ARG BUILDER_IMAGE=rust:1-bookworm
ARG RUNTIME_IMAGE=debian:bookworm-slim

FROM --platform=$BUILDPLATFORM ${BUILDER_IMAGE} AS builder

ARG BUILDARCH
ARG TARGETARCH
ARG TARGETPLATFORM

WORKDIR /src

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
      build-essential \
      ca-certificates \
      clang \
      cmake \
      git \
      libclang-dev \
      make \
      perl \
      pkg-config \
      python3 \
    && if [ "$TARGETARCH" != "$BUILDARCH" ]; then \
         case "$TARGETARCH" in \
           arm64) \
             apt-get install -y --no-install-recommends \
               g++-aarch64-linux-gnu \
               gcc-aarch64-linux-gnu \
               libc6-dev-arm64-cross \
             ;; \
           amd64) \
             apt-get install -y --no-install-recommends \
               g++-x86-64-linux-gnu \
               gcc-x86-64-linux-gnu \
               libc6-dev-amd64-cross \
             ;; \
           *) \
             echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 2 \
             ;; \
         esac; \
       fi \
    && rm -rf /var/lib/apt/lists/* \
    && case "$TARGETARCH" in \
         amd64|arm64) ;; \
         *) echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 2 ;; \
       esac

COPY . .

RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    --mount=type=cache,target=/src/target \
    set -eux; \
    case "$TARGETARCH" in \
      amd64) target_triple=x86_64-unknown-linux-gnu ;; \
      arm64) target_triple=aarch64-unknown-linux-gnu ;; \
      *) echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 2 ;; \
    esac; \
    rustup target add "$target_triple"; \
    if [ "$TARGETARCH" != "$BUILDARCH" ]; then \
      case "$TARGETARCH" in \
        arm64) \
          export \
            CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc \
            CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc \
            CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++ \
            AR_aarch64_unknown_linux_gnu=aarch64-linux-gnu-ar \
            PKG_CONFIG_ALLOW_CROSS=1 \
          ;; \
        amd64) \
          export \
            CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=x86_64-linux-gnu-gcc \
            CC_x86_64_unknown_linux_gnu=x86_64-linux-gnu-gcc \
            CXX_x86_64_unknown_linux_gnu=x86_64-linux-gnu-g++ \
            AR_x86_64_unknown_linux_gnu=x86_64-linux-gnu-ar \
            PKG_CONFIG_ALLOW_CROSS=1 \
          ;; \
        *) \
          echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 2 \
          ;; \
      esac; \
    fi; \
    cargo build --release --target "$target_triple" --bin rpki_artifact_metrics; \
    mkdir -p /build-out/bin; \
    cp "target/$target_triple/release/rpki_artifact_metrics" /build-out/bin/

FROM --platform=$TARGETPLATFORM ${RUNTIME_IMAGE} AS rpki-client-builder

ARG RPKI_CLIENT_VERSION=9.8
ARG RPKI_CLIENT_SHA256=42920aac5afd0996173fb9f7848691a2c49dd234e4f10478808c1aa475620861

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
      build-essential \
      ca-certificates \
      curl \
      libexpat1-dev \
      libssl-dev \
      libtls-dev \
      pkg-config \
      rsync \
      zlib1g-dev \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --system --no-create-home --shell /usr/sbin/nologin _rpki-client

RUN set -eux; \
    curl -fsSL "https://ftp.openbsd.org/pub/OpenBSD/rpki-client/rpki-client-${RPKI_CLIENT_VERSION}.tar.gz" -o /tmp/rpki-client.tar.gz; \
    echo "${RPKI_CLIENT_SHA256}  /tmp/rpki-client.tar.gz" | sha256sum -c -; \
    tar -xzf /tmp/rpki-client.tar.gz -C /tmp; \
    cd "/tmp/rpki-client-${RPKI_CLIENT_VERSION}"; \
    ./configure --prefix=/opt/rpki-client; \
    make -j"$(nproc)"; \
    make install; \
    /opt/rpki-client/sbin/rpki-client -V

FROM --platform=$TARGETPLATFORM ${RUNTIME_IMAGE} AS runtime

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
      ca-certificates \
      libexpat1 \
      libssl3 \
      libtls26 \
      tzdata \
      zlib1g \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --system --no-create-home --shell /usr/sbin/nologin _rpki-client \
    && mkdir -p /opt/rpki-client/var/cache/rpki-client

WORKDIR /opt/ours-rp

COPY --from=builder /build-out/bin/ /opt/ours-rp/bin/
COPY --from=rpki-client-builder /opt/rpki-client/ /opt/rpki-client/
COPY --from=rpki-client-builder /opt/rpki-client/sbin/rpki-client /opt/ours-rp/bin/rpki-client

ARG SOURCE_COMMIT=unknown
ARG SOURCE_DIRTY=unknown
ARG BUILD_TIMESTAMP_UTC=unknown
ARG RPKI_CLIENT_VERSION=9.8

LABEL org.opencontainers.image.title="ours-rp-metrics" \
      org.opencontainers.image.description="Ours RP artifact metrics image for multi-arch Docker Compose deployment" \
      org.opencontainers.image.revision="${SOURCE_COMMIT}" \
      org.opencontainers.image.created="${BUILD_TIMESTAMP_UTC}" \
      org.opencontainers.image.source-dirty="${SOURCE_DIRTY}" \
      org.opencontainers.image.rpki-client.version="${RPKI_CLIENT_VERSION}"

RUN chmod +x /opt/ours-rp/bin/* \
    && mkdir -p /var/lib/ours-rp/state /var/lib/ours-rp/runs /var/lib/ours-rp/logs

ENV RUN_ROOT=/var/lib/ours-rp \
    BIN_DIR=/opt/ours-rp/bin \
    RUST_BACKTRACE=1

VOLUME ["/var/lib/ours-rp"]