FROM golang:1.26-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
ARG VERSION=dev
RUN CGO_ENABLED=0 GOOS=linux go build \
    -ldflags="-s -w" \
    -o spa-server \
    ./cmd/spa-server

FROM alpine:3.21
RUN apk add --no-cache ca-certificates tzdata \
    && addgroup -S spa && adduser -S -G spa -H -s /sbin/nologin spa
WORKDIR /app
COPY --from=builder /app/spa-server .

ARG VERSION=dev
ARG GIT_SHA=unknown
ARG BASE_DIGEST=

LABEL org.opencontainers.image.source="https://code.nochebuena.dev/einherjar/spa-server"
LABEL org.opencontainers.image.version="$VERSION"
LABEL org.opencontainers.image.revision="$GIT_SHA"
LABEL org.opencontainers.image.base.name="alpine:3.21"
LABEL org.opencontainers.image.base.digest="$BASE_DIGEST"
LABEL dev.nochebuena.healthz="/health"

# Provide your SPA build at /srv/www — COPY dist/ in a downstream Dockerfile, or
# bind-mount it at runtime (-v /path/to/dist:/srv/www). No VOLUME is declared here
# on purpose: a VOLUME at this path creates an anonymous volume that `docker compose
# up` reuses across container recreation, shadowing a freshly COPY'd bundle with the
# previous build — a silent stale deploy (worse for PWAs, whose service worker then
# caches the stale ngsw.json). A runtime bind-mount works with or without it, and a
# child image cannot un-declare an inherited VOLUME, so it must not be declared at all.

# Drop root: the server is a static binary serving read-only files on a >1024 port,
# so it needs no privilege. COPY'd assets are world-readable, so the unprivileged
# user reads /srv/www without a chown.
USER spa
EXPOSE 8080
ENTRYPOINT ["/app/spa-server"]