FROM golang:1.25 AS builder

WORKDIR /src

COPY go.mod go.sum ./
RUN go mod download

COPY . .

# Build server binary
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" -o /out/soul-api ./cmd/server

FROM alpine:3.19

WORKDIR /app

RUN apk add --no-cache ca-certificates tzdata wget && \
    addgroup -S app && adduser -S -G app app

COPY --from=builder /out/soul-api /app/soul-api
COPY certs/ /app/certs/

# Runtime directories used by the app
RUN mkdir -p /app/uploads /app/log && chown -R app:app /app

ENV APP_ENV=production
ENV GIN_MODE=release
ENV PORT=8080
ENV UPLOAD_DIR=/app/uploads
ENV WECHAT_CERT_PATH=/app/certs/apiclient_cert.pem
ENV WECHAT_KEY_PATH=/app/certs/apiclient_key.pem

EXPOSE 8080

USER app

CMD ["/app/soul-api"]