Dockerfile.proxy

# Build stage
FROM golang:1.24-alpine AS builder

# Install git and ca-certificates (needed for HTTPS)
RUN apk add --no-cache git ca-certificates tzdata

# Set working directory
WORKDIR /app

# Copy go mod files first for better caching
COPY go.mod go.sum ./
RUN go mod download

# Copy source code
COPY . .

# Build the binary
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
    -ldflags='-w -s -extldflags "-static"' \
    -o /contextforge-proxy \
    ./cmd/proxy

# Final stage
FROM alpine:3.21

# Add non-root user
RUN adduser -D -u 65532 -g "" nonroot

# Install ca-certificates for HTTPS support
RUN apk add --no-cache ca-certificates

# Copy binary from builder
COPY --from=builder /contextforge-proxy /contextforge-proxy

# Copy timezone data
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo

# Set ownership
RUN chown nonroot:nonroot /contextforge-proxy

# Use non-root user
USER nonroot

# Expose ports
EXPOSE 9090 9091

# Health check
HEALTHCHECK --interval=10s --timeout=3s --start-period=5s --retries=3 \
    CMD wget --no-verbose --tries=1 --spider http://localhost:9090/healthz || exit 1

# Run the binary
ENTRYPOINT ["/contextforge-proxy"]