# syntax=docker/dockerfile:1.7
FROM golang:1.26.3-alpine AS builder
WORKDIR /src

ARG GOPROXY=https://goproxy.cn|https://proxy.golang.org|direct
ARG GOSUMDB=sum.golang.org
ENV GOPROXY=${GOPROXY} GOSUMDB=${GOSUMDB}

COPY go.mod go.sum ./
COPY api/go.mod api/go.sum ./api/
RUN --mount=type=cache,id=hyapp-go-mod,target=/go/pkg/mod \
    --mount=type=cache,id=hyapp-go-build,target=/root/.cache/go-build \
    GOWORK=off go mod download
COPY . .
RUN --mount=type=cache,id=hyapp-go-mod,target=/go/pkg/mod \
    --mount=type=cache,id=hyapp-go-build,target=/root/.cache/go-build \
    mkdir -p /out && \
    GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /out/server ./services/statistics-service/cmd/server && \
    GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /out/backfill-social-identities ./services/statistics-service/cmd/backfill-social-identities

FROM alpine:3.20
ENV TZ=UTC
WORKDIR /app
RUN apk add --no-cache ca-certificates wget && adduser -D -g '' appuser
COPY --from=builder /out/server /app/server
# 历史身份回放只随 statistics 镜像交付，不开放 HTTP；生产由单节点
# docker exec 显式 dry-run/apply，复用容器内只读配置与最小连接数保护。
COPY --from=builder /out/backfill-social-identities /app/backfill-social-identities
COPY services/statistics-service/configs/config.docker.yaml /app/config.yaml
USER appuser
EXPOSE 13110
ENTRYPOINT ["/app/server", "-config", "/app/config.yaml"]