# wai-relay (crate joule-moq-relay) as an OCI image, for running it yourself.
#
# Build from the repository's root, with the ignore file beside this one keeping the context to
# the directories the relay's workspace is built from:
#
#   docker build -f joule-code/joule-code-rs/crates/joule-moq-relay/deploy/Containerfile -t wai-relay .
#   (or: podman build --ignorefile <this directory>/Containerfile.dockerignore -f ... the same)
#
# Two stages, as wai/wai-quantum-service/deploy/Containerfile has them. The first builds the relay
# with the repository's pinned toolchain (rust-toolchain.toml) from the locked dependencies; the
# second holds the binary, the certificate roots for an upstream with a public certificate, and a
# configuration, run as an unprivileged user. Both bases are pinned by digest, the build is
# locked, paths are remapped and the timestamp is fixed, so the same source builds the same binary.
#
#   docker run -p 4443:4443/udp -p 4480:4480 wai-relay
#
# serves native QUIC and WebTransport on UDP 4443 and the WebSocket fallback on TCP 4480, with a
# development certificate whose SHA-256 it logs. A deployment mounts its own configuration over
# /etc/wai-relay/relay.toml (relay.example.toml, beside the crate, shows every field) and its
# certificate files beside it. deploy/check-image.sh builds the image and holds it to its checks.

# The build stage: the language's build image at the repository's toolchain, pinned by digest.
FROM docker.io/library/rust:1.99.1-slim-trixie@sha256:f6c4a35d21dbb3c89d7a8d056c193e94fc09037f2b58dd858b09c39a47dd02d7 AS build
ENV CARGO_INCREMENTAL=0 \
    CARGO_TERM_COLOR=never \
    SOURCE_DATE_EPOCH=0 \
    RUSTFLAGS="--remap-path-prefix=/src=/build --remap-path-prefix=/usr/local/cargo=/cargo -C strip=symbols"
WORKDIR /src
# The relay's workspace, the path dependencies of its members, and the toolchain's manifest, whose
# version `wai-relay --version` states.
COPY jcp/jcp-rs ./jcp/jcp-rs
COPY joule-code/joule-code-rs ./joule-code/joule-code-rs
COPY joulecontract/joulecontract-rs ./joulecontract/joulecontract-rs
COPY proof/proof-rs ./proof/proof-rs
COPY sandbox/sandbox-rs ./sandbox/sandbox-rs
COPY wai/wai-metrics ./wai/wai-metrics
COPY wai/wai-rs/Cargo.toml ./wai/wai-rs/Cargo.toml
WORKDIR /src/joule-code/joule-code-rs
# JOBS bounds the build's parallel jobs on a shared host (--build-arg JOBS=8).
ARG JOBS
RUN cargo build --locked --release -p joule-moq-relay --bin wai-relay ${JOBS:+--jobs "$JOBS"} \
 && cp target/release/wai-relay /wai-relay

# The run stage: a slim base of the same release, pinned by digest, and the binary.
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2
RUN useradd --system --uid 10001 --home-dir /var/lib/wai-relay --create-home wai \
 && mkdir -p /etc/wai-relay /etc/ssl/certs
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build /wai-relay /usr/local/bin/wai-relay
COPY joule-code/joule-code-rs/crates/joule-moq-relay/deploy/relay.toml /etc/wai-relay/relay.toml
USER wai
LABEL org.opencontainers.image.title="wai-relay" \
      org.opencontainers.image.source="https://git.transaction.science/Transaction-Science/open-standards" \
      org.opencontainers.image.licenses="Apache-2.0"
EXPOSE 4443/udp 4480/tcp
ENTRYPOINT ["/usr/local/bin/wai-relay"]
CMD ["--config", "/etc/wai-relay/relay.toml"]