# Build stage. Pinned to the toolchain in rust-toolchain.toml so a CI image
# bump cannot silently change the compiler.
FROM rust:1.97.1-slim-bookworm AS build
WORKDIR /src

RUN apt-get update && apt-get install -y --no-install-recommends \
        pkg-config libssl-dev ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Manifests first so the dependency layer caches independently of source edits.
COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
COPY crates ./crates
RUN cargo build --release --workspace --locked

# Runtime stage. Distroless-adjacent: no shell, no package manager, nothing to
# pivot to. This process listens on :25 to the open internet.
FROM debian:bookworm-slim AS runtime
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --system --uid 10001 --no-create-home --shell /usr/sbin/nologin openmail

COPY --from=build /src/target/release/openmail /usr/local/bin/openmail

USER 10001:10001
ENTRYPOINT ["/usr/local/bin/openmail"]
CMD ["serve"]