# Mode 2 — node as a container. Builds the standard kit (default features).
# Does not provision secrets, tokens, or WireGuard private keys.
#
# Build context: a directory holding the hatchery checkout as `hatchery/`; every
# dependency resolves from crates.io. `deploy/node/docker-build.sh` stages it
# (it excludes target/ and .git).
#
# ./crates/hatchery-node/deploy/node/docker-build.sh
#
# Provider CLIs are not installed unless you pass
# --build-arg INSTALL_PROVIDER_CLIS=1 --build-arg PROVIDER_CLI_INSTALL='...'
# The service unit (mode 1) does not install them.
FROM rust:alpine AS build
RUN apk add --no-cache musl-dev pkgconf openssl-dev openssl-libs-static sqlite-dev sqlite-static perl make cmake clang git linux-headers
ENV OPENSSL_STATIC=1 PKG_CONFIG_ALL_STATIC=1
WORKDIR /src
COPY hatchery /src/hatchery
WORKDIR /src/hatchery
RUN cargo build --locked --release -p hatchery-node
FROM alpine:3
RUN apk add --no-cache ca-certificates iproute2 wireguard-tools bash curl
COPY --from=build /src/hatchery/target/release/gate4agent-node /usr/local/bin/gate4agent-node
COPY hatchery/crates/hatchery-node/deploy/node/install-provider-clis.sh /usr/local/sbin/install-provider-clis
COPY hatchery/crates/hatchery-node/deploy/node/gate4agent-node.service /etc/systemd/system/gate4agent-node.service
ARG INSTALL_PROVIDER_CLIS=0
ARG PROVIDER_CLI_INSTALL=
RUN chmod 0755 /usr/local/sbin/install-provider-clis \
&& INSTALL_PROVIDER_CLIS="$INSTALL_PROVIDER_CLIS" PROVIDER_CLI_INSTALL="$PROVIDER_CLI_INSTALL" /usr/local/sbin/install-provider-clis
# No ENV token, no COPY of a key. The process reads those from the operator at runtime.
ENTRYPOINT ["gate4agent-node"]