# syntax=docker/dockerfile:1
# Packages the binaries deploy/build.sh already built (dist/bin/linux_<arch>/blacktip),
# so the arm64 image needs no emulation. Build it with:  sh deploy/build.sh && docker buildx build .
#
# Blacktip opens ports on the machine's own IP addresses, so run it with host
# networking (see deploy/docker-compose.yml). It runs as root in the container so it
# can bind ports below 1024 such as 80 and 443.
FROM --platform=$BUILDPLATFORM alpine:3.22 AS prep
RUN apk add --no-cache ca-certificates \
 && mkdir /data

FROM scratch
ARG TARGETARCH
LABEL org.opencontainers.image.title="Blacktip" \
      org.opencontainers.image.description="Edge: public ports, WireGuard tunnels, logins and mail egress" \
      org.opencontainers.image.source="https://git.veillax.com/Veillax/blacktip" \
      org.opencontainers.image.licenses="AGPL-3.0-only"
COPY --from=prep /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=prep /data /data
COPY dist/bin/linux_${TARGETARCH}/blacktip /blacktip
COPY dist/bin/linux_${TARGETARCH}/traefik /traefik
# Traefik serves http/https; set BLACKTIP_TRAEFIK= (empty) in .env to use the built-in proxy instead
ENV BLACKTIP_DATA=/data BLACKTIP_TRAEFIK=/traefik
VOLUME ["/data"]
EXPOSE 51820/udp
ENTRYPOINT ["/blacktip"]