Dockerfile.backend

# Backend-only Dockerfile for Fly.io deployments
# Now includes both Rust backend and OCaml crypto verifier

FROM rust:1.88 AS rust-builder
WORKDIR /app

# Build args for version info (GIT_COMMIT_MESSAGE intentionally omitted —
# commit messages in image ENV leak internal information; use git log instead)
ARG GIT_COMMIT

RUN apt-get update \
    && apt-get install --no-install-recommends -y pkg-config libssl-dev \
    && rm -rf /var/lib/apt/lists/*

# Copy only dependency files first for better caching
COPY Cargo.toml Cargo.lock ./
RUN mkdir -p src && echo "fn main() {}" > src/main.rs
RUN cargo fetch --locked

# Build dependencies only (cached layer)
RUN cargo build --release --locked --bin copypaste || true
RUN rm -rf src

# Now copy actual source code
COPY src ./src
COPY static ./static
COPY docs ./docs
COPY README.md ./
COPY blockchain ./blockchain

# Build the actual application with version info (only this layer rebuilds when code changes)
ENV GIT_COMMIT=${GIT_COMMIT}
RUN cargo build --release --locked --bin copypaste

# OCaml builder stage
FROM ocaml/opam:debian-12-ocaml-5.2 AS ocaml-builder

# Install system dependencies
RUN sudo apt-get update && sudo apt-get install -y \
    pkg-config \
    libssl-dev \
    libgmp-dev \
    && sudo rm -rf /var/lib/apt/lists/*

WORKDIR /app/ocaml-crypto-verifier

# Copy only dependency files first for better caching
COPY ocaml-crypto-verifier/dune-project ocaml-crypto-verifier/crypto_verifier.opam ./

# Update opam and install OCaml dependencies (system deps already installed above)
RUN opam update && opam install . --deps-only --yes

# Now copy source code
COPY ocaml-crypto-verifier/ ./

# Build the OCaml application (only this layer rebuilds when code changes)
RUN opam exec -- dune build @install

# Runtime stage
FROM debian:bookworm-slim AS runtime
WORKDIR /app

RUN apt-get update \
    && apt-get install --no-install-recommends -y ca-certificates tzdata curl \
    && rm -rf /var/lib/apt/lists/*

# Copy Rust binary
COPY --from=rust-builder /app/target/release/copypaste /usr/local/bin/copypaste

# Copy OCaml binary
COPY --from=ocaml-builder /app/ocaml-crypto-verifier/_build/install/default/bin/crypto_verifier_server /usr/local/bin/crypto-verifier

# Copy static assets
COPY --from=rust-builder /app/static ./static
COPY --from=rust-builder /app/docs ./docs
COPY --from=rust-builder /app/blockchain ./blockchain

# Create a startup script to run both services
RUN echo '#!/bin/bash\n\
# Check which process Fly.io wants us to run\n\
if [[ "${FLY_PROCESS_GROUP}" == "crypto-verifier" ]]; then\n\
    echo "Starting OCaml crypto verifier..."\n\
    exec crypto-verifier\n\
elif [[ "${FLY_PROCESS_GROUP}" == "app" ]]; then\n\
    echo "Starting Rust backend..."\n\
    exec copypaste serve\n\
else\n\
    echo "No FLY_PROCESS_GROUP specified, starting both services..."\n\
    # Start OCaml crypto verifier in background\n\
    crypto-verifier &\n\
    CRYPTO_PID=$!\n\
    \n\
    # Start Rust backend in foreground\n\
    copypaste serve &\n\
    RUST_PID=$!\n\
    \n\
    # Wait for any process to exit\n\
    wait -n\n\
    \n\
    # Exit with the status of the process that exited first\n\
    exit $?\n\
fi\n\
' > /usr/local/bin/start-services.sh && chmod +x /usr/local/bin/start-services.sh

# Create non-root user and fix ownership
RUN groupadd --system --gid 1001 copypaste && \
    useradd --system --uid 1001 --gid copypaste --no-create-home copypaste && \
    chown -R copypaste:copypaste /app

# Expose GIT_COMMIT as an OCI label rather than runtime ENV
ARG GIT_COMMIT
LABEL org.opencontainers.image.revision="${GIT_COMMIT}"

ENV ROCKET_ADDRESS=0.0.0.0
ENV ROCKET_PORT=8000
ENV COPYPASTE_VERSION=0.1.0-docker
EXPOSE 8000 8001

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD ["copypaste", "healthcheck"]

USER copypaste

# Fly.io process commands may override this; custom/default image runs use the
# same subcommand-aware launcher.
CMD ["/usr/local/bin/start-services.sh"]