# syntax=docker/dockerfile:1
# Standalone Rust/Axum OCSP responder. It has no database or KCA master-key
# access; configuration and signer material are mounted at runtime.

FROM rust:1-slim-bookworm AS builder
WORKDIR /app
COPY ocsp-responder/Cargo.toml ocsp-responder/Cargo.lock ./
COPY ocsp-responder/src ./src
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/app/target \
    cargo build --release --locked \
 && cp /app/target/release/kca-ocsp-responder /usr/local/bin/kca-ocsp-responder

FROM debian:bookworm-slim
RUN addgroup --system ocsp \
 && adduser --system --ingroup ocsp --no-create-home ocsp \
 && mkdir -p /etc/ssl/certs
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

COPY --from=builder /usr/local/bin/kca-ocsp-responder /usr/local/bin/kca-ocsp-responder

ENV OCSP_CONFIG=/etc/ocsp/responder.yaml
USER ocsp
EXPOSE 2560

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
  CMD ["/usr/local/bin/kca-ocsp-responder", "--healthcheck"]

CMD ["/usr/local/bin/kca-ocsp-responder"]