# Custom CoreDNS image that bakes in the rfc2136 plugin for accepting
# RFC 2136 dynamic updates (TSIG-authenticated). The upstream
# coredns/coredns image does NOT include this plugin — CoreDNS itself
# has no plugin for accepting dynamic updates anywhere in its ecosystem
# as of v1.12.2, so we ship our own.
#
# Stage 1: build CoreDNS from source with our plugin appended to
# plugin.cfg. Stage 2: distroless runtime image.
#
# Plugin source: <REPO_URL_PLACEHOLDER>
# This Dockerfile is currently SCAFFOLDING ONLY — the plugin repo does
# not yet exist. Building this image will fail until Phase 1 ships.

# ─── Stage 1: builder ──────────────────────────────────────────────
FROM golang:1.22-alpine AS builder

RUN apk add --no-cache git make

WORKDIR /build
ARG COREDNS_REF=v1.12.2
RUN git clone --depth 1 --branch ${COREDNS_REF} https://github.com/coredns/coredns.git .

# Inject our plugin into plugin.cfg. Must come BEFORE the `cache` plugin
# so authoritative answers from rfc2136 aren't intercepted by cache.
ARG PLUGIN_REPO=git.supported.systems/rsp2k/coredns-rfc2136
ARG PLUGIN_REF=latest
RUN sed -i "/^cache:cache$/i rfc2136:${PLUGIN_REPO}" plugin.cfg && \
    go get ${PLUGIN_REPO}@${PLUGIN_REF}

RUN make GOFLAGS="-ldflags=-w -s"

# ─── Stage 2: runtime ──────────────────────────────────────────────
FROM gcr.io/distroless/static-debian12

COPY --from=builder /build/coredns /coredns

# Match upstream's exposed ports.
EXPOSE 53 53/udp 853 443 9153 8080

ENTRYPOINT ["/coredns"]
CMD ["-conf", "/etc/coredns/Corefile"]
