FROM golang:1.24-alpine AS build

WORKDIR /src
COPY go.mod go.sum* ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/tapm-server ./cmd/server \
    && CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/tapm-migrate ./cmd/migrate

FROM alpine:3.22

RUN apk add --no-cache ca-certificates \
    && addgroup -S tapm \
    && adduser -S -G tapm -H tapm
WORKDIR /app
COPY --from=build /out/tapm-server /usr/local/bin/tapm-server
COPY --from=build /out/tapm-migrate /usr/local/bin/tapm-migrate
COPY migrations /app/migrations
USER tapm
EXPOSE 8080
ENTRYPOINT ["/usr/local/bin/tapm-server"]