# wai-room (crate joule-moq-room), the room service, as an OCI image, for running it yourself.
#
# Build from the repository's root, with the ignore file beside this one keeping the context to
# the directories the room service is built from:
#
#   docker build -f joule-code/joule-code-rs/crates/joule-moq-room/deploy/Containerfile -t wai-room .
#   (or: podman build --ignorefile <this directory>/Containerfile.dockerignore -f ... the same)
#
# Two stages, as wai/wai-quantum-service/deploy/Containerfile has them. The first builds the
# service with the repository's pinned toolchain (rust-toolchain.toml) from the locked
# dependencies; the second holds the binary and a configuration, run as an unprivileged user.
# Both bases are pinned by digest, the build is locked, paths are remapped and the timestamp is
# fixed, so the same source builds the same binary.
#
# The service keeps its keys in one volume, /var/lib/wai-room. Make them once; the command prints
# the lines the relay's configuration needs to trust them:
#
#   docker run --rm -v wai-room:/var/lib/wai-room wai-room keygen /var/lib/wai-room/keys.toml
#   docker run -v wai-room:/var/lib/wai-room -p 9682:9682 wai-room
#
# Its configuration (/etc/wai-room/room.toml) serves HTTP on port 9682 and reaches the relay's
# WebSocket listener at ws://relay:4480/moq, a relay container named relay on the same network.
# A deployment mounts its own configuration over that file (room.example.toml, beside the crate,
# shows every field). deploy/check-image.sh builds the image and runs it beside the relay's.

# The build stage: the language's build image at the repository's toolchain, pinned by digest.
FROM docker.io/library/rust:1.99.1-slim-trixie@sha256:f6c4a35d21dbb3c89d7a8d056c193e94fc09037f2b58dd858b09c39a47dd02d7 AS build
ENV CARGO_INCREMENTAL=0 \
    CARGO_TERM_COLOR=never \
    SOURCE_DATE_EPOCH=0 \
    RUSTFLAGS="--remap-path-prefix=/src=/build --remap-path-prefix=/usr/local/cargo=/cargo -C strip=symbols"
WORKDIR /src
# The service's own workspace (crates/joule-moq-room, with its lock file), its path dependencies,
# and wai/, from which the wai crate it depends on reads the files its features include.
COPY jcp/jcp-rs ./jcp/jcp-rs
COPY joule-code/joule-code-rs ./joule-code/joule-code-rs
COPY joule-ui/joule-ui-rs ./joule-ui/joule-ui-rs
COPY sandbox/sandbox-rs ./sandbox/sandbox-rs
COPY wai ./wai
WORKDIR /src/joule-code/joule-code-rs/crates/joule-moq-room
# JOBS bounds the build's parallel jobs on a shared host (--build-arg JOBS=8).
ARG JOBS
RUN cargo build --locked --release --bin wai-room ${JOBS:+--jobs "$JOBS"} \
 && cp target/release/wai-room /wai-room

# The run stage: a slim base of the same release, pinned by digest, and the binary.
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2
RUN useradd --system --uid 10001 --home-dir /var/lib/wai-room --create-home wai \
 && chmod 0700 /var/lib/wai-room \
 && mkdir -p /etc/wai-room
COPY --from=build /wai-room /usr/local/bin/wai-room
COPY joule-code/joule-code-rs/crates/joule-moq-room/deploy/room.toml /etc/wai-room/room.toml
USER wai
LABEL org.opencontainers.image.title="wai-room" \
      org.opencontainers.image.source="https://git.transaction.science/Transaction-Science/open-standards" \
      org.opencontainers.image.licenses="Apache-2.0"
# Its keys: made once (keygen, above), never over a file that exists, mode 0600.
VOLUME ["/var/lib/wai-room"]
EXPOSE 9682
ENTRYPOINT ["/usr/local/bin/wai-room"]
CMD ["--config", "/etc/wai-room/room.toml"]