FROM alpine:3.23@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40 AS verified-binaries
COPY binaries/ /binaries/
ARG TARGETARCH
RUN cd /binaries && sha256sum -c checksums.txt && \
    case "$TARGETARCH" in amd64|arm64) ;; *) exit 1 ;; esac && \
    cp "pgpipe-linux-$TARGETARCH" /pgpipe && \
    cp "pgpipe-demo-bootstrap-linux-$TARGETARCH" /pgpipe-demo-bootstrap
FROM verified-binaries AS runtime-download
FROM verified-binaries AS bootstrap-download

FROM postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777 AS database
COPY --chmod=0555 volume-guard.sh database-entrypoint.sh /usr/local/share/pgpipe-quickstart/
COPY --chmod=0555 database-ready.sh /docker-entrypoint-initdb.d/99-ready.sh
ENV PGDATA=/var/lib/postgresql/data/data
ENTRYPOINT ["/usr/local/share/pgpipe-quickstart/database-entrypoint.sh"]
CMD ["postgres"]

FROM database AS source
COPY source.sql /docker-entrypoint-initdb.d/10-source.sql

FROM database AS destination
COPY --from=bootstrap-download --chmod=0555 /pgpipe-demo-bootstrap /usr/local/bin/pgpipe-demo-bootstrap
COPY destination.sql /docker-entrypoint-initdb.d/10-destination.sql
COPY --chmod=0555 destination-bootstrap.sh /docker-entrypoint-initdb.d/20-protected-storage.sh

FROM alpine:3.23@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40 AS config-init
COPY --chmod=0555 volume-guard.sh config-init.sh /setup/
COPY pgpipe.yaml /seed/pgpipe.yaml
ENTRYPOINT ["/setup/config-init.sh"]

# The default image contains no bootstrap helper or destination administrator binding.
FROM alpine:3.23@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40 AS runtime
RUN apk add --no-cache ca-certificates tzdata && \
    addgroup -S -g 10001 pgpipe && \
    adduser -S -D -H -u 10001 -h /var/lib/pgpipe/data -s /sbin/nologin -G pgpipe pgpipe && \
    mkdir -p /etc/pgpipe /var/lib/pgpipe
COPY --from=runtime-download --chmod=0555 /pgpipe /usr/local/bin/pgpipe
LABEL org.opencontainers.image.title="pgpipe" org.opencontainers.image.version="6.0.1"
ENV GOMEMLIMIT=2GiB HOME=/var/lib/pgpipe/data PGPIPE_DEPLOYMENT=container
USER 10001:10001
WORKDIR /var/lib/pgpipe
EXPOSE 8080
HEALTHCHECK --interval=5s --timeout=5s --start-period=20s --retries=12 \
  CMD ["pgpipe", "healthcheck", "--config", "/etc/pgpipe/data/pgpipe.yaml", "--timeout", "3s"]
ENTRYPOINT ["pgpipe"]
CMD ["start", "--config", "/etc/pgpipe/data/pgpipe.yaml"]
