#
# Builder
#

FROM nixos/nix:2.31.3 AS builder

#RUN cp "$(nix --extra-experimental-features "nix-command flakes" --option filter-syscalls false --option substituters "http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org" build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt

COPY . /tmp/build
WORKDIR /tmp/build

RUN nix \
    --extra-experimental-features "nix-command flakes" \
    --option filter-syscalls false \
    --option substituters "http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org" \
    build '.#docker_env'

# Export the built closure to a folder
RUN mkdir /tmp/nix-store-closure
RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
RUN ln -s $(readlink -f /tmp/build/result/bin/sh) /tmp/sh



#
# Runner
#

FROM scratch

WORKDIR /app

ENV PATH="$PATH:/app/bin"

ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt

COPY --from=builder /tmp/nix-store-closure /nix/store
COPY --from=builder /tmp/build/result /app
COPY --from=builder /tmp/sh /bin/sh
EXPOSE 8080
#RUN addgroup web && adduser -D -G web web
#&& install -d -D -o web -g web -m 700 /srv/http/public
# RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log
CMD ["/app/bin/launch_nginx"]