# ---------- Build Stage ----------
FROM golang:1.24 AS builder

WORKDIR /app
COPY . .

# Which commit this image is. Reported by GET /live/api/v1/health, so "I pushed
# it" and "it is running" stop being the same sentence — a redeploy can reuse a
# cached image, and there was no way to tell from outside.
#
# Passed by the platform as a build argument:
#   docker build --build-arg BUILD_VERSION=$(git rev-parse --short HEAD) .
# In Dokploy this goes under the application's Build settings. Left unset it
# reads "unknown", which is itself worth seeing — it means nothing stamped it.
#
# `.git` is not in the build context (see .dockerignore), so the build cannot
# work this out for itself.
ARG BUILD_VERSION=unknown

RUN CGO_ENABLED=0 GOOS=linux go build \
    -ldflags "-X nearle/controllers.Version=${BUILD_VERSION}" -o server

# ---------- Runtime Stage ----------
FROM alpine:latest
RUN apk add --no-cache tzdata
WORKDIR /app

COPY --from=builder /app/server /app
COPY nearle-gear-firebase-adminsdk-l9oha-23ca3b3609.json .

# No `.env.*` is copied in (see .dockerignore), so this only decides which
# rules config.Load applies: production insists on a signing secret and never
# falls back to localhost values. Every real value comes from the platform's
# environment settings.
ENV APP_ENV=production

# Must match APP_PORT in the platform's environment (1009 in production).
EXPOSE 1009

CMD ["/app/server"]