FROM golang:1.24-alpine AS build
WORKDIR /src
COPY go.mod ./
COPY cmd ./cmd
COPY internal ./internal
RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /out/google-auth-proxy ./cmd/google-auth-proxy

FROM scratch
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build /out/google-auth-proxy /google-auth-proxy
USER 65532:65532
EXPOSE 2999
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s CMD ["/google-auth-proxy", "-healthcheck"]
ENTRYPOINT ["/google-auth-proxy"]