# cognitive-fabric PWA static server image. Build context = deploy/dist (the output of `node deploy/build-dist.mjs`) plus the
# files named below, so the image contains exactly the verified dist and nothing else. See deploy/container/build-image.sh.
#
# Not in the image on purpose: the 5 GB / 1.2 GB LLM files (self-hosted mirror lives on the host, see README).
FROM docker.io/library/caddy:2.10-alpine

LABEL org.opencontainers.image.title="cognitive-fabric-pwa" \
      org.opencontainers.image.description="Static server for the cognitive-fabric PWA (Caddy, no application logic)"

# Which CSP the pod sends: cfp_csp_selfhosted (models from /mirror/ on this origin) or cfp_csp_external (official model hosts).
ENV CFP_CSP_SNIPPET=cfp_csp_selfhosted

COPY container/Caddyfile /etc/caddy/Caddyfile
COPY caddy/cfp-headers.caddy /etc/caddy/cfp-headers.caddy
COPY dist/memory-models /srv/memory-models
COPY dist/site /srv/site

# The stock binary carries cap_net_bind_service; we listen on 8080 and drop ALL capabilities in the pod, which makes exec of a
# file-capability binary fail ("operation not permitted"). Found by running the image locally under the pod's securityContext.
RUN setcap -r /usr/bin/caddy

# Fail the image build, not the first request, if the config is wrong.
RUN caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile

EXPOSE 8080
USER 65532:65532
