Dockerfile.daemon

# Dockerfile for the Graycode daemon (background HTTP server).
# The binary is identical to the CLI image — this Dockerfile just sets the
# daemon as the default entrypoint and exposes the daemon port.
#
# Build:  docker build -f Dockerfile.daemon -t graycode-daemon .
# Run:    docker run -p 4590:4590 -e GRAYCODE_DAEMON_API_KEY=... graycode-daemon
FROM golang:1.26.6-alpine@sha256:af8d6740070b8906d12eae1c3e3ea0957fb63f492051ea05e354c38ef9fe88df AS builder

RUN apk upgrade --no-cache && \
    apk add --no-cache git ca-certificates tzdata

WORKDIR /build

# Module resolution is file-proxy-first (see Dockerfile); no GOPRIVATE override.
ENV GOPROXY=file:///build/third_party/modproxy,https://proxy.golang.org,direct

ARG VERSION=dev
ARG COMMIT=none
ARG BUILD_DATE=unknown

COPY . .

RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    rm -f go.work go.work.sum && \
    CGO_ENABLED=0 GOOS=linux go build -trimpath \
    -ldflags="-s -w \
      -X main.Version=${VERSION} \
      -X main.Commit=${COMMIT} \
      -X main.BuildDate=${BUILD_DATE}" \
    -o graycode ./cmd/graycode

FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b

RUN apk upgrade --no-cache && \
    apk add --no-cache ca-certificates git bash curl tini && \
    adduser -D -u 1000 -h /home/graycode graycode

# Create state directory for daemon logs, API key, and audit log.
RUN mkdir -p /home/graycode/.graycode/state && \
    chown -R graycode:graycode /home/graycode/.graycode

COPY --from=builder /build/graycode /usr/local/bin/graycode
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
COPY packaging/systemd/graycode-daemon.service /etc/systemd/system/graycode-daemon.service

USER graycode
WORKDIR /workspace

EXPOSE 4590

# Health check probes the daemon's health endpoint.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD curl -ksf https://127.0.0.1:4590/v1/health || curl -sf http://127.0.0.1:4590/v1/health || exit 1

ENTRYPOINT ["tini", "--", "graycode", "daemon", "start"]
CMD ["--host", "0.0.0.0", "--port", "4590"]