# monitor — admin-only log stream + dashboard. Multi-stage: build a static
# binary (UI is //go:embed-ed into it), ship it on scratch.
#
# No CA roots needed: phase 1 talks to nothing over the network — it only reads
# a file. Add them here if a later phase makes outbound TLS calls.
FROM golang:1.25-alpine AS build
WORKDIR /src
COPY go.mod ./
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /out/monitor .

FROM scratch
COPY --from=build /out/monitor /monitor
EXPOSE 8080
ENTRYPOINT ["/monitor"]