# syntax=docker/dockerfile:1
# Standalone Rust/Axum OCSP responder.
#
# The final image is scratch: the binary is a statically linked musl
# executable and the only file besides it is the CA bundle needed for
# outbound HTTPS to S3. Configuration, CA certificates and delegated signer
# material are mounted at runtime.

FROM rust:1-alpine AS builder

RUN apk add --no-cache build-base musl-dev perl ca-certificates file binutils \
 && rustup target add x86_64-unknown-linux-musl

WORKDIR /app
COPY ocsp-responder/Cargo.toml ocsp-responder/Cargo.lock ./
COPY ocsp-responder/src ./src

RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/app/target \
    RUSTFLAGS="-C target-feature=+crt-static" \
    cargo build --release --locked --target x86_64-unknown-linux-musl \
 && strip target/x86_64-unknown-linux-musl/release/kca-ocsp-responder \
 && file target/x86_64-unknown-linux-musl/release/kca-ocsp-responder \
    | grep -Eq "statically linked|static-pie linked" \
 && cp target/x86_64-unknown-linux-musl/release/kca-ocsp-responder /kca-ocsp-responder

FROM scratch

COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=builder /kca-ocsp-responder /kca-ocsp-responder

ENV OCSP_CONFIG=/etc/ocsp/responder.yaml \
    SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

USER 65532:65532
EXPOSE 2560

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
  CMD ["/kca-ocsp-responder", "--healthcheck"]

ENTRYPOINT ["/kca-ocsp-responder"]