FROM crystallang/crystal:1.14.0-alpine AS builder

# Install build dependencies
RUN apk add --no-cache \
    yaml-dev \
    openssl-dev \
    zlib-dev \
    sqlite-dev \
    postgresql-dev \
    git \
    curl

# Set build arguments
ARG APP_NAME=billing-service

WORKDIR /app

# Copy shared source files and directories from parent directory first
COPY src/*.cr src/
COPY src/controller/ src/controller/

# Copy service-specific files
COPY src/billing-service/ src/billing-service/

# Copy and install dependencies
COPY src/billing-service/shard.yml ./
RUN shards install

# Build the binary with standalone flag
RUN crystal build --release --static src/main.cr -o "${APP_NAME}" -D standalone

# Runtime stage
FROM alpine:3.19

# Install runtime dependencies
RUN apk add --no-cache \
    ca-certificates \
    tzdata \
    openssl \
    yaml

WORKDIR /app

# Copy the binary from builder
COPY --from=builder /app/"${APP_NAME}" .

# Create non-root user and set permissions
RUN adduser -D appuser && \
    chown -R appuser:appuser /app && \
    find /app -type f -exec chmod 500 {} \; && \
    find /app -type d -exec chmod 755 {} \; && \
    chmod 550 /app/"${APP_NAME}"

USER appuser

# Set security-related environment variables
ENV PORT=8082
ENV KEMAL_ENV=production
ENV SECURE_PROCESSING=true
ENV PCI_COMPLIANCE=true

# Expose port
EXPOSE 8082

# Use exec form for proper signal handling
ENTRYPOINT ["/app/${APP_NAME}"]