FROM golang:1.23-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/flex-auth ./cmd/flex-auth

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/flex-auth /usr/local/bin/flex-auth
COPY examples /opt/flex-auth/examples
EXPOSE 8080
ENTRYPOINT ["/usr/local/bin/flex-auth"]
CMD ["serve", "--addr", "0.0.0.0:8080", "--registry", "/opt/flex-auth/examples/tenant-engine/registry_snapshot.json", "--policy", "/opt/flex-auth/examples/tenant-engine/policy_package.md"]