# Gateway image — portable across Hugging Face Docker Spaces, Fly.io, Railway,
# Render, Cloud Run. Build context is this `backend/` cargo workspace.
#   docker build -t wtw-gateway -f backend/Dockerfile backend
FROM rust:1-bookworm AS builder
WORKDIR /app
COPY . .
RUN cargo build --release -p gateway

FROM debian:bookworm-slim
# ca-certificates: TLS to a managed Postgres (Neon/Supabase). Non-root user.
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && useradd -m app
COPY --from=builder /app/target/release/gateway /usr/local/bin/gateway
USER app

# HF Spaces convention (app_port); the binary reads $PORT. Set DATABASE_URL as a
# Space secret to persist to an external Postgres (else it runs in-memory).
ENV PORT=7860
EXPOSE 7860
CMD ["gateway"]