# syntax=docker/dockerfile:1
# tunneld: the single-node self-hosted OpenTunnel-compatible server.
# Deploy on Coolify (or any Docker host) with host port mappings
# 443 -> 8443 and 80 -> 8080 and a volume on /app/data; see README.md.

FROM golang:1.27-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY cmd ./cmd
COPY internal ./internal
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/tunneld ./cmd/tunneld

FROM alpine:3.21
RUN apk add --no-cache ca-certificates \
    && adduser -D -u 1000 tunneld \
    && mkdir -p /app/data && chown tunneld:tunneld /app/data
COPY --from=build /out/tunneld /usr/local/bin/tunneld
USER tunneld
# Tunnels are <id>.<OPENTUNNEL_DOMAIN>; set it per deployment.
ENV TUNNELD_DATA=/app/data/data.json \
    LOCAL_CA_FILE=/app/data/ca.pem \
    TLS_LISTEN=:8443 \
    HTTP_LISTEN=:8080 \
    HTTP_MODE=redirect
EXPOSE 8443 8080
VOLUME ["/app/data"]
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
    CMD wget -qO /dev/null http://127.0.0.1:8080/health || exit 1
ENTRYPOINT ["/usr/local/bin/tunneld"]