# Multi-arch (amd64 / arm64) container image for captchaforge.
# Built + published as ghcr.io/santhsecurity/captchaforge:<version>
# via the .github/workflows/release.yml workflow.
#
# Stage 1: build the static-ish binary with rustls (no system openssl).
# Stage 2: ship a slim runtime with chromium pre-installed.

FROM rust:1.85-slim AS builder

WORKDIR /build

# System deps the cargo build needs (rustls vendors crypto; nothing
# else system-side except git for Cargo dep resolution).
RUN apt-get update && apt-get install -y --no-install-recommends \
    pkg-config \
    git \
    && rm -rf /var/lib/apt/lists/*

# Cache deps separately from source so iteration doesn't re-fetch.
COPY Cargo.toml Cargo.lock* ./
COPY rules ./rules
COPY rules-crate ./rules-crate
COPY challenge ./challenge
COPY cli ./cli
COPY bench ./bench
COPY src ./src
COPY schemas ./schemas
COPY deploy ./deploy

RUN cargo build --release --bin captchaforge && \
    strip target/release/captchaforge && \
    ls -la target/release/captchaforge

# Stage 2: runtime. Chromium for the chromiumoxide-driven solvers,
# tesseract for OCR fallback. No build tooling, no caches.
FROM debian:bookworm-slim AS runtime

ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y --no-install-recommends \
    chromium \
    chromium-sandbox \
    tesseract-ocr \
    fonts-liberation \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Non-root user for the serve process.
RUN useradd --create-home --shell /bin/bash captchaforge

COPY --from=builder /build/target/release/captchaforge /usr/local/bin/captchaforge

USER captchaforge
WORKDIR /home/captchaforge

# CHROME_BIN points the chromiumoxide harness at the installed
# Debian chromium binary.
ENV CHROME_BIN=/usr/bin/chromium

# Default: HTTP API on 8080. Override the command for one-shot
# solves: `docker run ghcr.io/santhsecurity/captchaforge solve <url>`.
EXPOSE 8080
ENTRYPOINT ["captchaforge"]
CMD ["serve", "--port", "8080"]
