# amd64 leg of the multi-arch standalone image — PACKAGING ONLY (no in-container
# compile). `rustc` SIGSEGVs under QEMU emulation, so we do NOT cross-build amd64
# inside a container on an arm64 host; instead the linux/amd64 binary is the HOST
# cross-compile produced by scripts/build-release.sh (x86_64-unknown-linux-gnu,
# homebrew GCC -> glibc 2.41), packaged here. trixie-slim because that glibc and
# libmvec.so.1 are absent on bookworm. (The arm64 leg builds natively from
# docker/standalone/Dockerfile; scripts/build-standalone-image.sh stitches both
# into one manifest list.)
#
# Build context = a staging dir holding the prebuilt `tidal-server` binary + the
# `config/` dir (the script assembles it); NOT the repo root.
FROM debian:trixie-slim
ARG DEBIAN_FRONTEND=noninteractive

# libstdc++6/libgcc-s1 for the usearch HNSW C++ + aws-lc runtime; ca-certificates
# for TLS; curl for the healthcheck.
RUN apt-get update && apt-get install -y --no-install-recommends \
        libstdc++6 libgcc-s1 ca-certificates curl && \
    rm -rf /var/lib/apt/lists/* && \
    useradd --system --home /srv tidal && \
    mkdir -p /data && chown tidal:tidal /data

COPY tidal-server /usr/local/bin/tidal-server
COPY --chown=tidal:tidal config /etc/tidal-server

ENV TIDAL_CONFIG=/etc/tidal-server
VOLUME ["/data"]
USER tidal
WORKDIR /srv
EXPOSE 9400 9091

HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
    CMD curl -f -H "Authorization: Bearer ${TIDAL_API_KEY:-}" http://localhost:9400/health || exit 1

# Match the in-container standalone Dockerfile: bare-binary ENTRYPOINT + standalone CMD.
ENTRYPOINT ["tidal-server"]
CMD ["standalone", \
    "--listen", "0.0.0.0:9400", \
    "--data-dir", "/data", \
    "--metrics", "0.0.0.0:9091"]