# Sibling Dockerfile that builds rust-sig-server out of the same repo
# checkout. Compose uses this for the `sig-server` service so the whole
# stack comes from one git pull. Context must be the repository root.

FROM rust:1.86-slim AS build
RUN apt-get update && apt-get install -y --no-install-recommends \
        pkg-config libssl-dev ca-certificates \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /src

COPY rust/ /src/rust/
COPY rust-sig-server/ /src/rust-sig-server/

WORKDIR /src/rust-sig-server
RUN cargo build --release --bin kez-sig-server

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && useradd -r -u 10002 -m kez

COPY --from=build /src/rust-sig-server/target/release/kez-sig-server /usr/local/bin/kez-sig-server

USER kez
WORKDIR /data

ENV KEZ_BIND=0.0.0.0:7878 \
    KEZ_DB=/data/sigchains.db \
    RUST_LOG=info

EXPOSE 7878
ENTRYPOINT ["/usr/local/bin/kez-sig-server"]