Dockerfile

# ── Stage 1: Build the headless server ──
FROM rust:1.82-bookworm AS builder

WORKDIR /app

# Install system dependencies for rusqlite bundled build
RUN apt-get update && apt-get install -y --no-install-recommends \
    pkg-config libssl-dev \
    && rm -rf /var/lib/apt/lists/*

# Copy manifests first for layer caching
COPY src-tauri/Cargo.toml src-tauri/Cargo.lock src-tauri/
COPY src-tauri/src/ src-tauri/src/
COPY src-tauri/assistant/ src-tauri/assistant/

# Build only the headless server binary (skip Tauri GUI deps)
WORKDIR /app/src-tauri
RUN cargo build --bin orchestrator-server --release \
    --no-default-features 2>&1

# ── Stage 2: Runtime image ──
FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates curl \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user
RUN useradd -m -s /bin/bash orchestrator

COPY --from=builder /app/src-tauri/target/release/orchestrator-server /usr/local/bin/orchestrator-server

# Default data directory
ENV ORCHESTRATOR_HOME=/home/orchestrator/.orchestrator
ENV ORCHESTRATOR_PORT=47821
ENV ORCHESTRATOR_HOST=0.0.0.0

USER orchestrator
WORKDIR /home/orchestrator

EXPOSE 47821

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD curl -sf http://localhost:${ORCHESTRATOR_PORT}/health || exit 1

ENTRYPOINT ["orchestrator-server"]