FROM golang:1.26-alpine AS builder

WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY cmd ./cmd
COPY internal ./internal
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/notion-manager ./cmd/notion-manager

FROM alpine:3.22

COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
RUN addgroup -g 1000 app \
    && adduser -D -u 1000 -G app app

WORKDIR /app
COPY --from=builder --chown=app:app /out/notion-manager /app/notion-manager
RUN mkdir -p /app/accounts && chown -R app:app /app

ENV PORT=7860 \
    TZ=UTC \
    REQUIRE_SECRETS=true \
    DEBUG_LOGGING=false \
    API_LOG_INPUT=false \
    API_LOG_OUTPUT=false \
    NOTION_LOG_REQUEST=false \
    NOTION_LOG_RESPONSE=false \
    DUMP_API_INPUT=false

EXPOSE 7860
USER app

ENTRYPOINT ["/app/notion-manager"]