# Upstream v0.9.0 (0e176b1), with the reviewed standalone publication patch.
FROM docker.io/library/rust:1-alpine@sha256:44819b27be4c97b0e4d7203bd2e02c4820f97700211b6a37fb4c246a2de59383 AS builder
RUN apk add --no-cache musl-dev cmake make gcc g++ perl linux-headers ca-certificates
WORKDIR /proj
ENV CARGO_BUILD_JOBS=2 CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_TEST_DEBUG=0
COPY source/ ./
# Gate the production image on unit tests and both real HTTP/OpenID endpoint suites.
RUN cargo test --locked -p lk-jwt-service --lib
RUN cargo test --locked -p lk-jwt-service-integration-tests --test get_token --test sfu_get
RUN cargo build --locked --release -p lk-jwt-service --bin lk-jwt-service --bin healthcheck \
    && strip target/release/lk-jwt-service target/release/healthcheck
FROM scratch
COPY --from=builder /proj/target/release/lk-jwt-service /lk-jwt-service
COPY --from=builder /proj/target/release/healthcheck /lk-jwt-service-healthcheck
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
LABEL org.opencontainers.image.source="https://github.com/element-hq/lk-jwt-service" \
      org.opencontainers.image.revision="0e176b1eca44e67b11484d0bdf56999807bf2b8e+iscg-policy1" \
      org.opencontainers.image.licenses="AGPL-3.0-only"
EXPOSE 8080
USER 65532:65532
CMD ["/lk-jwt-service"]
HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD ["/lk-jwt-service-healthcheck"]