# Multi-stage build for the atproto-crates workspace
# Builds the workspace's binaries and installs the CLI tools

# Build stage. Keep in step with `rust-version` in Cargo.toml, `channel` in
# rust-toolchain.toml, and the builder stages in `Dockerfile.pds`,
# `Dockerfile.pds-debug` and `crates/atproto-pds/Dockerfile`. The CI
# "toolchain pins" step fails on drift.
FROM rust:1.97-slim-bookworm AS builder

# Install system dependencies needed for building
RUN apt-get update && apt-get install -y \
    pkg-config \
    libssl-dev \
    && rm -rf /var/lib/apt/lists/*

# Set working directory
WORKDIR /usr/src/app

# Copy the entire workspace
COPY . .

# Build, in release, exactly the binaries the runtime stage below copies:
# - atproto-identity: atpdid (keys, resolution, PLC)
# - atproto-dasl: atpcid (CIDs for data, files and records)
# - atpxrpc: the XRPC client (sessions, proxying, DPoP calls)
# - atproto-attestation: atproto-attestation-sign, atproto-attestation-verify
# - atproto-oauth: atproto-oauth-service-token
# - atproto-jetstream: atproto-jetstream-consumer
# - atproto-lexicon: atproto-lexicon-resolve
# Named one by one rather than `--bins`, which compiled all seventeen of the
# workspace's binaries, `pds` among them, to ship these eight. Naming them also
# turns a missing feature into a build error: `--bins` skips a binary whose
# `required-features` are off without a word, and the `COPY` below would be
# the first thing to notice. atpdid and atproto-lexicon-resolve need
# `hickory-dns`; the attestation tools need `tokio`, which is spelled
# `atproto-attestation/tokio` because that crate is the only one with the
# feature, and a bare `tokio` fails on `atproto-lexicon`, whose optional
# `tokio` dependency is behind `dep:`.
# No `smtp`: this image ships the CLI tools and no `pds`, so nothing in it
# sends mail. The images that do ship `pds` -- `Dockerfile.pds`,
# `Dockerfile.pds-debug` and `crates/atproto-pds/Dockerfile` -- build `smtp`,
# and `crates/atproto-pds/tests/integration/operator_docs.rs` holds each of
# them to it. `crates/readme-doctests/tests/root_dockerfile.rs` holds this
# line to the `COPY` lines.
RUN cargo build --release -F clap,hickory-dns,atproto-attestation/tokio \
    --bin atpdid \
    --bin atpcid \
    --bin atpxrpc \
    --bin atproto-attestation-sign \
    --bin atproto-attestation-verify \
    --bin atproto-oauth-service-token \
    --bin atproto-jetstream-consumer \
    --bin atproto-lexicon-resolve

# Runtime stage - use distroless for minimal attack surface
FROM gcr.io/distroless/cc-debian12

# Create directory for binaries
WORKDIR /usr/local/bin

# Copy every binary the builder stage built
COPY --from=builder /usr/src/app/target/release/atpdid .
COPY --from=builder /usr/src/app/target/release/atpcid .
COPY --from=builder /usr/src/app/target/release/atpxrpc .
COPY --from=builder /usr/src/app/target/release/atproto-attestation-sign .
COPY --from=builder /usr/src/app/target/release/atproto-attestation-verify .
COPY --from=builder /usr/src/app/target/release/atproto-oauth-service-token .
COPY --from=builder /usr/src/app/target/release/atproto-jetstream-consumer .
COPY --from=builder /usr/src/app/target/release/atproto-lexicon-resolve .

# Default to the DID tool
# Users can override with specific binary: docker run <image> atpdid --help
# Or run other tools:
#   docker run <image> atpcid --help
#   docker run <image> atproto-attestation-sign --help
#   docker run <image> atproto-attestation-verify --help
#   docker run <image> atpxrpc --help
#   docker run <image> atproto-oauth-service-token --help
#   docker run <image> atproto-jetstream-consumer --help
#   docker run <image> atproto-lexicon-resolve --help
CMD ["atpdid", "--help"]

# Add labels for documentation
LABEL org.opencontainers.image.title="atproto-crates"
LABEL org.opencontainers.image.description="AT Protocol identity management tools"
LABEL org.opencontainers.image.authors="Nick Gerakines <nick.gerakines@gmail.com>"
LABEL org.opencontainers.image.source="https://tangled.org/ngerakines.me/atproto-crates"
LABEL org.opencontainers.image.version="0.15.0-rc.6"
LABEL org.opencontainers.image.licenses="MIT"

# Document available binaries
LABEL binaries="atpdid,atpcid,atproto-attestation-sign,atproto-attestation-verify,atpxrpc,atproto-oauth-service-token,atproto-jetstream-consumer,atproto-lexicon-resolve"