FROM golang:1.24-bookworm AS relay-build
WORKDIR /src
COPY go.mod main.go tls.go ./
RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /relay .

FROM node:22-bookworm-slim
ARG CODEX_VERSION=0.159.3
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl git python3 ripgrep tini \
    && rm -rf /var/lib/apt/lists/* \
    && npm install -g --no-audit --no-fund @openai/codex@${CODEX_VERSION}
COPY --from=relay-build /relay /usr/local/bin/dobrochan-codex-relay
COPY --chmod=755 docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
ENV CODEX_HOME=/home/node/.codex
ARG USER_UID=1000
ARG USER_GID=1000
RUN test "$USER_UID" -gt 0 && test "$USER_GID" -gt 0 \
    && if [ "$USER_GID" != 1000 ]; then groupmod -g "$USER_GID" node; fi \
    && if [ "$USER_UID" != 1000 ]; then usermod -u "$USER_UID" node; fi \
    && chown -R node:node /home/node
RUN mkdir -p /home/node/.codex /workspace && chown node:node /home/node/.codex /workspace
USER node
WORKDIR /workspace
ENTRYPOINT ["/usr/bin/tini", "-g", "--", "/usr/local/bin/docker-entrypoint.sh"]
