FROM golang:1.23-alpine AS builder
WORKDIR /app

# Module downloads go through the homelab caching proxy when CI passes
# PROXY_URL. With the argument unset the value is exactly the public default,
# so a build outside the LAN behaves as it always did.
#
# The separators are `|`, not `,`, and that is load-bearing: with commas the go
# command only falls through on a 404/410, so a proxy that is DOWN fails the
# build with "connect: connection refused". A pipe falls back on any error,
# which is what makes a proxy outage cost time instead of a broken build.
ARG PROXY_URL=
ENV GOPROXY=${PROXY_URL:+$PROXY_URL/go|}https://proxy.golang.org|direct

# Dependencies are pinned in go.mod/go.sum, so the build is reproducible and
# needs no module resolution at image-build time.
COPY go.mod go.sum ./
RUN go mod download

COPY main.go .
# The admin UI is embedded from web/ via //go:embed, so it must exist at build time.
COPY web ./web
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o mildgrim-drop main.go

FROM alpine:3.20
RUN apk add --no-cache ca-certificates mailcap
WORKDIR /app
COPY --from=builder /app/mildgrim-drop /app/mildgrim-drop
EXPOSE 8095
ENTRYPOINT ["/app/mildgrim-drop"]
