# Build and run from the repository root, e.g.:
#   podman build -f crates/nook-vault/Dockerfile -t nookd .
#   docker build -f crates/nook-vault/Dockerfile -t nookd .

FROM rust:1-bookworm AS builder
WORKDIR /build
COPY Cargo.toml Cargo.lock ./
COPY crates ./crates
RUN cargo build --release -p nook-vault --bin nookd

FROM debian:bookworm-slim AS runtime
# Fixed, predictable UID/GID (rather than an auto-assigned system UID) so
# bind-mount ownership can be documented reliably: `chown 10001:10001 <dir>`.
RUN groupadd --system --gid 10001 nookd \
    && useradd --system --uid 10001 --gid 10001 --create-home --home-dir /data --shell /usr/sbin/nologin nookd \
    && chown -R nookd:nookd /data
COPY --from=builder /build/target/release/nookd /usr/local/bin/nookd

# /data holds the object store and meta.sqlite. It MUST be backed by a
# named volume or bind mount at runtime (see README) — anything written
# here that isn't on a mount is lost when the container is removed.
ENV NOOK_DATA_DIR=/data
VOLUME ["/data"]

USER nookd
WORKDIR /data
EXPOSE 8080
ENTRYPOINT ["/usr/local/bin/nookd"]
CMD ["serve", "--listen", "0.0.0.0:8080"]

# To create/manage vaults against this same mounted volume, run the vault
# CLI as a one-off container overriding the default command, e.g.:
#   podman run --rm -v nookd-data:/data --entrypoint /usr/local/bin/nookd nookd \
#     vault create --storage /data
