# Alpine-based MUSL static binary builder for nsigner

FROM alpine:3.19 AS builder

RUN apk add --no-cache \
    build-base \
    linux-headers \
    openssl-dev \
    openssl-libs-static \
    curl-dev \
    curl-static \
    zlib-static \
    sqlite-dev \
    sqlite-static \
    brotli-static \
    c-ares-static \
    nghttp2-static \
    libidn2-static \
    libpsl-static \
    libunistring-static \
    zstd-static \
    git \
    autoconf \
    automake \
    libtool \
    pkgconfig \
    bash

WORKDIR /build

# Build libsecp256k1 from source with schnorr support
RUN cd /tmp && \
    git clone --depth 1 https://github.com/bitcoin-core/secp256k1.git && \
    cd secp256k1 && \
    ./autogen.sh && \
    ./configure \
      --prefix=/usr \
      --enable-static \
      --disable-shared \
      --enable-module-schnorrsig \
      --enable-module-extrakeys \
      --enable-module-recovery && \
    make -j"$(nproc)" && \
    make install && \
    rm -rf /tmp/secp256k1

# Copy and build nostr_core_lib from project resources
COPY resources/nostr_core_lib /build/nostr_core_lib/
RUN cd /build/nostr_core_lib && \
    chmod +x ./build.sh && \
    ./build.sh --nips=1,4,6,19,44

# Copy source files
COPY src/ /build/src/

# Build nsigner as a fully static binary
RUN gcc -static -Os -ffunction-sections -fdata-sections -Wl,--gc-sections -s -Wall -Wextra -std=c99 \
    -I/build/nostr_core_lib \
    -I/build/nostr_core_lib/nostr_core \
    -I/build/nostr_core_lib/cjson \
    /build/src/main.c \
    /build/src/secure_mem.c \
    /build/src/mnemonic.c \
    /build/src/role_table.c \
    /build/src/selector.c \
    /build/src/enforcement.c \
    /build/src/dispatcher.c \
    /build/src/policy.c \
    /build/src/server.c \
    /build/src/transport_frame.c \
    /build/src/key_store.c \
    /build/src/socket_name.c \
    /build/nostr_core_lib/libnostr_core_x64.a \
    -o /build/nsigner_static \
    $(pkg-config --static --libs libcurl openssl) \
    -lsecp256k1 -lsqlite3 -lz -lpthread -lm

RUN strip /build/nsigner_static || true
RUN file /build/nsigner_static && \
    (ldd /build/nsigner_static 2>&1 || true)

FROM scratch AS output
COPY --from=builder /build/nsigner_static /nsigner_static