FROM golang:1.23-alpine AS builder
WORKDIR /app
COPY src/go.mod src/go.sum ./
RUN go mod download
COPY src/ .
# Build every command, not only the issuer. The migration and validation
# binaries are how an operator prepares and checks a cutover, and needing a Go
# toolchain on the host to run them defeats shipping an image at all
# (KEY-WP-0026).
RUN CGO_ENABLED=0 go build -o /out/keycape             ./cmd/keycape && \
    CGO_ENABLED=0 go build -o /out/validator           ./cmd/validator && \
    CGO_ENABLED=0 go build -o /out/lldap-export        ./cmd/lldap-export && \
    CGO_ENABLED=0 go build -o /out/keycape-to-keycloak ./cmd/keycape-to-keycloak && \
    CGO_ENABLED=0 go build -o /out/lldap-to-ldap       ./cmd/lldap-to-ldap

FROM gcr.io/distroless/static-debian12
COPY --from=builder /out/ /
EXPOSE 8080
# The issuer stays the default. The other binaries are reachable by overriding
# the entrypoint, e.g. --entrypoint /lldap-export.
ENTRYPOINT ["/keycape"]