FROM --platform=$BUILDPLATFORM alpine:3.23@sha256:85fe1e81d6758c208f3e1eed4338a1997e19d4be002d4dd32d3100c9a8c010a0 AS downloader
RUN apk add --no-cache ca-certificates curl
COPY artifacts.sha256 download.sh /download/
ARG TARGETARCH
ARG PGPIPE_DOWNLOAD_BASE=https://www.pghorizon.com/downloads/pgpipe/v7.0.0
ENV PGPIPE_DOWNLOAD_BASE=$PGPIPE_DOWNLOAD_BASE

FROM downloader AS runtime-download
RUN --mount=type=cache,id=pgpipe-v7.0.0-runtime-${TARGETARCH},target=/download-cache,sharing=locked \
    --mount=type=secret,id=download_ca \
    sh /download/download.sh pgpipe "$TARGETARCH" /pgpipe

FROM downloader AS bootstrap-download
RUN --mount=type=cache,id=pgpipe-v7.0.0-bootstrap-${TARGETARCH},target=/download-cache,sharing=locked \
    --mount=type=secret,id=download_ca \
    sh /download/download.sh pgpipe-demo-bootstrap "$TARGETARCH" /pgpipe-demo-bootstrap

FROM postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777 AS database
COPY --chmod=0555 volume-guard.sh database-entrypoint.sh /usr/local/share/pgpipe-quickstart/
COPY --chmod=0555 database-ready.sh /docker-entrypoint-initdb.d/99-ready.sh
ENV PGDATA=/var/lib/postgresql/data/data
ENTRYPOINT ["/usr/local/share/pgpipe-quickstart/database-entrypoint.sh"]
CMD ["postgres"]

FROM database AS source
COPY source.sql /docker-entrypoint-initdb.d/10-source.sql

FROM database AS destination
COPY --chown=root:root --chmod=0644 THIRD_PARTY_LICENSES.txt /usr/share/doc/pgpipe/THIRD_PARTY_LICENSES.txt
RUN test -s /usr/share/doc/pgpipe/THIRD_PARTY_LICENSES.txt && \
    install -d -m 0755 -o root -g root /usr/share/doc/pgpipe
COPY --from=bootstrap-download --chmod=0555 /pgpipe-demo-bootstrap /usr/local/bin/pgpipe-demo-bootstrap
COPY destination.sql /docker-entrypoint-initdb.d/10-destination.sql
COPY --chmod=0555 destination-bootstrap.sh /docker-entrypoint-initdb.d/20-protected-storage.sh

FROM alpine:3.23@sha256:85fe1e81d6758c208f3e1eed4338a1997e19d4be002d4dd32d3100c9a8c010a0 AS config-init
COPY --chmod=0555 volume-guard.sh config-init.sh /setup/
COPY pgpipe.yaml /seed/pgpipe.yaml
ENTRYPOINT ["/setup/config-init.sh"]

# The default image contains no bootstrap helper or destination administrator binding.
FROM alpine:3.23@sha256:85fe1e81d6758c208f3e1eed4338a1997e19d4be002d4dd32d3100c9a8c010a0 AS runtime
COPY --chown=root:root --chmod=0644 THIRD_PARTY_LICENSES.txt /usr/share/doc/pgpipe/THIRD_PARTY_LICENSES.txt
RUN test -s /usr/share/doc/pgpipe/THIRD_PARTY_LICENSES.txt && \
    install -d -m 0755 -o root -g root /usr/share/doc/pgpipe && \
    apk add --no-cache ca-certificates tzdata && \
    addgroup -S -g 10001 pgpipe && \
    adduser -S -D -H -u 10001 -h /var/lib/pgpipe/data -s /sbin/nologin -G pgpipe pgpipe && \
    mkdir -p /etc/pgpipe /var/lib/pgpipe
COPY --from=runtime-download --chmod=0555 /pgpipe /usr/local/bin/pgpipe
LABEL org.opencontainers.image.title="pgpipe" org.opencontainers.image.version="7.0.0" \
      org.opencontainers.image.licenses="LicenseRef-Proprietary"
ENV GOMEMLIMIT=2GiB HOME=/var/lib/pgpipe/data PGPIPE_DEPLOYMENT=container
USER 10001:10001
WORKDIR /var/lib/pgpipe
EXPOSE 8080
HEALTHCHECK --interval=5s --timeout=5s --start-period=20s --retries=12 \
  CMD ["pgpipe", "healthcheck", "--config", "/etc/pgpipe/data/pgpipe.yaml", "--timeout", "3s"]
ENTRYPOINT ["pgpipe"]
CMD ["start", "--config", "/etc/pgpipe/data/pgpipe.yaml"]