# Self-contained secs_server image for the secs4j interop harness.
#
# The dev-time `server` compose service bind-mounts the source tree
# read-write at /app and lets the in-container `builder` step compile
# there.  That works on a developer laptop but breaks under docker-
# in-docker (gitea-act / GitHub Actions runners with a mounted
# /var/run/docker.sock): the bind-mount source resolves against the
# *host* daemon's filesystem, not the runner container's, so /app
# mounts empty and the build / launch silently fails.
#
# This image bakes the source + Release binary in at build time so
# `docker run` of it needs no volumes at all — same pattern already
# used by interop/secs4j/Dockerfile for the Java harness.
FROM ubuntu:24.04 AS build

ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential cmake ninja-build \
        libasio-dev libyaml-cpp-dev \
        libprotobuf-dev protobuf-compiler protobuf-compiler-grpc libgrpc++-dev \
        python3 python3-yaml \
        git ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /src
COPY . /src
RUN cmake -S /src -B /src/build -G Ninja -DCMAKE_BUILD_TYPE=Release \
 && cmake --build /src/build --target secs_server secs_gemd


FROM ubuntu:24.04

ENV DEBIAN_FRONTEND=noninteractive
# Dev packages in the runtime layer purely to pull the grpc/protobuf
# runtime libs by reliable names; image size is irrelevant for a CI harness.
RUN apt-get update && apt-get install -y --no-install-recommends \
        libyaml-cpp0.8 libgrpc++-dev libprotobuf-dev \
    && rm -rf /var/lib/apt/lists/*

# WORKDIR must be the directory holding `data/` because secs_server's
# default --config / --state-table paths are relative ("data/...").
WORKDIR /app
COPY --from=build /src/build/secs_server /usr/local/bin/secs_server
COPY --from=build /src/build/secs_gemd   /usr/local/bin/secs_gemd
COPY data /app/data

EXPOSE 5000
ENTRYPOINT ["/usr/local/bin/secs_server"]
CMD ["--port", "5000", "--device", "0"]