# ==============================================================================
# NX9 WireGuard - Multi-Stage Container Image
# ==============================================================================

# ── Stage 1: Build binary in Rust environment ────────────────────────────────
FROM rust:1.97-bookworm AS builder

WORKDIR /usr/src/nx9-wg

# Copy manifests and source tree
COPY Cargo.toml Cargo.lock ./
COPY crates ./crates
COPY src ./src

# Build release binary with optimization
RUN cargo build --release --bin nx9-wg

# ── Stage 2: Minimal runtime image ──────────────────────────────────────────
FROM debian:bookworm-slim

# Install only essential runtime dependencies (ca-certificates for HTTPS/TLS)
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Copy compiled binary from builder
COPY --from=builder /usr/src/nx9-wg/target/release/nx9-wg /usr/local/bin/nx9-wg

# Create state and configuration directories
RUN mkdir -p /var/lib/nx9-wg /etc/nx9-wg /var/lib/nx9-wg/backups

# Expose API/WebSocket port and default WireGuard UDP listen port
EXPOSE 8080 51820/udp

# Environment defaults
ENV NX9_WG_DATA_DIR=/var/lib/nx9-wg
ENV NX9_WG_LOG_LEVEL=info

# Healthcheck against Axum public health endpoint
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
    CMD ["/usr/local/bin/nx9-wg", "system", "health"] || exit 1

ENTRYPOINT ["/usr/local/bin/nx9-wg"]
CMD ["serve", "--bind", "0.0.0.0:8080"]