FROM golang:1.26-alpine AS builder
WORKDIR /src
COPY go.mod ./
COPY . .
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" -o /out/paw-toolbox .

FROM alpine:3.24
RUN apk add --no-cache ca-certificates tzdata openssl && addgroup -S paw && adduser -S -G paw paw
WORKDIR /app
COPY --from=builder /out/paw-toolbox /app/paw-toolbox
COPY apps.json /data/apps.json
RUN mkdir -p /data/files && chown -R paw:paw /data
USER paw
ENV ADDR=":8080" \
    SERVER_MODE="http" \
    APPS_JSON="/data/apps.json" \
    DATA_DIR="/data" \
    CLIPBOARD_DATA="/data/clipboard.json" \
    MAX_PER_ROOM="200" \
    CLIPBOARD_PERSIST_SECRETS="false" \
    FILE_MAX_BYTES="268435456" \
    AUTH_USER="" \
    AUTH_PASS=""
EXPOSE 8080 8443
ENTRYPOINT ["/app/paw-toolbox"]