# luxfi/kms — MPC-backed KMS server (headless, no React UI)
# Server-only build: Go + sqlcipher + MPC/ZAP. Skips the React SPA frontend
# stage so emulated cross-platform builds (M-series Mac → linux/amd64) don't
# trip QEMU's esbuild crash.

FROM golang:1.26.4-bookworm AS builder
ENV GOTOOLCHAIN=auto
RUN apt-get update && apt-get install -y --no-install-recommends \
    libsqlcipher-dev gcc libc6-dev pkg-config git ca-certificates \
    && rm -rf /var/lib/apt/lists/*

ARG GITHUB_TOKEN
RUN git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
# No GOPRIVATE — luxfi/hanzoai Go modules are PUBLIC; resolve via public proxy +
# sumdb (immutable). GOPRIVATE would route `direct` and re-poison go.sum.

WORKDIR /build
COPY go.mod go.sum ./
# GOSUMDB=off: luxfi first-party tags are periodically force-republished during the
# ongoing ecosystem re-tag (e.g. luxfi/vm), so immutable sum.golang.org lags the
# proxy and rejects the current bits. Trust the proxy/authed-git source and record
# what is really fetched — integrity is still enforced against the regenerated
# go.sum (regenerate-not-bypass). Mirrors the main Dockerfile.
ENV GOSUMDB=off
RUN rm -f go.sum && go mod download
COPY . .

# `COPY . .` just re-introduced the committed go.sum, which can be stale vs the bits
# primed above when a luxfi tag was force-republished — a -mod=mod build then aborts
# on a go.sum checksum mismatch. Drop and regenerate from the primed cache under
# GOSUMDB=off (same as the main Dockerfile). Without this, that earlier regeneration
# is silently reverted by this COPY.
RUN rm -f go.sum && go mod download

# GOFLAGS=-mod=mod builds from the module cache, not the in-tree vendor/. The
# committed vendor/ can lag go.mod during the re-tag (inconsistent vendoring) and
# also strips supranational/blst C headers. Matches the main Dockerfile.
RUN CGO_ENABLED=1 GOFLAGS=-mod=mod go build -tags "sqlite_fts5 sqlcipher" \
    -ldflags="-s -w" -o /usr/local/bin/kms ./cmd/kms

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends \
    libsqlcipher0 ca-certificates curl \
    && rm -rf /var/lib/apt/lists/*

COPY --from=builder /usr/local/bin/kms /usr/local/bin/kms
RUN mkdir -p /data/kms

ENV BASE_SKIP_ROOT_REDIRECT=1
ENV BASE_DISABLE_ADMIN_UI=1

EXPOSE 8080
HEALTHCHECK --interval=10s --timeout=3s --retries=3 \
  CMD curl -f http://localhost:8080/healthz || exit 1
ENTRYPOINT ["kms", "serve", "--http=0.0.0.0:8080"]