# Naut-Torrent — multi-stage build.
#
# The daemon, the webui plugin, and the static UI assets are all compiled from
# source inside the image, so the binaries are frozen at `docker build` time:
# a rebuild is the only thing that bumps the running version.
#
#   docker build -t naut-torrent .
#   docker run -d --name naut \
#     -p 8080:8080 -p 6881:6881 -p 6881:6881/udp \
#     -e NAUT_AUTH_PASSWORD=change-me \
#     -v naut-data:/data -v /path/to/downloads:/downloads \
#     naut-torrent
#
# The build context must be the Naut-Torrent repo with its submodules checked
# out (external/torrent-peer, external/torrent-tracker, web/torrent-ui):
#   git submodule update --init --recursive

# ---------------------------------------------------------------------------
# Stage 1 — build
# ---------------------------------------------------------------------------
FROM debian:bookworm-slim AS build

# Toolchain + library headers. Lua/Jansson/SQLite/OpenSSL/liburing are linked
# from the distro (the project's default, non-vendored build path).
RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential \
        cmake \
        pkg-config \
        liburing-dev \
        libssl-dev \
        libjansson-dev \
        liblua5.4-dev \
        libsqlite3-dev \
    && rm -rf /var/lib/apt/lists/*

# CMake asks pkg-config for the module name "lua"; Debian ships it as "lua5.4".
# Bridge the two with a .pc symlink rather than patching CMakeLists.
RUN set -eux; \
    luapc="$(find /usr -name 'lua5.4.pc' | head -n1)"; \
    test -n "$luapc"; \
    mkdir -p /usr/local/lib/pkgconfig; \
    ln -sf "$luapc" /usr/local/lib/pkgconfig/lua.pc

ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig

WORKDIR /src
COPY . .

# Configure + build only the artifacts the image ships. -DNAUT_STANDALONE=OFF
# (default) uses the system Lua/Jansson installed above.
RUN cmake -S . -B build -DCMAKE_BUILD_TYPE=Release \
 && cmake --build build -j"$(nproc)" --target nautd nautctl naut_webui

# ---------------------------------------------------------------------------
# Stage 2 — runtime
# ---------------------------------------------------------------------------
FROM debian:bookworm-slim AS runtime

# Shared libraries the daemon + plugin load at runtime, plus CA certs for
# HTTPS RSS feeds / tracker announces.
RUN apt-get update && apt-get install -y --no-install-recommends \
        liburing2 \
        libssl3 \
        libjansson4 \
        liblua5.4-0 \
        libsqlite3-0 \
        ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --system --create-home --home-dir /home/naut --uid 1000 naut

WORKDIR /app

# Binaries, the webui plugin, and the static frontend assets.
COPY --from=build /src/build/nautd        /app/nautd
COPY --from=build /src/build/nautctl      /usr/local/bin/nautctl
COPY --from=build /src/build/naut_webui.so /app/naut_webui.so
COPY --from=build /src/web/torrent-ui/public /app/web/torrent-ui/public

# nautd links the two submodule engines as shared libraries; ship them and
# refresh the loader cache so the SONAMEs resolve at runtime.
COPY --from=build /src/build/torrent-peer/libtorrentpeer.so       /usr/local/lib/
COPY --from=build /src/build/torrent-tracker/libtorrenttracker.so /usr/local/lib/
RUN ldconfig

# Defaults — override any of these at `docker run` time with -e.
ENV NAUT_WEBUI_HOST=0.0.0.0 \
    NAUT_WEBUI_PORT=8080 \
    NAUT_WEBUI_ROOT=/app/web/torrent-ui/public \
    NAUT_WEBUI_DB=/data/webui.db \
    NAUT_WEBUI_SAVE_PATH=/downloads \
    NAUT_STATE_DIR=/data/state \
    NAUT_SOCKET=/run/naut/nautd.sock
#   NAUT_AUTH_USER=admin            # default
#   NAUT_AUTH_PASSWORD=...          # generated + printed to the log if unset
#   NAUT_SESSION_TTL=604800         # login lifetime in seconds (default 7d)

# Create the data/download/socket dirs (if the volume is fresh) then exec the
# daemon with the webui plugin. Built with printf (single-quoted lines keep the
# $VARs literal) so the image stays a single Dockerfile on any builder.
RUN printf '%s\n' \
    '#!/bin/sh' \
    'set -e' \
    'mkdir -p "$NAUT_STATE_DIR" "$NAUT_WEBUI_SAVE_PATH" "$(dirname "$NAUT_WEBUI_DB")" "$(dirname "$NAUT_SOCKET")"' \
    'exec /app/nautd --socket "$NAUT_SOCKET" --plugin /app/naut_webui.so --state-dir "$NAUT_STATE_DIR" "$@"' \
    > /usr/local/bin/entrypoint.sh \
 && chmod +x /usr/local/bin/entrypoint.sh

# Owned by the unprivileged runtime user; bind-mounted volumes must be writable
# by uid 1000.
RUN mkdir -p /data /downloads /run/naut \
 && chown -R naut:naut /app /data /downloads /run/naut

USER naut

VOLUME ["/data", "/downloads"]
EXPOSE 8080 6881 6881/udp

# Liveness: ask the daemon to pong over its control socket (no extra tooling).
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD nautctl --socket "$NAUT_SOCKET" ping || exit 1

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]