# syntax=docker/dockerfile:1.7
# Build context: repository root.
# Independent Integration Service release artifact:
#   docker build --target integration-service -f infra/integration.Dockerfile .

FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS builder

ARG TARGETOS=linux
ARG TARGETARCH
ARG VERSION=dev

RUN apk add --no-cache ca-certificates git openssh-client \
    && mkdir -p /root/.ssh \
    && chmod 700 /root/.ssh \
    && ssh-keyscan github.com >> /root/.ssh/known_hosts \
    && git config --global url."git@github.com-nexuscrm-connectors:pingcap-inc/nexuscrm-connectors".insteadOf "https://github.com/pingcap-inc/nexuscrm-connectors" \
    && git config --global url."git@github.com-nexuscrm-api-host:pingcap-inc/nexuscrm-api-host".insteadOf "https://github.com/pingcap-inc/nexuscrm-api-host" \
    && git config --global url."git@github.com-nexuscrm-contract:pingcap-inc/nexuscrm-contract".insteadOf "https://github.com/pingcap-inc/nexuscrm-contract" \
    && git config --global url."git@github.com-nexuscrm-controlplane:pingcap-inc/nexuscrm-controlplane".insteadOf "https://github.com/pingcap-inc/nexuscrm-controlplane"

ENV GOPRIVATE=github.com/pingcap-inc/nexuscrm-connectors,github.com/pingcap-inc/nexuscrm-api-host,github.com/pingcap-inc/nexuscrm-contract,github.com/pingcap-inc/nexuscrm-controlplane
ENV GONOSUMDB=github.com/pingcap-inc/nexuscrm-connectors,github.com/pingcap-inc/nexuscrm-api-host,github.com/pingcap-inc/nexuscrm-contract,github.com/pingcap-inc/nexuscrm-controlplane

WORKDIR /src

# Copy only the app-blind Integration module closure. The Dockerfile-specific
# ignore is the build-context authority; these COPY instructions deliberately
# name no Runtime engine, distribution, app-pack, tenant overlay, or frontend.
COPY shared/go.mod shared/go.sum ./shared/
COPY backend/go.mod backend/go.sum ./backend/
COPY nexuscrm-db/go.mod ./nexuscrm-db/
COPY nexuscrm-kernel/go.mod ./nexuscrm-kernel/
COPY nexuscrm-outbound/go.mod ./nexuscrm-outbound/

WORKDIR /src
COPY shared/ ./shared/
COPY backend/ ./backend/
COPY nexuscrm-db/ ./nexuscrm-db/
COPY nexuscrm-kernel/ ./nexuscrm-kernel/
COPY nexuscrm-outbound/ ./nexuscrm-outbound/

WORKDIR /src/backend
RUN --mount=type=secret,id=nexuscrm_connectors_deploy_key,target=/run/secrets/nexuscrm_connectors_deploy_key,mode=0600 \
    --mount=type=secret,id=nexuscrm_api_host_deploy_key,target=/run/secrets/nexuscrm_api_host_deploy_key,mode=0600 \
    --mount=type=secret,id=nexuscrm_contract_deploy_key,target=/run/secrets/nexuscrm_contract_deploy_key,mode=0600 \
    --mount=type=secret,id=nexuscrm_controlplane_deploy_key,target=/run/secrets/nexuscrm_controlplane_deploy_key,mode=0600 \
    --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build <<'EOF'
set -e
connectors_key="$(mktemp)"
api_host_key="$(mktemp)"
contract_key="$(mktemp)"
controlplane_key="$(mktemp)"
ssh_config="$(mktemp)"
trap 'rm -f "$connectors_key" "$api_host_key" "$contract_key" "$controlplane_key" "$ssh_config"' EXIT
for pair in \
  "nexuscrm_connectors_deploy_key:$connectors_key" \
  "nexuscrm_api_host_deploy_key:$api_host_key" \
  "nexuscrm_contract_deploy_key:$contract_key" \
  "nexuscrm_controlplane_deploy_key:$controlplane_key"; do
  source="${pair%%:*}"
  destination="${pair#*:}"
  tr -d '\r' < "/run/secrets/$source" > "$destination"
  printf '\n' >> "$destination"
  chmod 600 "$destination"
done
cat > "$ssh_config" <<CONFIG
Host github.com-nexuscrm-connectors
  HostName github.com
  User git
  IdentityFile $connectors_key
  IdentitiesOnly yes
Host github.com-nexuscrm-api-host
  HostName github.com
  User git
  IdentityFile $api_host_key
  IdentitiesOnly yes
Host github.com-nexuscrm-contract
  HostName github.com
  User git
  IdentityFile $contract_key
  IdentitiesOnly yes
Host github.com-nexuscrm-controlplane
  HostName github.com
  User git
  IdentityFile $controlplane_key
  IdentitiesOnly yes
CONFIG
GIT_SSH_COMMAND="ssh -F $ssh_config" CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
  go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" -o /out/integration-service ./cmd/integration-service/
EOF

FROM alpine:3.20 AS integration-base
RUN apk add --no-cache ca-certificates tzdata \
    && addgroup -S -g 10001 integration \
    && adduser -S -D -H -u 10001 -G integration integration
USER 10001:10001

FROM integration-base AS integration-service
ARG VERSION=dev
LABEL org.opencontainers.image.title="NexusCRM Integration Service" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.revision="${VERSION}" \
      dev.nexuscrm.integration.role="integration-service"
COPY --from=builder /out/integration-service /usr/local/bin/integration-service
ENTRYPOINT ["/usr/local/bin/integration-service"]