# syntax=docker/dockerfile:1

ARG TARGETARCH

FROM --platform=$BUILDPLATFORM ubuntu:22.04 AS dante-source
COPY scripts/install-landing-build-deps.sh /install-build-deps.sh
RUN sh /install-build-deps.sh
COPY scripts/build-landing-dante.sh /build-dante.sh
FROM dante-source AS dante-build-amd64
RUN sh /build-dante.sh amd64 /out
FROM dante-source AS dante-build-arm64
RUN sh /build-dante.sh arm64 /out

# Export only the artifacts, so a cache hit does not materialize the C build
# environment just to read /out. Keep these layers independent of Go sources.
FROM scratch AS dante-amd64
COPY --link --from=dante-build-amd64 /out/ /out/
FROM scratch AS dante-arm64
COPY --link --from=dante-build-arm64 /out/ /out/

FROM --platform=$BUILDPLATFORM node:24.21.0-bookworm-slim AS web-build
WORKDIR /src/web
COPY web/package.json web/package-lock.json ./
RUN --mount=type=cache,target=/root/.npm \
    npm ci --ignore-scripts
COPY web/ ./
RUN npm run build

FROM scratch AS web-assets
COPY --link --from=web-build /src/web/dist/ /dist/

FROM --platform=$BUILDPLATFORM golang:1.26.10-bookworm AS go-source
WORKDIR /src
COPY go.mod go.sum ./
# Keep extracted modules, checksum metadata and the selected toolchain. The
# downloaded ZIPs duplicate those files and are not needed to compile them.
RUN GOTOOLCHAIN=go1.26.10 go mod download && \
    find /go/pkg/mod/cache/download -type f -name '*.zip' -delete
COPY --link cmd/ ./cmd/
COPY --link internal/ ./internal/

# Export compiled packages through the existing registry layer cache. Do not
# use a cache mount here: ephemeral builders would lose its contents. Version
# arguments belong only to the final link stage, not package compilation.
FROM go-source AS compile-amd64
COPY --link --from=dante-amd64 /out/ /src/internal/dantebundle/assets/
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOTOOLCHAIN=go1.26.10 \
    go list -export -deps -trimpath ./cmd/vastora > /dev/null

FROM compile-amd64 AS binary-amd64
ARG VASTORA_VERSION=0.1.0-dev
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOTOOLCHAIN=go1.26.10 go build -trimpath \
    -ldflags="-s -w -X github.com/petauron/vastora/internal/center.Version=${VASTORA_VERSION} -X github.com/petauron/vastora/internal/agent.Version=${VASTORA_VERSION}" \
    -o /out/vastora ./cmd/vastora

FROM go-source AS compile-arm64
COPY --link --from=dante-arm64 /out/ /src/internal/dantebundle/assets/
RUN CGO_ENABLED=0 GOOS=linux GOARCH=arm64 GOTOOLCHAIN=go1.26.10 \
    go list -export -deps -trimpath ./cmd/vastora > /dev/null

FROM compile-arm64 AS binary-arm64
ARG VASTORA_VERSION=0.1.0-dev
RUN CGO_ENABLED=0 GOOS=linux GOARCH=arm64 GOTOOLCHAIN=go1.26.10 go build -trimpath \
    -ldflags="-s -w -X github.com/petauron/vastora/internal/center.Version=${VASTORA_VERSION} -X github.com/petauron/vastora/internal/agent.Version=${VASTORA_VERSION}" \
    -o /out/vastora ./cmd/vastora

FROM binary-amd64 AS center-amd64
FROM binary-arm64 AS center-arm64
FROM center-${TARGETARCH} AS center-build
RUN mkdir /out/center-data && chown 65532:65532 /out/center-data

FROM gcr.io/distroless/static-debian13:nonroot
WORKDIR /app
COPY --link --from=center-build /out/vastora /usr/local/bin/vastora
COPY --link --from=binary-amd64 /out/vastora /app/agent-binaries/linux-amd64
COPY --link --from=binary-arm64 /out/vastora /app/agent-binaries/linux-arm64
COPY --link --from=web-assets /dist/ /app/web/dist/
COPY catalog/trust/ /app/catalog-trust/
COPY --from=center-build --chown=65532:65532 /out/center-data /var/lib/vastora
VOLUME ["/var/lib/vastora"]
ENTRYPOINT ["/usr/local/bin/vastora"]