# Foxhunt Broker Gateway Service - Production Build
# Multi-stage build with cargo-chef for dependency caching
# GLIBC 2.35 (Ubuntu 22.04), no CUDA required (CPU-only service)
# Optimized for BuildKit layer caching

# ============================================================================
# Stage 1: Builder Dependencies - Build dependencies in cached layer
# ============================================================================
FROM rust:1.89-slim AS builder-deps

# Install system dependencies (protobuf, SSL, build tools)
RUN apt-get update && apt-get install -y \
    curl \
    git \
    build-essential \
    pkg-config \
    libssl-dev \
    ca-certificates \
    protobuf-compiler \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy workspace manifests first for dependency caching
COPY Cargo.toml Cargo.lock ./

# Copy sqlx offline cache for compile-time query verification
COPY .sqlx ./.sqlx

# Copy all workspace members (needed for workspace resolution)
COPY trading_engine ./trading_engine
COPY risk ./risk
COPY risk-data ./risk-data
COPY trading-data ./trading-data
COPY fxt ./fxt
COPY ml ./ml
COPY ml-data ./ml-data
COPY data ./data
COPY backtesting ./backtesting
COPY adaptive-strategy ./adaptive-strategy
COPY common ./common
COPY storage ./storage
COPY model_loader ./model_loader
COPY market-data ./market-data
COPY database ./database
COPY config ./config
COPY web-gateway ./web-gateway
COPY ctrader-openapi ./ctrader-openapi
COPY services/backtesting_service ./services/backtesting_service
COPY services/broker_gateway_service ./services/broker_gateway_service
COPY services/trading_service ./services/trading_service
COPY services/ml_training_service ./services/ml_training_service
COPY services/data_acquisition_service ./services/data_acquisition_service
COPY services/trading_agent_service ./services/trading_agent_service
COPY services/api_gateway ./services/api_gateway
COPY services/load_tests ./services/load_tests
COPY services/stress_tests ./services/stress_tests
COPY services/integration_tests ./services/integration_tests
COPY tests ./tests

# Enable sqlx offline mode to use cached query metadata
ENV SQLX_OFFLINE=true

# Build dependencies (this layer is cached unless dependencies change)
# Use BuildKit cache mount for cargo registry
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    cargo build -p broker_gateway_service --release --lib

# ============================================================================
# Stage 2: Builder Application - Build broker_gateway_service binary
# ============================================================================
FROM builder-deps AS builder

# Copy entire workspace
COPY . .

# Set SQLX offline mode (no database connection during build)
ENV SQLX_OFFLINE=true

# Build broker_gateway_service binary
# Use BuildKit cache mount for cargo registry and target directory
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    --mount=type=cache,target=/app/target \
    cargo build -p broker_gateway_service --release && \
    # Copy binary out of cached target directory to persistent location
    mkdir -p /app/binaries && \
    cp /app/target/release/broker_gateway_service /app/binaries/

# Verify binary exists and strip debug symbols to reduce size
RUN ls -lh /app/binaries/broker_gateway_service && \
    strip /app/binaries/broker_gateway_service && \
    ls -lh /app/binaries/broker_gateway_service

# ============================================================================
# Stage 3: Runtime - Minimal production image (Ubuntu 22.04)
# ============================================================================
FROM ubuntu:22.04 AS runtime

# Install minimal runtime dependencies
RUN apt-get update && apt-get install -y \
    ca-certificates \
    libssl3 \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Download and install grpc_health_probe for Kubernetes health checks
RUN curl -sSL https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/v0.4.25/grpc_health_probe-linux-amd64 \
    -o /usr/local/bin/grpc_health_probe && \
    chmod +x /usr/local/bin/grpc_health_probe

# Create non-root user for security (uid 1000 matches development environment)
RUN groupadd --system --gid 1000 foxhunt && \
    useradd --system --uid 1000 --gid foxhunt --shell /bin/bash foxhunt

# Create application directories with proper permissions
RUN mkdir -p /app/config /app/logs /app/data && \
    chown -R foxhunt:foxhunt /app

# Set working directory
WORKDIR /app

# Copy broker_gateway_service binary from builder stage
COPY --from=builder /app/binaries/broker_gateway_service /usr/local/bin/broker_gateway_service

# Set executable permissions
RUN chmod +x /usr/local/bin/broker_gateway_service

# Verify GLIBC version (Ubuntu 22.04 = GLIBC 2.35)
RUN ldd --version

# Change ownership to non-root user
RUN chown foxhunt:foxhunt /usr/local/bin/broker_gateway_service

# Switch to non-root user
USER foxhunt

# Expose ports
# 50056: gRPC service port
# 8086: Health check HTTP endpoint
# 9096: Prometheus metrics endpoint
EXPOSE 50056 8086 9096

# Health check using grpc_health_probe (Kubernetes will use this)
HEALTHCHECK --interval=10s --timeout=5s --start-period=30s --retries=3 \
    CMD /usr/local/bin/grpc_health_probe -addr=localhost:50056 || exit 1

# Metadata labels
ARG GIT_COMMIT=unknown
ARG BUILD_DATE=unknown
ARG VERSION=0.1.0

LABEL org.opencontainers.image.title="Foxhunt Broker Gateway Service" \
      org.opencontainers.image.description="FIX order routing to AMP Futures (CQG)" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.vendor="Foxhunt HFT Trading System" \
      org.opencontainers.image.revision="${GIT_COMMIT}" \
      foxhunt.service.name="broker_gateway_service" \
      foxhunt.service.port="50056" \
      foxhunt.glibc.version="2.35"

# Default command: Run broker_gateway_service
CMD ["/usr/local/bin/broker_gateway_service"]