FROM debian:bookworm-slim

RUN apt-get update && \
    apt-get install -y --no-install-recommends nginx curl unzip ca-certificates gcc libc6-dev && \
    rm -rf /var/lib/apt/lists/*

# RustFS 1.0.3 binary (glibc build) from the official GitHub release,
# verified against the release SHA256SUMS.
RUN curl -fsSL https://github.com/rustfs/rustfs/releases/download/1.0.3/rustfs-linux-x86_64-gnu-v1.0.3.zip -o /tmp/rustfs.zip && \
    curl -fsSL https://github.com/rustfs/rustfs/releases/download/1.0.3/SHA256SUMS -o /tmp/SHA256SUMS && \
    SHA=$(grep 'rustfs-linux-x86_64-gnu-v1.0.3.zip$' /tmp/SHA256SUMS | awk '{print $1}') && \
    echo "$SHA  /tmp/rustfs.zip" | sha256sum -c - && \
    unzip -o /tmp/rustfs.zip -d /tmp/rustfs-bin && \
    find /tmp/rustfs-bin -name rustfs -type f -exec install -m 0755 {} /usr/bin/rustfs \; && \
    rm -rf /tmp/rustfs.zip /tmp/SHA256SUMS /tmp/rustfs-bin

COPY nginx.conf /etc/nginx/nginx.conf

# linkshim: the HF bucket FUSE mount has no hard-link support, and RustFS
# 1.0.3 publishes multipart part metadata via hard_link() (EOPNOTSUPP ->
# every UploadPart fails). The shim falls back to copying on EOPNOTSUPP.
COPY linkshim.c /usr/local/src/linkshim.c
RUN gcc -shared -fPIC -O2 -o /usr/local/lib/linkshim.so /usr/local/src/linkshim.c -ldl && \
    apt-get purge -y gcc libc6-dev && apt-get autoremove -y && rm -rf /var/lib/apt/lists/*

RUN mkdir -p /data /logs

# DIRECT_IO off and DRIVE_SYNC off: the HF bucket FUSE mount rejects
# several POSIX ops with EOPNOTSUPP; keep RustFS on its plainest I/O path.
# (Multipart itself is fixed by linkshim above, not by these toggles.)
ENV RUSTFS_ADDRESS=0.0.0.0:9000 \
    RUSTFS_CONSOLE_ADDRESS=0.0.0.0:9001 \
    RUSTFS_CONSOLE_ENABLE=true \
    RUSTFS_VOLUMES=/data \
    RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS="*" \
    RUSTFS_OBJECT_DIRECT_IO_WRITE_ENABLE=false \
    RUSTFS_DRIVE_SYNC_ENABLE=false \
    RUSTFS_OBS_LOGGER_LEVEL=warn

EXPOSE 8080

# Start RustFS only when root credentials are provided via Space secrets,
# so the instance never runs on the well-known default credentials.
CMD ["/bin/sh", "-c", "if [ -n \"$RUSTFS_ACCESS_KEY\" ] && [ -n \"$RUSTFS_SECRET_KEY\" ]; then LD_PRELOAD=/usr/local/lib/linkshim.so rustfs /data & else echo 'RUSTFS_ACCESS_KEY / RUSTFS_SECRET_KEY not set, storage not started'; fi; exec nginx -g 'daemon off;'"]