# syntax=docker/dockerfile:1
FROM golang:1.27-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY cmd ./cmd
COPY internal ./internal
ARG VERSION=dev
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath \
    -ldflags="-s -w -X main.version=${VERSION}" \
    -o /out/traefik-selectel-dns ./cmd/traefik-selectel-dns

# static: CA-сертификаты (для HTTPS к Selectel) + пользователь nonroot (uid 65532), без shell.
# Для воспроизводимости закрепите образ по digest.
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/traefik-selectel-dns /traefik-selectel-dns
USER 65532:65532
EXPOSE 9090
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD ["/traefik-selectel-dns", "-healthcheck"]
ENTRYPOINT ["/traefik-selectel-dns"]
CMD ["-config", "/etc/traefik-selectel-dns/config.yaml"]