# Sridu - a folder of static files behind nginx.
# Build:  docker compose build      Run:  docker compose up -d
FROM nginx:1.30-alpine

LABEL org.opencontainers.image.title="Sridu" \
      org.opencontainers.image.description="Camera dart detection and scoring, entirely offline in the browser" \
      org.opencontainers.image.licenses="LicenseRef-Sridu-Personal-Use" \
      org.opencontainers.image.url="https://sridu.com" \
      org.sridu.app="sridu" org.sridu.part="web"

# openssl: a self-signed certificate for https in the home network - browsers
# hand out cameras (and the crypto the sessions need) only on https or localhost
RUN apk add --no-cache openssl \
 && mkdir -p /etc/nginx/certs /var/lib/sridu/data \
 && chown -R nginx:nginx /etc/nginx/certs /var/lib/sridu

# start-up hooks, run by nginx's own entrypoint in this order; they write
# only to /tmp/sridu, so the container also runs read-only and unprivileged
# (chmod as its own step: Synology's Docker builds without BuildKit, which
# is what COPY --chmod would need)
COPY docker/10-sridu-cert.sh docker/20-sridu-data.sh docker/30-sridu-config.sh docker/40-sridu-site.sh /docker-entrypoint.d/
RUN chmod 755 /docker-entrypoint.d/10-sridu-cert.sh /docker-entrypoint.d/20-sridu-data.sh \
              /docker-entrypoint.d/30-sridu-config.sh /docker-entrypoint.d/40-sridu-site.sh

# defaults for a plain "docker run" (home network); the compose files set them
ENV SRIDU_HTTPS=on \
    SRIDU_DATA=on \
    SRIDU_API=off \
    SRIDU_BROKER=off \
    NGINX_ENTRYPOINT_QUIET_LOGS=1

# the data folder of the installation (see docker/20-sridu-data.sh)
VOLUME /var/lib/sridu/data

COPY docker/nginx-main.conf /etc/nginx/nginx.conf
COPY nginx.conf /etc/nginx/conf.d/default.conf
COPY index.html config.html overlay.html sw.js manifest.webmanifest icon.svg icon-180.png icon-192.png icon-512.png favicon.ico og.png robots.txt llms.txt LICENSE AI-NOTICE.md /usr/share/nginx/html/
COPY css /usr/share/nginx/html/css
COPY js /usr/share/nginx/html/js
COPY locales /usr/share/nginx/html/locales
COPY voice /usr/share/nginx/html/voice
# readable for the unprivileged user of the public setup, whatever modes the
# files had on the host (a NAS share often hands out rwx------)
RUN chmod -R a+rX /etc/nginx/nginx.conf /etc/nginx/conf.d /usr/share/nginx/html

# 8080 http, 8443 https (home network only)
EXPOSE 8080 8443
