ARG GO_IMAGE=golang:1.24-trixie
ARG RUNTIME_IMAGE=debian:trixie-slim
ARG VERSION=0.0.0

FROM ${GO_IMAGE} AS build-machinery

ARG VERSION
ENV CGO_ENABLED=1

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    ca-certificates \
    git \
    libavcodec-dev \
    libavutil-dev \
    libswscale-dev \
    pkg-config \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /src
COPY machinery ./machinery
COPY .git ./.git

RUN cd machinery && \
    go mod download && \
    if [ -z "${VERSION}" ] || [ "${VERSION}" = "0.0.0" ]; then \
        VERSION=$(git -C /src describe --tags --always 2>/dev/null || echo "0.0.0"); \
    fi && \
    go build \
        -tags moq,timetzdata,netgo,osusergo \
        -ldflags "-s -w -X github.com/kerberos-io/agent/machinery/src/utils.VERSION=${VERSION}" \
        -o /out/main \
        ./main.go && \
    cp -r data /out/data && \
    printf '%s' "${VERSION}" > /out/version && \
    mkdir -p /out/data/cloud /out/data/snapshots /out/data/log /out/data/recordings /out/data/capture-test /out/data/config

FROM node:22-alpine AS build-ui

WORKDIR /src/ui
COPY ui ./
RUN mkdir -p /src/machinery && \
    yarn config set network-timeout 300000 && \
    yarn install --frozen-lockfile && \
    yarn build

FROM ${RUNTIME_IMAGE}

RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    ffmpeg \
    libcap2-bin \
    libstdc++6 \
    && rm -rf /var/lib/apt/lists/* && \
    groupadd --system kerberosio && \
    useradd --system --gid kerberosio --groups video --create-home agent

COPY --from=build-machinery --chown=root:root /out/main /home/agent/main
COPY --from=build-machinery --chown=agent:kerberosio /out/data /home/agent/data
COPY --from=build-machinery --chown=root:root /out/version /home/agent/version
COPY --from=build-ui --chown=agent:kerberosio /src/machinery/www /home/agent/www

RUN cp /home/agent/data/config/config.json /home/agent/data/config.template.json && \
    chown agent:kerberosio /home/agent/data/config.template.json && \
    setcap 'cap_net_bind_service=+ep' /home/agent/main && \
    /home/agent/main -action version

USER agent
WORKDIR /home/agent

EXPOSE 80
HEALTHCHECK CMD curl --fail http://localhost:80 || exit 1
CMD ["./main", "-action", "run", "-port", "80"]