FROM golang:1.26-alpine AS build

WORKDIR /src

# Dependencies first, so edits to the app don't re-download the module cache.
# There are none, but the layer keeps the shape of the other apps.
COPY go.mod ./
RUN go mod download

COPY . .

# Static binary: no libc, so it runs in a scratch image. The timezone database
# is embedded by the `time/tzdata` import in main.go.
RUN CGO_ENABLED=0 GOOS=linux go build \
        -trimpath \
        -ldflags="-s -w" \
        -o /out/fit ./cmd/server


FROM scratch

COPY --from=build /out/fit /fit

# nobody:nogroup — the only writable path is the mounted volume at /data.
USER 65534:65534

EXPOSE 8080
ENTRYPOINT ["/fit"]