# Build context is the repo root (see docker-compose.yml) — every
# service's Dockerfile follows this same two-stage shape: compile one
# cmd/server binary against the whole monorepo module, then ship just
# the binary + that service's migrations in a distroless-ish runtime
# image. See ARCHITECTURE.md's "One Go module, many deployables" note
# for why this is a single `module enkly` rather than N go.mod files.
FROM golang:1.23-bookworm AS build
WORKDIR /src
COPY go.mod go.sum* ./
COPY gen/ gen/
COPY pkg/ pkg/
COPY services/iam/ services/iam/
# No go.sum is committed yet (see "go mod tidy" in the repo root's
# README), so resolve+lock the full dependency graph here, after all
# source is present — `go mod tidy` needs to see every import (direct
# AND the ones grpc/protobuf/etc. pull in transitively) to compute it.
# Once a go.sum is committed to the repo, this can be replaced with
# the faster, better-cached `go mod download`.
RUN go mod tidy
RUN CGO_ENABLED=0 go build -o /out/iam-server ./services/iam/cmd/server

FROM gcr.io/distroless/static-debian12:nonroot
WORKDIR /app
COPY --from=build /out/iam-server ./iam-server
COPY --from=build /src/services/iam/migrations ./migrations
ENV ENKLY_IAM_GRPC_ADDR=:9001
EXPOSE 9001
ENTRYPOINT ["./iam-server"]