FROM rust:alpine AS builder

WORKDIR /usr/src/app

# Install build dependencies including openssl for musl static linking
RUN apk add --no-cache musl-dev pkgconfig openssl-dev openssl-libs-static && \
    rustup target add x86_64-unknown-linux-musl

COPY Cargo.toml Cargo.lock ./
COPY crates ./crates
COPY apps ./apps

# Build with OpenSSL static linking
ENV RUSTFLAGS='-C target-feature=+crt-static'
ENV OPENSSL_STATIC=1
ENV OPENSSL_DIR=/usr
RUN cargo build --release --bin gateway --target x86_64-unknown-linux-musl

FROM alpine:latest AS runtime

RUN apk add --no-cache ca-certificates

RUN adduser -D -u 1000 appuser
WORKDIR /app

COPY --from=builder /usr/src/app/target/x86_64-unknown-linux-musl/release/gateway ./gateway

USER appuser

CMD ["./gateway"]