release-tools/stuffbin; \
    chmod 0400 .release-tools/stuffbin.sha256; \
    chmod 0500 .release-tools; \
    chown -R 10001:10001 .release-tools /out

USER 10001:10001
RUN --network=none sh ./scripts/release-stuff.sh /out/customer-service
USER 0:0

RUN --network=none set -eu; \
    test -s /etc/ssl/certs/ca-certificates.crt; \
    test -s /usr/local/go/lib/time/zoneinfo.zip; \
    mkdir -p /rootfs/app/uploads /rootfs/tmp /rootfs/etc/ssl/certs /rootfs/usr/share; \
    cp -p /etc/ssl/certs/ca-certificates.crt /rootfs/etc/ssl/certs/ca-certificates.crt; \
    cp -p /usr/local/go/lib/time/zoneinfo.zip /rootfs/usr/share/zoneinfo.zip; \
    cp -p /out/customer-service /rootfs/app/customer-service; \
    chmod 0755 /rootfs/app/customer-service; \
    chmod 0700 /rootfs/app/uploads; \
    chmod 1777 /rootfs/tmp; \
    chown -R 10001:10001 /rootfs/app

FROM scratch

ARG VERSION
ARG REVISION
ARG CREATED

LABEL org.opencontainers.image.title="customer-service" \
      org.opencontainers.image.version="$VERSION" \
      org.opencontainers.image.revision="$REVISION" \
      org.opencontainers.image.created="$CREATED"

COPY --from=builder /rootfs /

ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
    ZONEINFO=/usr/share/zoneinfo.zip \
    TZ=UTC \
    HOME=/app \
    TMPDIR=/tmp

WORKDIR /app
USER 10001:10001
EXPOSE 9000
ENTRYPOINT ["/app/customer-service"]
CMD ["--config", "/app/config.toml"]
