# ── Build stage ──────────────────────────────────────────────────────────
FROM rust:1.96-bookworm AS builder
WORKDIR /app

# Cache dependencies separately from source changes.
COPY Cargo.toml Cargo.lock ./
RUN mkdir -p src && echo "fn main() {}" > src/main.rs && \
    cargo build --release --locked && \
    rm -rf src

# Build the real binary.
COPY src/ src/
RUN touch src/main.rs && cargo build --release --locked

# ── Runtime stage ────────────────────────────────────────────────────────
FROM debian:bookworm-slim AS runtime

# Install only what the binary actually needs at runtime:
#   ca-certificates → HTTPS RPC and webhook calls via reqwest/aws-lc-rs.
RUN apt-get update && \
    apt-get install --no-install-recommends -y ca-certificates && \
    rm -rf /var/lib/apt/lists/*

# Non-root user for the process.
RUN useradd --create-home --shell /bin/bash --uid 1000 pano

# Default config directory.
RUN mkdir -p /etc/pano && chown pano:pano /etc/pano

COPY --from=builder /app/target/release/pano /usr/local/bin/pano

# Default config path; override via --config, PANO_CONFIG env, or mount.
ENV PANO_CONFIG=/etc/pano/Config.toml

EXPOSE 3210
USER pano
HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD ["pano", "ping"]
ENTRYPOINT ["pano"]
