FROM golang:1.24-alpine AS build

WORKDIR /src

# Dependencies first: this layer is reused whenever only source files change.
COPY go.mod go.sum ./
RUN go mod download

COPY . .

ARG VERSION=dev
RUN CGO_ENABLED=0 go build \
      -trimpath \
      -ldflags="-s -w -X main.version=${VERSION}" \
      -o /out/syncbot .


FROM alpine:3.22

LABEL org.opencontainers.image.title="syncbot" \
      org.opencontainers.image.description="Mirrors git repositories from a source to a destination on a timer." \
      org.opencontainers.image.licenses="MIT"

# git and ssh do the actual transfer work; syncbot only orchestrates them.
RUN apk add --no-cache git openssh-client ca-certificates tzdata \
 && adduser -D -H -u 10001 syncbot \
 && mkdir -p /var/lib/syncbot /etc/syncbot \
 && chown -R syncbot:syncbot /var/lib/syncbot

COPY --from=build /out/syncbot /usr/local/bin/syncbot

USER syncbot

# Mount the config read-only at this path, or override it with -config.
ENTRYPOINT ["/usr/local/bin/syncbot"]
CMD ["-config", "/etc/syncbot/config.toml"]