FROM golang:1.26-alpine AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN --mount=type=cache,target=/root/go/pkg/mod go mod download
COPY . .
RUN --mount=type=cache,target=/root/go/pkg/mod CGO_ENABLED=0 go build -o /out/synapse-backupper ./cmd/synapse-backupper

FROM alpine:3.24
RUN apk add --no-cache postgresql18-client ca-certificates && update-ca-certificates
RUN addgroup -S app && adduser -S -G app app
COPY --from=builder --chown=app:app /out/synapse-backupper /usr/local/bin/synapse-backupper
USER app
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s CMD ["synapse-backupper", "healthcheck"]
LABEL maintainer="infra@tswf.io" version="0.1.0" description="Synapse PostgreSQL backup tool with composite dual-KEM encryption"
ENTRYPOINT ["/usr/local/bin/synapse-backupper"]
CMD ["run"]