Dockerfile

# Use Debian-based Golang image for building
FROM golang:bookworm AS builder

# Install git and set working directory
RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Build determinism and cache paths
RUN go env -w GOCACHE=/go-cache
RUN go env -w GOMODCACHE=/gomod-cache

# Copy local source code
COPY . .

# Pre-download modules so Go can populate go.sum entries for the new nostr module.
RUN --mount=type=cache,target=/gomod-cache --mount=type=cache,target=/go-cache \
    go mod download

# Build the app; VERSION stamps the version the relay reports over NIP-11
ARG VERSION=dev
RUN --mount=type=cache,target=/gomod-cache --mount=type=cache,target=/go-cache \
    go build -a -tags netgo -ldflags "-w -s -extldflags \"-static\" -X main.buildVersion=${VERSION}" -o sanctum .

# Final Alpine image (keeps latest tag intentionally)
FROM alpine:latest

ENV IMPORT_FLAG=false

# Add non-root user specification
RUN adduser -D -g '' nonroot

WORKDIR /app

# Copy Go application
COPY --from=builder /app/sanctum .

# Ensure the main executable has the correct permissions
RUN chmod +x /app/sanctum

# Copy the httml templates
COPY --from=builder /app/templates /app/templates

# Copy the entrypoint script
COPY entrypoint.sh /entrypoint.sh

# Ensure the entrypoint script has the correct permissions
RUN chmod +x /entrypoint.sh

# Set the entrypoint
ENTRYPOINT ["/entrypoint.sh"]

# Switch to non-root user
USER nonroot

# Expose port
EXPOSE 3355