Dockerfile.dev

# Base images pinned by digest, as in the production Dockerfile. TLS is rustls
# throughout (sqlx-cli included): no OpenSSL at build or run time.

# =============================================================================
# Stage 1: Chef - install cargo-chef and sqlx-cli
# =============================================================================
FROM rust:1.98-slim-bookworm@sha256:ebd900bae66fd508b466cef82d64a83a5fb34682e4c8b2797a42908bddc95a57 AS chef

# hadolint ignore=DL3008
RUN apt-get update && apt-get install -y --no-install-recommends \
    pkg-config \
    && rm -rf /var/lib/apt/lists/*

RUN cargo install cargo-chef --version 0.1.78 --locked \
    && cargo install sqlx-cli --no-default-features --features rustls,postgres --locked

WORKDIR /app

# =============================================================================
# Stage 2: Planner - generate the dependency recipe
# =============================================================================
FROM chef AS planner

COPY . .
RUN cargo chef prepare --recipe-path recipe.json

# =============================================================================
# Stage 3: Builder - compile dependencies then the binary
# =============================================================================
FROM chef AS builder

COPY --from=planner /app/recipe.json recipe.json

# Cache layer: compile dependencies only
RUN cargo chef cook --release --recipe-path recipe.json

# Compile the binary
COPY . .
RUN cargo build --release --bin auth-api

# =============================================================================
# Stage 4: Runtime dev - includes migrations, sqlx-cli and postgresql-client
# =============================================================================
FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171 AS runtime

# hadolint ignore=DL3008
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

RUN useradd --uid 1001 --no-create-home --shell /bin/false appuser

WORKDIR /app

COPY --from=builder /app/target/release/auth-api ./auth-api
COPY --from=builder /usr/local/cargo/bin/sqlx /usr/local/bin/sqlx
COPY --from=builder /app/migrations ./migrations
COPY --from=builder /app/templates ./templates

RUN chown -R appuser:appuser /app

USER 1001:1001

EXPOSE 3000

# `exec` makes the service PID 1, so `docker stop` reaches it as SIGTERM.
CMD ["sh", "-c", "sqlx migrate run --database-url \"$DATABASE_URL\" && exec ./auth-api"]