# hu13 — multi-stage build (f0rge issue #11).
#
#   docker build -t hu13 .
#   docker run --rm -p 39313:39313 \
#     -v "$PWD:/data/repo:ro" -v hu13-inbox:/data/inbox \
#     [-e HU13_BRANCH=main] [-e HU13_CLONE_URL=...] \
#     [-e HU13_PUBLIC_ORIGIN=http://host:39313] \
#     hu13
#
# Stage 1: pinned Rust builder. Only the files cargo needs are copied so
# the layer cache survives unrelated edits. `--locked` keeps Cargo.lock
# authoritative.

FROM rust:1.98-bookworm AS builder
WORKDIR /src
COPY Cargo.toml Cargo.lock ./
COPY src/ ./src/
COPY static/ ./static/
RUN cargo build --locked --release

# Stage 2: minimal runtime. ca-certificates for https clone URLs, git
# (hu13 shells out to `git -C` for every read — no git, no build),
# nonroot `hu13` (uid 10000), the static binary + entrypoint only.
FROM debian:bookworm-slim
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates git \
    && rm -rf /var/lib/apt/lists \
    && useradd --uid 10000 --create-home --shell /usr/sbin/nologin hu13 \
    && mkdir -p /srv/www /data/inbox \
    && chown -R hu13:hu13 /srv/www /data/inbox
COPY --from=builder /src/target/release/hu13 /usr/local/bin/hu13
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh
# Header config defaults (m6, issues #21 + #24): empty means fallback —
# repo dir name for the name (never blank), hidden line for the description.
# Public origin default (m6, issue #32): empty means unset (bundle-first
# presentation; set HU13_PUBLIC_ORIGIN to advertise `<origin>/repo.git`
# (`git clone <origin>/repo.git` needs no smart server) and
# `<origin>/repo.bundle` for the snapshot download).
ENV HU13_REPO_NAME=""
ENV HU13_DESCRIPTION=""
ENV HU13_PUBLIC_ORIGIN=""
USER hu13
EXPOSE 39313
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
