# Copyright © Albert Lane. All Rights Reserved.
# Proprietary and Confidential — Albert Lane Proprietary Software License.
# Unauthorized use, copying, modification, or distribution is prohibited.
# License inquiries: https://albertlane.net
# ==============================================================================
# Stage 1: Cargo Build & Dependencies Caching (Builder)
# Build context: the rust/ directory of this repo  (docker build -f ../docker/Dockerfile .)
# ==============================================================================
FROM rust:1.80-slim-bookworm AS builder

# Install security utilities and native build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    pkg-config \
    libssl-dev \
    git \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /usr/src/aros

# Dummy sources to pre-build dependencies and optimize docker layer caching.
# Repair R-DK-3: this crate has a lib + two [[bin]] targets, so stubs are created for each.
COPY Cargo.toml Cargo.lock ./
RUN mkdir -p src/bin && echo "" > src/lib.rs \
    && echo "fn main() {}" > src/bin/aros-edge-node.rs \
    && echo "fn main() {}" > src/bin/aros-tui.rs
RUN cargo build --release && rm -rf src

# Copy real source code and execute hardened release build
COPY . .
RUN touch src/lib.rs src/bin/aros-edge-node.rs
RUN cargo build --release --bin aros-edge-node

# ==============================================================================
# Stage 2: Minimal Distroless Runtime Enclave
# ==============================================================================
FROM gcr.io/distroless/cc-debian12:nonroot AS runtime

# Copy compiled binary from builder
COPY --from=builder /usr/src/aros/target/release/aros-edge-node /usr/local/bin/aros-edge-node

# Copy static configuration.
# Repair R-DK-2: `COPY /etc/aros` read from the build-context root, not the host's /etc.
# Use a context-relative path; it must contain build_manifest.json (a contract JSON).
COPY --chown=nonroot:nonroot etc-aros/ /etc/aros/

# Set non-root runtime environment
USER nonroot:nonroot
WORKDIR /var/lib/aros

ENV AROS_NETWORK_ID="aros-edge-mesh" \
    RUST_LOG="info" \
    ENCLAVE_MODE="airgapped"

EXPOSE 4001/tcp
EXPOSE 4001/udp
ENTRYPOINT ["/usr/local/bin/aros-edge-node"]
CMD ["--config", "/etc/aros/build_manifest.json"]
