# syntax=docker/dockerfile:1.7
# Test-only packaging for binaries built from one exact local NexusCRM commit.
# Compilation stays on the authenticated host; Docker receives no GitHub or
# module credentials. Formal releases continue to use runtime.Dockerfile and
# integration.Dockerfile plus the owner signing workflows.

FROM alpine:3.20 AS runtime-base
RUN apk add --no-cache ca-certificates git tzdata \
    && addgroup -S -g 10001 runtime \
    && adduser -S -D -H -u 10001 -G runtime runtime \
    && mkdir -p /etc/nexuscrm \
    && chown -R runtime:runtime /etc/nexuscrm
USER 10001:10001

ARG VERSION
ARG SOURCE_REVISION

FROM runtime-base AS runtime-api
ARG VERSION
ARG SOURCE_REVISION
LABEL org.opencontainers.image.title="NexusCRM Runtime API (Test2 dev candidate)" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.revision="${SOURCE_REVISION}" \
      dev.nexuscrm.runtime.role="runtime-api" \
      dev.nexuscrm.release.class="test2-dev-candidate"
COPY runtime-api /usr/local/bin/runtime-api
COPY l0-controlplane /usr/local/bin/l0-controlplane
COPY runtime-api.schema.json /etc/nexuscrm/config-schema.json
COPY host-compatibility.json /etc/nexuscrm/host-compatibility.json
EXPOSE 9090 9091
HEALTHCHECK --interval=10s --timeout=3s --retries=3 CMD wget -qO- http://127.0.0.1:9091/livez >/dev/null || exit 1
ENTRYPOINT ["/usr/local/bin/runtime-api"]

FROM runtime-base AS runtime-worker
ARG VERSION
ARG SOURCE_REVISION
LABEL org.opencontainers.image.title="NexusCRM Runtime Worker (Test2 dev candidate)" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.revision="${SOURCE_REVISION}" \
      dev.nexuscrm.runtime.role="runtime-worker" \
      dev.nexuscrm.release.class="test2-dev-candidate"
COPY runtime-worker /usr/local/bin/runtime-worker
COPY runtime-worker.schema.json /etc/nexuscrm/config-schema.json
EXPOSE 9191
HEALTHCHECK --interval=10s --timeout=3s --retries=3 CMD wget -qO- http://127.0.0.1:9191/livez >/dev/null || exit 1
ENTRYPOINT ["/usr/local/bin/runtime-worker"]

FROM alpine:3.20 AS integration-service
RUN apk add --no-cache ca-certificates tzdata \
    && addgroup -S -g 10001 integration \
    && adduser -S -D -H -u 10001 -G integration integration
USER 10001:10001
ARG VERSION
ARG SOURCE_REVISION
LABEL org.opencontainers.image.title="NexusCRM Integration Service (Test2 dev candidate)" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.revision="${SOURCE_REVISION}" \
      dev.nexuscrm.integration.role="integration-service" \
      dev.nexuscrm.release.class="test2-dev-candidate"
COPY integration-service /usr/local/bin/integration-service
ENTRYPOINT ["/usr/local/bin/integration-service"]