# The binary is NOT compiled here. Build it first, from the repository root:
#
#   (cd web && npm ci && npm run build)
#   zig build cross -Dweb-dist=web/dist -Doptimize=ReleaseSafe
#
# then build the image with the repository root as context:
#
#   docker build -t nxdns -f deploy/docker/Dockerfile .
#
# The builder stage stages the CA bundle (upstream DoH/DoT verification rescans
# the system store; a scratch image without one breaks every TLS upstream) and
# maps the buildx TARGETARCH onto the zig cross-target directory.

FROM alpine:3.22 AS builder
RUN apk add --no-cache ca-certificates
ARG TARGETARCH
COPY zig-out/cross /cross
RUN mkdir -p /rootfs/etc/ssl/certs /rootfs/etc/nxdns /rootfs/var/lib/nxdns \
    && cp /etc/ssl/certs/ca-certificates.crt /rootfs/etc/ssl/certs/ \
    && case "${TARGETARCH:-amd64}" in \
         amd64) cp /cross/x86_64-linux-musl/nxdns /rootfs/nxdns ;; \
         arm64) cp /cross/aarch64-linux-musl/nxdns /rootfs/nxdns ;; \
         *) echo "unsupported TARGETARCH '${TARGETARCH}'" >&2; exit 1 ;; \
       esac \
    && chown 65532:65532 /rootfs/var/lib/nxdns

FROM scratch
COPY --from=builder /rootfs/ /
USER 65532:65532
VOLUME /var/lib/nxdns
EXPOSE 53/udp 53/tcp 8080 443 853
ENTRYPOINT ["/nxdns"]
CMD ["run"]