# syntax=docker/dockerfile:1
#
# Acauã server image: the acaua daemon (API and embedded web dashboard) linked
# against the official prebuilt libduckdb. DuckDB is never compiled here.

# Build stage.
FROM rust:1.99-slim-trixie AS build
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl unzip \
 && rm -rf /var/lib/apt/lists/*
COPY scripts/fetch-libduckdb.sh /usr/local/bin/fetch-libduckdb.sh
RUN fetch-libduckdb.sh /opt/duckdb \
 && echo /opt/duckdb > /etc/ld.so.conf.d/duckdb.conf \
 && ldconfig
ENV DUCKDB_LIB_DIR=/opt/duckdb \
    DUCKDB_INCLUDE_DIR=/opt/duckdb
WORKDIR /src
COPY Cargo.toml Cargo.lock ./
COPY crates crates
COPY apps/gui/ui apps/gui/ui
COPY logo.png logo.png
# The ldd check fails the build if the binary is not linked to the shared
# libduckdb (for example if someone re-enables the `bundled` feature).
RUN cargo build --release --locked -p acaua-cli \
 && ldd target/release/acaua | grep -q 'libduckdb.so => /opt/duckdb/libduckdb.so'

# Runtime stage: Debian slim, the binary, libduckdb.so, CA certificates and
# curl (update check and HEALTHCHECK). Runs as an unprivileged user.
FROM debian:trixie-slim
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl libstdc++6 \
 && rm -rf /var/lib/apt/lists/* \
 && groupadd --system --gid 10001 acaua \
 && useradd --system --uid 10001 --gid 10001 --home-dir /data --shell /usr/sbin/nologin acaua \
 && mkdir -p /data/acaua /data/zeek \
 && chown acaua:acaua /data/acaua
COPY --from=build /opt/duckdb/libduckdb.so /opt/duckdb/.duckdb-release /opt/duckdb/
RUN echo /opt/duckdb > /etc/ld.so.conf.d/duckdb.conf && ldconfig
COPY --from=build /src/target/release/acaua /usr/local/bin/acaua
LABEL org.opencontainers.image.title="Acauã" \
      org.opencontainers.image.description="Network threat hunting with deterministic evidence" \
      org.opencontainers.image.source="https://git.lucasrguerra.dev.br/ciberfauna/acaua" \
      org.opencontainers.image.licenses="MIT OR Apache-2.0"
ENV ACAUA_RUNTIME=container
USER acaua
WORKDIR /data
EXPOSE 8787
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD curl -fsS http://127.0.0.1:8787/api/health >/dev/null || exit 1
ENTRYPOINT ["acaua"]
CMD ["serve", "--bind", "0.0.0.0:8787", "--data-dir", "/data/acaua"]