# syntax=docker/dockerfile:1
#
# Single image, all six daemons. docker-compose runs one container per daemon
# off this image with a different command — the native-lib + toolchain surface
# is shared, so separate images would duplicate ~all of it. Isolation still
# holds: each daemon is its own container/namespace, only mavend mounts the key
# and the db volume.
#
# Native deps are the prebuilt artifacts the repo already carries under deps/
# (libwhisper+ggml-vulkan, onnxruntime, piper/espeak). We do NOT build
# whisper.cpp from source here — COPY the prebuilt .so and headers.
# ponytail: prebuilt-lib copy, not a from-source build. Add a whisper.cpp build
# stage if you ever need reproducibility / a different arch than the host libs.

# trixie, not bookworm: the prebuilt deps/lib/*.so are linked against
# glibc 2.38 + GLIBCXX 3.4.32 (built on the Arch host). bookworm's glibc 2.36
# is too old and the link fails on missing symbols. trixie ships glibc 2.40.
# 1.24 (not 1.23) because golang trixie images start at 1.24; go 1.24 builds the
# `go 1.23` module fine (the directive is a minimum).
FROM golang:1.24-trixie AS build
WORKDIR /src

# libvulkan-dev: libggml-vulkan.so needs libvulkan.so.1 at link time.
RUN apt-get update && apt-get install -y --no-install-recommends libvulkan-dev \
    && rm -rf /var/lib/apt/lists/*

# native build inputs (prebuilt libs + headers), then module cache, then source
COPY deps/lib/ /src/deps/lib/
COPY deps/piper/ /src/deps/piper/
COPY deps/include/ /src/deps/include/
COPY deps/whisper.cpp/ggml/include/ /src/deps/whisper.cpp/ggml/include/
COPY go.mod go.sum ./
RUN go mod download
COPY cmd/ ./cmd/
COPY internal/ ./internal/

# CGO wiring mirrors the Makefile; rpath points at the RUNTIME lib location so
# the binaries find their .so at /opt/maven/lib regardless of LD_LIBRARY_PATH.
ENV CGO_ENABLED=1 \
    CGO_CFLAGS="-I/src/deps/include -I/src/deps/whisper.cpp/ggml/include" \
    CGO_LDFLAGS="-L/src/deps/lib -L/src/deps/piper -Wl,-rpath,/opt/maven/lib"
RUN go build -o /out/mavend    ./cmd/mavend    && \
    go build -o /out/mavsttd   ./cmd/mavsttd   && \
    go build -o /out/mavttsd   ./cmd/mavttsd   && \
    go build -o /out/mavweb    ./cmd/mavweb    && \
    go build -o /out/mavpoll   ./cmd/mavpoll   && \
    go build -o /out/mavcaldav ./cmd/mavcaldav && \
    go build -o /out/mavwaked  ./cmd/mavwaked

FROM debian:trixie-slim AS runtime
# tzdata so the TZ env (set in compose) resolves — otherwise Go can't load the
# zone and time.Now() stays UTC, and mavend answers clock/date queries and
# evaluates quiet-hours in UTC.
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates libvulkan1 mesa-vulkan-drivers libgomp1 tzdata alsa-utils && \
    rm -rf /var/lib/apt/lists/*

# runtime native libs: whisper/ggml (incl. vulkan) are real files in deps/lib.
COPY deps/lib/   /opt/maven/lib/
COPY deps/piper/ /opt/maven/piper/
# The router embedder needs onnxruntime 1.26, but deps/lib only carries dangling
# symlinks to it (they point at an absolute HOST path that isn't in the image).
# Ship the real 1.26 lib and repoint the symlinks. Piper keeps its OWN
# onnxruntime 1.14 under /opt/maven/piper (found via piper's $ORIGIN runpath +
# its exact soname libonnxruntime.so.1.14.1) — do NOT copy piper's .so into
# /opt/maven/lib, that clobbers 1.26 and mavend dies with "ORT API base: 2".
COPY deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so.1.26.0 /opt/maven/lib/
RUN cd /opt/maven/lib \
    && ln -sf libonnxruntime.so.1.26.0 libonnxruntime.so \
    && ln -sf libonnxruntime.so.1.26.0 libonnxruntime.so.1
COPY --from=build /out/ /opt/maven/bin/

ENV LD_LIBRARY_PATH=/opt/maven/lib PATH=/opt/maven/bin:$PATH

# unprivileged; core owns the key + db, modules own nothing.
RUN useradd -r -u 10001 -m maven \
    && mkdir -p /run/maven /var/lib/maven \
    && chown maven:maven /run/maven /var/lib/maven
USER maven
WORKDIR /opt/maven