# Unified multi-stage Rust service builder
# Usage: docker build --build-arg SERVICE=trading_service -f infra/docker/Dockerfile.service .
#
# Optional sccache: pass SCCACHE_BUCKET + credentials to enable S3-backed build cache

# =============================================================================
# Stage 1: Builder
# =============================================================================
FROM rust:1.89-slim-bookworm AS builder

ARG SERVICE
ARG SCCACHE_BUCKET=""
ARG AWS_ACCESS_KEY_ID=""
ARG AWS_SECRET_ACCESS_KEY=""
ARG AWS_DEFAULT_REGION="nl-ams"
ARG SCCACHE_ENDPOINT=""

RUN test -n "${SERVICE}" || (echo "ERROR: SERVICE build-arg is required" && exit 1)

RUN apt-get update && apt-get install -y --no-install-recommends \
    pkg-config \
    libssl-dev \
    protobuf-compiler \
    perl \
    make \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Conditionally install sccache when a bucket is configured
RUN if [ -n "${SCCACHE_BUCKET}" ]; then \
        curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.8.1/sccache-v0.8.1-x86_64-unknown-linux-musl.tar.gz \
        | tar xz --strip-components=1 -C /usr/local/bin sccache-v0.8.1-x86_64-unknown-linux-musl/sccache \
        && chmod +x /usr/local/bin/sccache; \
    fi

# Set sccache env vars conditionally
ENV RUSTC_WRAPPER=${SCCACHE_BUCKET:+/usr/local/bin/sccache}
ENV SCCACHE_BUCKET=${SCCACHE_BUCKET}
ENV SCCACHE_S3_USE_SSL=true
ENV SCCACHE_ENDPOINT=${SCCACHE_ENDPOINT}
ENV AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
ENV AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
ENV AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION}

WORKDIR /build

# Copy workspace manifests first for layer caching
COPY Cargo.toml Cargo.lock ./
COPY .sqlx ./.sqlx

# Copy all workspace crate directories
COPY trading_engine ./trading_engine
COPY risk ./risk
COPY risk-data ./risk-data
COPY trading-data ./trading-data
COPY fxt ./fxt
COPY ml ./ml
COPY ml-data ./ml-data
COPY data ./data
COPY backtesting ./backtesting
COPY adaptive-strategy ./adaptive-strategy
COPY common ./common
COPY storage ./storage
COPY model_loader ./model_loader
COPY market-data ./market-data
COPY database ./database
COPY config ./config
COPY web-gateway ./web-gateway
COPY ctrader-openapi ./ctrader-openapi
COPY foxhunt-deploy ./foxhunt-deploy
COPY services ./services
COPY tests ./tests

ENV SQLX_OFFLINE=true

RUN cargo build --release -p ${SERVICE} \
    && mkdir -p /build/out \
    && cp target/release/${SERVICE} /build/out/ \
    && strip /build/out/${SERVICE}

# Show sccache stats if enabled
RUN if [ -n "${SCCACHE_BUCKET}" ] && command -v sccache >/dev/null 2>&1; then \
        sccache --show-stats; \
    fi

# =============================================================================
# Stage 2: Runtime
# =============================================================================
FROM debian:bookworm-slim AS runtime

RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    libssl3 \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Install grpc_health_probe for Kubernetes health checks
RUN curl -fsSL https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/v0.4.25/grpc_health_probe-linux-amd64 \
    -o /usr/local/bin/grpc_health_probe \
    && chmod +x /usr/local/bin/grpc_health_probe

RUN groupadd -g 1000 foxhunt \
    && useradd -u 1000 -g foxhunt -m -s /bin/false foxhunt

ARG SERVICE
ENV SERVICE=${SERVICE}

WORKDIR /app

COPY --from=builder /build/out/${SERVICE} ./${SERVICE}
RUN chmod +x ./${SERVICE}

USER foxhunt

ENTRYPOINT ["/bin/sh", "-c", "exec /app/${SERVICE}"]