# Stage 1: Build
FROM rustlang/rust:nightly-slim AS builder

RUN apt-get update && apt-get install -y pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Cache dependencies — only re-runs when Cargo.toml / Cargo.lock change
COPY Cargo.toml Cargo.lock ./
RUN mkdir -p src && echo "fn main() {}" > src/main.rs
RUN cargo build --release && rm -rf src target/release/deps/dns_resolver*

# Build the real binary
COPY src ./src
RUN cargo build --release

# Build a tiny native HTTP healthcheck binary (no OS tools needed at runtime)
RUN printf '%s\n' \
    'use std::io::{Read,Write};' \
    'use std::net::TcpStream;' \
    'fn main(){' \
    '    let mut s=match TcpStream::connect("127.0.0.1:9090"){' \
    '        Ok(s)=>s, Err(_)=>std::process::exit(1),' \
    '    };' \
    '    let _=s.write_all(b"GET / HTTP/1.0\r\nHost: localhost\r\n\r\n");' \
    '    let mut r=String::new();' \
    '    let _=s.read_to_string(&mut r);' \
    '    std::process::exit(if r.contains("200 OK"){0}else{1});' \
    '}' > /tmp/healthcheck.rs \
    && rustc /tmp/healthcheck.rs -o /app/healthcheck

# Stage 2: Runtime — distroless has no shell, no package manager, no attack surface
# Includes glibc, libgcc, ca-certificates
FROM gcr.io/distroless/cc-debian12

WORKDIR /app

COPY --from=builder /app/target/release/dns-resolver /app/dns-resolver
COPY --from=builder /app/healthcheck /app/healthcheck

# Run as uid=1002
USER 1002:1002

# DATABASE_URL must be provided at runtime via env vars or secrets.
# No default credentials are baked into the image.
ENV LISTEN_ADDR=0.0.0.0:5353
ENV RESOLVER_ID=resolver-1
ENV UPSTREAM_DNS=1.1.1.1:53
ENV BLOCKLIST_RELOAD_INTERVAL_SECS=30
ENV STATS_FLUSH_INTERVAL_SECS=5

EXPOSE 5353/udp
EXPOSE 9090

HEALTHCHECK --interval=10s --timeout=5s --start-period=15s --retries=3 \
    CMD ["/app/healthcheck"]

CMD ["/app/dns-resolver"]
