# Dockerfile.traefik — custom orca-traefik image (R-024)
#
# Extends the official traefik:v3.3.0 image with a baked default static
# config. The host-side /etc/traefik/traefik.yml (rendered by
# emitter.RenderTraefikStaticConfig) is mounted :ro at runtime to
# override this default — preserving the traefik-on-public-ip opt-out
# (REQ-100) and any site-local customisation.
#
# Dynamic config (routers, services, certs) is mounted from
# /etc/traefik/dynamic on the host — orca writes to it atomically via
# the SSH-push transport (C-10 protocol).
#
# Build:
#   docker build -f Dockerfile.traefik -t git.cloudinit.dev/coreci/orca-traefik:v0.13.1 .
#
# Run (hybrid R-017 mode — nft DNATs :443/:80 to loopback):
#   podman run -d --name orca-traefik --restart=unless-stopped \
#     --network host \
#     -v /etc/traefik/traefik.yml:/etc/traefik/traefik.yml:ro \
#     -v /etc/traefik/dynamic:/etc/traefik/dynamic:ro \
#     -v /etc/orca/step-ca-root.crt:/etc/orca/step-ca-root.crt:ro \
#     git.cloudinit.dev/coreci/orca-traefik:v0.13.1

FROM traefik:v3.3.0

LABEL org.opencontainers.image.title="orca-traefik"
LABEL org.opencontainers.image.description="Custom Traefik image for Orca ingress (R-024)"
LABEL org.opencontainers.image.source="https://git.cloudinit.dev/coreci/orca"

COPY docker/orca-traefik/traefik.yml /etc/traefik/traefik.yml
COPY docker/orca-traefik/step-ca-root.crt /etc/orca/step-ca-root.crt

CMD ["--configFile=/etc/traefik/traefik.yml"]