Dockerfile

# ─── Stage 1: Build ──────────────────────────────────────────────────────────
FROM rust:1.78-slim AS builder

WORKDIR /app

# Cache dependencies first (faster rebuilds)
COPY Cargo.toml Cargo.lock ./
RUN mkdir src && echo 'fn main(){}' > src/main.rs
RUN cargo build --release 2>/dev/null || true
RUN rm -rf src

# Build the real source
COPY src ./src
RUN cargo build --release --bin lucella

# ─── Stage 2: Runtime (minimal image) ────────────────────────────────────────
FROM debian:bookworm-slim AS runtime

RUN apt-get update && apt-get install -y \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Non-root user for security
RUN useradd -m -u 1001 lucella
USER lucella
WORKDIR /home/lucella

# Copy binary from builder
COPY --from=builder /app/target/release/lucella /usr/local/bin/lucella

# Default config via environment variables
ENV LUCELLA_HOST=0.0.0.0
ENV LUCELLA_PORT=7777
ENV LUCELLA_MAX_CONNECTIONS=10000
ENV LUCELLA_MAX_RPS=1000
ENV LUCELLA_DEBUG=false
# LUCELLA_KEY must be set by user (min 16 chars)

EXPOSE 7777

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD lucella check --host 127.0.0.1 --port ${LUCELLA_PORT} || exit 1

ENTRYPOINT ["lucella"]
CMD ["serve"]