FROM rust:1.94-bookworm AS builder

RUN cargo install dioxus-cli --version 0.7.3 --locked

ARG DOCS_URL=/docs

WORKDIR /app
COPY . .
ENV DOCS_URL=${DOCS_URL}
# compliance-agent (a workspace member) depends on the private tramiton-core git
# repo, so the workspace resolve needs it even to build the dashboard.
# Authenticate the fetch with a PAT passed as a BuildKit secret.
RUN --mount=type=secret,id=tramiton_token \
    if [ -s /run/secrets/tramiton_token ]; then \
      git config --global \
        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
        "ssh://git@gitea.meghsakha.com:22222/"; \
    fi && \
    CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY --from=builder /app/target/dx/compliance-dashboard/release/web/compliance-dashboard /app/compliance-dashboard
COPY --from=builder /app/target/dx/compliance-dashboard/release/web/public /app/public

ENV IP=0.0.0.0
EXPOSE 8080

ENTRYPOINT ["./compliance-dashboard"]