# syntax=docker/dockerfile:1
# ---- OpenFUT Bridge: FIFA integration / reverse-engineering proxy ----
# Multi-stage build; slim Debian runtime. reqwest uses rustls-tls and the
# bridge self-signs its own cert at startup (rcgen) — no OpenSSL needed.

FROM rust:1-bookworm AS builder
WORKDIR /build

COPY Cargo.toml Cargo.lock* ./
RUN mkdir -p src src/bin \
    && echo 'fn main() {}' > src/main.rs \
    && echo '' > src/lib.rs \
    && echo 'fn main() {}' > src/bin/replay.rs \
    && cargo build --release --bin openfut-bridge 2>/dev/null || true
RUN rm -rf src

COPY src ./src
RUN touch src/main.rs src/lib.rs \
    && cargo build --release --bin openfut-bridge

# ---- Runtime ----
FROM debian:bookworm-slim AS runtime
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl \
    && rm -rf /var/lib/apt/lists/*

RUN useradd --system --uid 10002 --create-home --home-dir /app openfut
WORKDIR /app

COPY --from=builder /build/target/release/openfut-bridge /usr/local/bin/openfut-bridge

# Captures are written at runtime — keep them on a named volume.
RUN mkdir -p /app/captures && chown openfut:openfut /app/captures

USER openfut

ENV BRIDGE_LISTEN_ADDR=0.0.0.0:8443 \
    CORE_URL=http://core:8080 \
    CAPTURES_DIR=/app/captures \
    PLACEHOLDER_MODE=true \
    TLS_ENABLED=true \
    RUST_LOG=openfut_bridge=info,tower_http=info

EXPOSE 8443
VOLUME ["/app/captures"]

# The bridge serves TLS; -k because the cert is self-signed. /_bridge/health
# is the bridge's own admin endpoint (not a proxied FIFA route).
HEALTHCHECK --interval=15s --timeout=4s --start-period=8s --retries=5 \
    CMD curl -fsSk https://127.0.0.1:8443/_bridge/health || exit 1

ENTRYPOINT ["openfut-bridge"]