# syntax=docker/dockerfile:1.7
#
# Image for the Maestro registry.
#
# NAP-245 retired the per-binary crates: the registry now ships as the
# `registry` subcommand of the unified `maestro` binary. This image builds that
# binary with only the `registry` feature enabled (no cli/daemon/tui), so it
# stays small and pulls only maestro-registry + protocol + config.
#
# Build:  docker build -t maestro-registry .
# Run:    docker run --rm -p 8080:8080 -e MAESTRO_TOKEN=<secret> maestro-registry
#
# On Dokploy: point at this Dockerfile, expose port 8080 (or whatever you
# set MAESTRO_REGISTRY_BIND_ADDR to), and set MAESTRO_TOKEN as a secret env.
# No persistent volume is required when MAESTRO_TOKEN is provided.

FROM rust:1-bookworm AS builder
WORKDIR /build
COPY . .
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/build/target \
    cargo build --release -p maestro --no-default-features --features registry \
 && cp /build/target/release/maestro /maestro-registry

FROM debian:bookworm-slim
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates \
 && rm -rf /var/lib/apt/lists/*
COPY --from=builder /maestro-registry /usr/local/bin/maestro-registry

# Default to all-interfaces so Dokploy / Traefik can reach the service.
# Override via env on the platform.
ENV MAESTRO_REGISTRY_BIND_ADDR=0.0.0.0:8080
EXPOSE 8080

# The on-disk binary is the unified `maestro`; run its `registry` subcommand.
ENTRYPOINT ["/usr/local/bin/maestro-registry", "registry"]