FROM rust:alpine AS builder

RUN apk add --no-cache musl-dev openssl-dev openssl-libs-static pkgconfig

WORKDIR /app
COPY Cargo.* ./
COPY src ./src

RUN cargo build --release

FROM alpine:latest

RUN apk add --no-cache ca-certificates openssl

COPY --from=builder /app/target/release/planbot /usr/local/bin/

# Create non-root user
RUN adduser -D -u 1000 planbot
USER planbot

# Expose metrics port
EXPOSE 9090

ENTRYPOINT ["/usr/local/bin/planbot"]
