# Alpine-based MUSL static binary builder for nsigner

FROM alpine:3.19 AS builder

RUN apk add --no-cache \
    build-base \
    linux-headers \
    openssl-dev \
    openssl-libs-static \
    curl-dev \
    curl-static \
    zlib-static \
    sqlite-dev \
    sqlite-static \
    brotli-static \
    c-ares-static \
    nghttp2-static \
    libidn2-static \
    libpsl-static \
    libunistring-static \
    zstd-static \
    git \
    autoconf \
    automake \
    libtool \
    pkgconfig \
    bash

WORKDIR /build

# Build libsecp256k1 from source with schnorr support
RUN cd /tmp && \
    git clone --depth 1 https://github.com/bitcoin-core/secp256k1.git && \
    cd secp256k1 && \
    ./autogen.sh && \
    ./configure \
      --prefix=/usr \
      --enable-static \
      --disable-shared \
      --enable-module-schnorrsig \
      --enable-module-extrakeys \
      --enable-module-recovery && \
    make -j"$(nproc)" && \
    make install && \
    rm -rf /tmp/secp256k1

# Copy and build nostr_core_lib from project resources
COPY resources/nostr_core_lib /build/nostr_core_lib/
RUN if [ "$(uname -m)" = "aarch64" ] && ! command -v aarch64-linux-gnu-gcc >/dev/null 2>&1; then \
      ln -s "$(command -v gcc)" /usr/local/bin/aarch64-linux-gnu-gcc; \
    fi && \
    cd /build/nostr_core_lib && \
    chmod +x ./build.sh && \
    ./build.sh --nips=1,4,6,19,44

# Copy source files
COPY src/ /build/src/

# Build nsigner as a fully static binary
RUN ARCH="$(uname -m)"; \
    case "$ARCH" in \
      aarch64|arm64) NOSTR_LIB="/build/nostr_core_lib/libnostr_core_arm64.a" ;; \
      x86_64|amd64)  NOSTR_LIB="/build/nostr_core_lib/libnostr_core_x64.a" ;; \
      *) echo "Unsupported build arch: $ARCH"; exit 1 ;; \
    esac; \
    [ -f "$NOSTR_LIB" ] || { echo "Missing nostr core lib: $NOSTR_LIB"; ls -la /build/nostr_core_lib; exit 1; }; \
    gcc -static -Os -ffunction-sections -fdata-sections -Wl,--gc-sections -s -Wall -Wextra -std=c99 \
      -I/build/nostr_core_lib \
      -I/build/nostr_core_lib/nostr_core \
      -I/build/nostr_core_lib/cjson \
      /build/src/main.c \
      /build/src/secure_mem.c \
      /build/src/mnemonic.c \
      /build/src/role_table.c \
      /build/src/selector.c \
      /build/src/enforcement.c \
      /build/src/dispatcher.c \
      /build/src/policy.c \
      /build/src/server.c \
      /build/src/transport_frame.c \
      /build/src/key_store.c \
      /build/src/socket_name.c \
      "$NOSTR_LIB" \
      -o /build/nsigner_static \
      $(pkg-config --static --libs libcurl openssl) \
      -lsecp256k1 -lsqlite3 -lz -lpthread -lm

RUN strip /build/nsigner_static || true
RUN file /build/nsigner_static && \
    (ldd /build/nsigner_static 2>&1 || true)

FROM scratch AS output
COPY --from=builder /build/nsigner_static /nsigner_static