ARG ALPINE_BASE=alpine:3.20
ARG GO_BASE=golang:1.25
# The route-proxy module's runtime image: the reference reverse proxy compiled into a container.
#
# **The proxy source is not vendored here.** The canonical proxy — the contract written as something
# that runs — lives in the mesh-controller repository at examples/route-proxy (novox/hq 08-connectivity
# §3). This module ships the *packaging*, not a second copy of the contract, so the build context is
# the mesh-controller repository, and this Dockerfile compiles ./examples/route-proxy from it. The build seat
# hands it only that program's build source — its import closure, go.mod, go.sum and the vendored packages
# it uses (novox/hq ADR 0267, the artifact's `compiles`) — so a merge elsewhere in that repository does not
# move this image, and a COPY of anything outside it fails by name.
#
#   docker build -f mesh-catalog/modules/route-proxy/Dockerfile \
#                -t mesh-route-proxy:development  <path-to>/mesh-controller
#
# The mesh pins the digest of what this produces; the committed module.json carries the placeholder
# digest every mesh-built image does, replaced at publish.
FROM ${GO_BASE} AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /mesh-route-proxy ./examples/route-proxy

# A small runtime with the public CA roots the ACME client needs to reach a real authority, and run
# as root so it can bind :80 and :443 — the two privileged ports a public front door listens on.
FROM ${ALPINE_BASE}
RUN apk add --no-cache ca-certificates
COPY --from=build /mesh-route-proxy /usr/local/bin/mesh-route-proxy
ENTRYPOINT ["/usr/local/bin/mesh-route-proxy"]