FROM rust:1-bookworm AS build
WORKDIR /src
COPY . .
RUN cargo build --release --locked \
    && mkdir -p /out/var/lib/ratlogin /out/etc/ratlogin

FROM gcr.io/distroless/cc-debian12:nonroot
COPY --from=build /src/target/release/ratlogin /usr/local/bin/ratlogin
COPY --from=build --chown=nonroot:nonroot /out/var/lib/ratlogin /var/lib/ratlogin
COPY --from=build /out/etc/ratlogin /etc/ratlogin
ENV RATLOGIN_CONFIG=/etc/ratlogin/config.toml \
    RATLOGIN_STATE_DIR=/var/lib/ratlogin \
    RUST_LOG=info
VOLUME /var/lib/ratlogin
EXPOSE 9411
WORKDIR /var/lib/ratlogin
USER nonroot
CMD ["ratlogin", "serve"]