# Wormhole 内网穿透 + 反向代理网关（Go + Vue 管理台）
#
# 构建:
#   docker build -t wormhole:latest .
#
# 服务端:
#   docker run -d --name wormhole \
#     -p 8529:8529 -p 8528:8528 -p 8081:8081 -p 8443:8443 \
#     -v wormhole-data:/app/data \
#     wormhole:latest
#
# Agent:
#   docker run -d --name wormhole-agent --restart=unless-stopped --network host \
#     wormhole:latest agent -server <服务端IP>:8528 -key <verify_key>
#
# 生产镜像由 Gitea Actions 构建，见 README

# syntax=docker/dockerfile:1

# 基础镜像默认 Docker Hub；CI 默认 1Panel 加速（docker.1panel.live），本地可传：
#   docker build --build-arg IMAGE_PREFIX=docker.1panel.live/library/ -t wormhole:latest .
ARG IMAGE_PREFIX=

FROM --platform=$BUILDPLATFORM ${IMAGE_PREFIX}node:20-alpine AS web-builder

WORKDIR /src/web
COPY web/package.json web/package-lock.json web/.npmrc ./
RUN npm ci
COPY web/ ./
RUN npm run build

FROM --platform=$BUILDPLATFORM ${IMAGE_PREFIX}golang:1.25-alpine AS go-builder

ARG TARGETARCH
ARG GOPROXY=https://goproxy.cn,direct
ARG GOSUMDB=sum.golang.google.cn
ENV GOPROXY=${GOPROXY} GOSUMDB=${GOSUMDB}

WORKDIR /src
COPY go.mod go.sum go.env ./
RUN --mount=type=cache,target=/go/pkg/mod \
    go mod download

COPY cmd/ ./cmd/
COPY internal/ ./internal/
COPY web/embed.go ./web/
COPY --from=web-builder /src/web/dist ./web/dist

RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    CGO_ENABLED=0 GOOS=linux GOARCH="$TARGETARCH" \
    go build -ldflags="-w -s" -o /wormhole ./cmd/wormhole

FROM ${IMAGE_PREFIX}alpine:3.20

RUN apk add --no-cache ca-certificates tzdata \
    && addgroup -S wormhole \
    && adduser -S wormhole -G wormhole

WORKDIR /app

COPY --from=go-builder /wormhole /usr/local/bin/wormhole

RUN mkdir -p /app/data \
    && chown -R wormhole:wormhole /app

USER wormhole

VOLUME ["/app/data"]

EXPOSE 8529 8528 8081 8443

ENTRYPOINT ["/usr/local/bin/wormhole"]
CMD ["server"]