# Custom CoreDNS image that bakes in the rfc2136 plugin for accepting
# RFC 2136 dynamic updates (TSIG-authenticated). The upstream
# coredns/coredns image does NOT include this plugin — CoreDNS itself
# has no plugin for accepting dynamic updates anywhere in its ecosystem
# as of v1.12.2, so we ship our own.
#
# Stage 1: build CoreDNS from source with our plugin appended to
# plugin.cfg. Stage 2: distroless runtime image.
#
# Plugin source: <REPO_URL_PLACEHOLDER>
# This Dockerfile is currently SCAFFOLDING ONLY — the plugin repo does
# not yet exist. Building this image will fail until Phase 1 ships.

# ─── Stage 1: builder ──────────────────────────────────────────────
FROM golang:1.25-alpine AS builder

# GOTOOLCHAIN=auto lets `go` download a newer toolchain on demand if
# go.mod (ours OR a transitive dep's) specifies a Go version newer
# than the base image. Belt-and-suspenders so an upstream version
# bump doesn't break this Dockerfile.
ENV GOTOOLCHAIN=auto
# Bypass the public Go module proxy. Our plugin lives on a private
# Gitea instance, which proxy.golang.org won't (and shouldn't) cache.
# direct = go talks to the upstream VCS for every module fetch.
ENV GOPROXY=direct
ENV GOSUMDB=off

RUN apk add --no-cache git make

WORKDIR /build
ARG COREDNS_REF=v1.14.3
RUN git clone --depth 1 --branch ${COREDNS_REF} https://github.com/coredns/coredns.git .

# Inject our plugin into plugin.cfg. Must come BEFORE the `cache` plugin
# so authoritative answers from rfc2136 aren't intercepted by cache.
ARG PLUGIN_REPO=git.supported.systems/rsp2k/coredns-rfc2136
ARG PLUGIN_REF=latest
RUN sed -i "/^cache:cache$/i rfc2136:${PLUGIN_REPO}" plugin.cfg && \
    go get ${PLUGIN_REPO}@${PLUGIN_REF}

# Go's GOFLAGS env splits on whitespace and doesn't honour shell quoting
# in a way that survives a Dockerfile RUN, so passing
# `-ldflags="-w -s"` breaks parsing. We let `make` use its defaults;
# the resulting binary is ~10 MB larger than a stripped build but
# works correctly and is what upstream CoreDNS ships.
RUN make

# ─── Stage 2: runtime ──────────────────────────────────────────────
# Switched from distroless to alpine specifically so the rfc2136
# plugin's auto-commit can shell out to `git`. Distroless has no
# package manager and no shell, which would block git execution.
# Image grows ~10 MB; trade-off worth it for the audit trail.
FROM alpine:3.20

RUN apk add --no-cache git ca-certificates && \
    # Pre-create the user-id range the container will run as (1000)
    # so that volume-mounted files written by this process land owned
    # by the host's primary user. Add to the same group so a future
    # interactive `docker exec --user 1000` works.
    addgroup -g 1000 -S coredns && \
    adduser -u 1000 -S coredns -G coredns

COPY --from=builder /build/coredns /coredns

# Match upstream's exposed ports.
EXPOSE 53 53/udp 853 443 9153 8080

ENTRYPOINT ["/coredns"]
CMD ["-conf", "/etc/coredns/Corefile"]
