FROM golang:1.25-bookworm AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN go build -ldflags="-s -w" -o /bin/web ./web

# Cross-compile CLI for all platforms (parallel, fail on any error)
RUN set -e; \
    pids=""; \
    CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -ldflags="-s -w" -o /tmp/dl/darwin-arm64/congo ./cmd & pids="$pids $!"; \
    CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -ldflags="-s -w" -o /tmp/dl/darwin-amd64/congo ./cmd & pids="$pids $!"; \
    CGO_ENABLED=0 GOOS=linux  GOARCH=amd64 go build -ldflags="-s -w" -o /tmp/dl/linux-amd64/congo  ./cmd & pids="$pids $!"; \
    CGO_ENABLED=0 GOOS=linux  GOARCH=arm64 go build -ldflags="-s -w" -o /tmp/dl/linux-arm64/congo  ./cmd & pids="$pids $!"; \
    CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags="-s -w" -o /tmp/dl/windows-amd64/congo.exe ./cmd & pids="$pids $!"; \
    for pid in $pids; do wait $pid || exit 1; done

# Archive (users get "congo" inside the archive)
RUN apt-get update && apt-get install -y zip && rm -rf /var/lib/apt/lists/* && \
    mkdir /downloads && \
    tar -czf /downloads/congo-darwin-arm64.tar.gz -C /tmp/dl/darwin-arm64 congo && \
    tar -czf /downloads/congo-darwin-amd64.tar.gz -C /tmp/dl/darwin-amd64 congo && \
    tar -czf /downloads/congo-linux-amd64.tar.gz  -C /tmp/dl/linux-amd64  congo && \
    tar -czf /downloads/congo-linux-arm64.tar.gz  -C /tmp/dl/linux-arm64  congo && \
    cd /tmp/dl/windows-amd64 && zip -j /downloads/congo-windows-amd64.zip congo.exe

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y ca-certificates curl git && rm -rf /var/lib/apt/lists/* && \
    adduser --system --no-create-home app && \
    mkdir -p /data && chown app:nogroup /data && \
    git config --system safe.directory /opt/congo.git
ENV PORT=5000
ENV ENV=production
EXPOSE 5000
COPY --from=builder /bin/web /usr/local/bin/web
COPY --from=builder /downloads /usr/local/share/congo/downloads
HEALTHCHECK --interval=10s --timeout=5s --retries=3 \
  CMD curl -sf http://localhost:5000/health || exit 1
USER app
CMD ["web"]