FROM caddy:2.11.4-builder-alpine AS caddy-builder

# grpc and otel move together: grpc >= v1.83.0 requires otel v1.44.0, and xcaddy
# resolves these --with pins in one `go get`, so a stale otel pin makes go walk
# grpc backwards until it finds one that fits (silently, with a zero exit) --
# it lands on the v1.83.0-dev pre-release and the build still succeeds. Bump the
# otel pair in lockstep with grpc, and confirm with `go version -m` afterwards.
RUN XCADDY_SKIP_CLEANUP=1 xcaddy build \
        --with github.com/caddy-dns/cloudflare@v0.2.1 \
        --with github.com/caddy-dns/digitalocean@04bde2867106aa1b44c2f9da41a285fa02e629c5 \
        --with github.com/mholt/caddy-l4@6faae83b167fda94e62b686be5cbeb9b3f8fe002 \
        --with github.com/go-jose/go-jose/v3@v3.0.5 \
        --with github.com/go-jose/go-jose/v4@v4.1.4 \
        --with google.golang.org/grpc@v1.83.1 \
        --with go.opentelemetry.io/otel@v1.44.0 \
        --with go.opentelemetry.io/otel/sdk@v1.44.0

# Caddy's own go.mod pins x/crypto, x/net and x/text at versions with open CVEs;
# xcaddy preserved its build dir above, so upgrade them there and rebuild.
# x/crypto v0.55.0 requires x/net v0.57.0 and x/text v0.41.0, hence those floors.
RUN cd "$(find /tmp -maxdepth 1 -name 'buildenv_*' -type d | head -1)" && \
    go get golang.org/x/crypto@v0.55.0 && \
    go get golang.org/x/net@v0.57.0 && \
    go get golang.org/x/text@v0.41.0 && \
    go mod tidy && \
    go build -o /usr/bin/caddy -ldflags "-w -s" -trimpath -tags nobadger,nomysql,nopgx .

# xcaddy resolves every --with pin in a single `go get`, which walks a module
# backwards to an older release rather than failing when the pins conflict.
# Assert the binary really carries the pinned grpc, so a silent downgrade fails
# the build instead of shipping a proxy that only looks patched.
RUN go version -m /usr/bin/caddy | grep -qE 'google\.golang\.org/grpc[[:space:]]v1\.83\.1[[:space:]]' \
    || { echo "caddy was not built against the pinned grpc -- check the --with pins" >&2; exit 1; }

FROM caddy:2.11.4-alpine

# OS security updates. --available forces reinstall from the current repos;
# bump APK_SECURITY_PATCH to bust buildx's cached layer (keyed on this command
# string), otherwise a rebuild silently re-ships the old packages.
ARG APK_SECURITY_PATCH=2026-09-07
RUN echo "apk-security-patch ${APK_SECURITY_PATCH}" && apk update && apk upgrade --no-cache --available && apk add --no-cache nss-tools bash curl

COPY --from=caddy-builder /usr/bin/caddy /usr/bin/caddy

COPY Caddyfile.ce /etc/caddy/Caddyfile