# --- Build stage ---
FROM rust:1.88-alpine AS builder

RUN apk add --no-cache musl-dev pkgconfig openssl-dev

WORKDIR /app
COPY Cargo.toml Cargo.lock* ./
# Pre-fetch deps with a dummy build for layer caching
RUN mkdir src && echo "fn main(){}" > src/main.rs && \
    cargo build --release && \
    rm -rf src

COPY src ./src
COPY static ./static
COPY migrations ./migrations
RUN touch src/main.rs && cargo build --release

# --- Runtime stage ---
FROM alpine:3.21

RUN apk add --no-cache ca-certificates ffmpeg

# Run as a non-root user. Pre-create and chown the media mount path so the fresh
# named volume inherits the non-root ownership (Docker seeds an empty named volume
# from the image directory, preserving its uid/gid) and uploads can be written.
RUN addgroup -S app && adduser -S app -G app

WORKDIR /app
COPY --from=builder /app/target/release/eventsnap-backend ./

RUN mkdir -p /media && chown -R app:app /app /media
USER app

EXPOSE 3000
CMD ["./eventsnap-backend"]
