# mailrust in a container: one static program; data, settings and the key in /data.
#
#   docker build -t mailrust https://mailrust.com/docker/Dockerfile
#   docker run -d --name mailrust -p 127.0.0.1:8420:8420 -v mailrust-data:/data mailrust
#   docker logs mailrust        # prints the first-run link
#
# The build takes the latest release from mailrust.com and checks it before use:
# the release manifest must carry mailrust's signature, the file its checksum.
# Docs: https://mailrust.com/docs/running/docker

FROM alpine:3.20 AS fetch
RUN apk add --no-cache curl jq openssl
RUN set -eu; \
    base=https://mailrust.com/download; \
    printf '%s\n' '-----BEGIN PUBLIC KEY-----' 'MCowBQYDK2VwAyEASM6f7U5ib7CbXklscT1Oh6QB58rLWHZ+juHFTaXuG2w=' '-----END PUBLIC KEY-----' > release.pem; \
    curl -fsSL "$base/latest.json" -o latest.json; \
    curl -fsSL "$base/latest.json.sig" | base64 -d > latest.sig; \
    openssl pkeyutl -verify -pubin -inkey release.pem -rawin -in latest.json -sigfile latest.sig; \
    case "$(uname -m)" in \
        x86_64) target=linux-x86_64 ;; \
        aarch64) target=linux-aarch64 ;; \
        *) echo "mailrust is built for x86_64 and aarch64, this machine is $(uname -m)"; exit 1 ;; \
    esac; \
    url=$(jq -r --arg t "$target" '.files[] | select(.target == $t) | .url' latest.json); \
    [ -n "$url" ] || { echo "the latest release has no $target build yet"; exit 1; }; \
    sum=$(jq -r --arg t "$target" '.files[] | select(.target == $t) | .sha256' latest.json); \
    curl -fsSL "$url" -o mailrust.gz; \
    echo "$sum  mailrust.gz" | sha256sum -c -; \
    gunzip mailrust.gz; \
    chmod 755 mailrust; \
    ./mailrust version

FROM alpine:3.20
RUN apk add --no-cache ca-certificates tzdata \
    && adduser -D -H -u 10001 -s /sbin/nologin mailrust \
    && install -d -o mailrust -g mailrust -m 750 /data
COPY --from=fetch /mailrust /usr/local/bin/mailrust
USER mailrust
# Behind a reverse proxy: 8420. With HTTPS by itself (MAILRUST_DOMAIN):
# 8443 and 8080 inside, published as 443 and 80: no root needed.
ENV MAILRUST_DATA_DIR=/data \
    MAILRUST_LISTEN=0.0.0.0:8420 \
    MAILRUST_HTTPS_LISTEN=[::]:8443 \
    MAILRUST_HTTP_LISTEN=[::]:8080
VOLUME /data
EXPOSE 8420 8443 8080
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s CMD nc -z 127.0.0.1 8420 || nc -z 127.0.0.1 8443
ENTRYPOINT ["/usr/local/bin/mailrust"]