# Images for the downloadable self-hosted package.
#
# The package carries binaries that are already built, so this file only wraps
# them. The repository's own deploy/Dockerfile compiles from source and is what
# CI and production use; this one exists because the public download must work
# on a machine that has Docker and nothing else — no Go toolchain, no checkout,
# no access to a registry beyond Alpine's base image.
ARG ALPINE_IMAGE=alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b

FROM ${ALPINE_IMAGE} AS server
RUN apk add --no-cache ca-certificates wget
# prialo-license rides along so an operator can `inspect` the licence file on
# the host that runs it, with the exact key set this build trusts.
COPY bin/prialo-server bin/prialo-license /usr/local/bin/
EXPOSE 50051 3478/udp 8080
ENTRYPOINT ["prialo-server"]

FROM ${ALPINE_IMAGE} AS relay
RUN apk add --no-cache ca-certificates
# Created here, owned by the unprivileged user the relay runs as: Docker seeds
# a new named volume from the image path, so without this the volume would
# arrive root-owned and the relay could not write this month's usage.
RUN mkdir -p /var/lib/prialo-relay && chown 65534:65534 /var/lib/prialo-relay
COPY bin/prialo-relay /usr/local/bin/
EXPOSE 4430
ENTRYPOINT ["prialo-relay"]
