Dockerfile.api

# syntax=docker/dockerfile:1.7

FROM rust:1.95-bookworm AS api-builder

WORKDIR /app

RUN apt-get update && apt-get install -y --no-install-recommends \
    pkg-config \
    libssl-dev \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

COPY rust/Cargo.toml rust/Cargo.lock ./rust/
COPY rust/core ./rust/core
RUN mkdir -p rust/src/bin rust/src/api \
    && echo "pub mod api; mod frb_generated; pub mod download_service; pub use ferrisload_core as core;" > rust/src/lib.rs \
    && echo "pub mod downloader;" > rust/src/api/mod.rs \
    && printf '// cache warm-up\n' > rust/src/api/downloader.rs \
    && printf '// cache warm-up\n' > rust/src/download_service.rs \
    && printf 'fn main() {}\n' > rust/src/bin/m3u8_api_server.rs \
    && printf '// build cache warm-up\n' > rust/src/frb_generated.rs \
    && cargo build --manifest-path rust/Cargo.toml --release --locked --features api-server --bin m3u8_api_server \
    && rm -rf rust/src

COPY rust/src ./rust/src
RUN cargo build --manifest-path rust/Cargo.toml --release --locked --features api-server --bin m3u8_api_server

FROM debian:bookworm-slim

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
    ffmpeg \
    ca-certificates \
    curl \
    libssl3 \
    && rm -rf /var/lib/apt/lists/*

RUN useradd --create-home --shell /bin/bash appuser \
    && mkdir -p /app/downloads \
    && chown -R appuser:appuser /app

USER appuser
WORKDIR /app

COPY --from=api-builder /app/rust/target/release/m3u8_api_server ./m3u8_api_server

ENV FERRISLOAD_FFMPEG_PATH=/usr/bin/ffmpeg
ENV DOWNLOAD_DIR=/app/downloads
ENV RUST_LOG=info
ENV API_HOST=0.0.0.0
ENV API_PORT=3000
# 安全：留空 = 关闭鉴权；设置后所有端点（除 /health）要求 Bearer token。
# 运行时可覆盖：docker run -e FERRISLOAD_API_TOKEN=...
ENV FERRISLOAD_API_TOKEN=
# 安全：默认拒绝内网/回环地址（SSRF 防护）；设为 1 允许本地网络媒体服务器。
ENV FERRISLOAD_ALLOW_PRIVATE_NETWORKS=

EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD curl --fail --silent http://127.0.0.1:3000/health > /dev/null || exit 1

CMD ["./m3u8_api_server"]