FROM golang:1.25-bookworm AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN go build -ldflags="-s -w" -o /bin/app ./<<.Dir>>

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y ca-certificates curl && rm -rf /var/lib/apt/lists/* && \
    adduser --system --no-create-home app && \
    mkdir -p /data && chown app:nogroup /data
ENV PORT=5000
ENV ENV=production
EXPOSE 5000
COPY --from=builder /bin/app /usr/local/bin/app
HEALTHCHECK --interval=10s --timeout=5s --retries=3 \
  CMD curl -sf http://localhost:5000/health || exit 1
USER app
CMD ["app"]