# syntax=docker/dockerfile:1
# ---------------------------------------------------------------- build stage
FROM golang:1.23-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
# 全静态二进制：镜像里直接跑脚本，无需 libc。
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/wb2api ./cmd/server \
 && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/wb2api-launcher ./cmd/launcher \
 && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/signin_bin ./cmd/signin \
 && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/login ./cmd/login \
 && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/credit ./cmd/credit

# -------------------------------------------------------------- runtime stage
FROM alpine:3.20
# python3：login.sh 的 JSON 解析 + 入口脚本的配置校验；tzdata：Asia/Shanghai。
RUN apk add --no-cache wget ca-certificates tzdata python3 bash \
 && mkdir -p /app/auths /app/data
ENV TZ=Asia/Shanghai
WORKDIR /app

COPY --from=build /out/wb2api /app/wb2api
# 独立启动器：本地/容器里都能「先同步凭证、再拉起网关」，且换 wb2api 版本时它不用重编。
COPY --from=build /out/wb2api-launcher /app/wb2api-launcher
COPY --from=build /out/signin_bin /app/signin_bin
COPY --from=build /out/login /app/login
COPY --from=build /out/credit /app/credit
COPY login.sh signin.sh credit.sh /app/
COPY scripts/probe_active.py /app/scripts/probe_active.py
# config.default.json 只是「镜像内模板」：仅当持久卷上还没有 config.json 时被拷过去一次。
# 真正的运行配置住在私有 Storage Bucket 上（见 docker-entrypoint.sh），公开仓库里不放 api_key。
COPY config.default.json /app/config.json
COPY docker-entrypoint.sh /app/docker-entrypoint.sh
RUN sed -i 's/\r$//' /app/login.sh /app/signin.sh /app/credit.sh /app/docker-entrypoint.sh \
 && chmod 755 /app/login.sh /app/signin.sh /app/credit.sh /app/docker-entrypoint.sh

# 以 root 运行：Storage Bucket 卷由挂载器创建，非 root 用户可能写不进去。
EXPOSE 7861
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
  CMD wget -qO- http://127.0.0.1:7861/healthz || exit 1
ENTRYPOINT ["/app/docker-entrypoint.sh"]