# Static-only Caddy 2 image for ui.suaveplan.com.
#
# No build step — the registry and Storybook trees are bind-mounted at
# runtime from /srv/registry on the OVH host. Image carries only the
# Caddy binary plus the validated Caddyfile.

FROM caddy:2-alpine

# wget is in the base image; used by HEALTHCHECK below.
COPY Caddyfile /etc/caddy/Caddyfile

# Validate Caddyfile at build time so a syntactically broken config
# fails the image build, not the deploy.
RUN caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile

# Caddy needs both ports for ACME HTTP-01 challenge + HTTPS serve.
EXPOSE 80 443

# Health probe hits the static /health endpoint defined in the Caddyfile.
# Uses --no-check-certificate because the cert is for ui.suaveplan.com
# but the probe targets 127.0.0.1 inside the container — TLS chain
# validation is not the contract being checked here, response body is.
# 30 s interval, 10 s timeout, 3 retries before unhealthy.
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
	CMD wget -q -O- --no-check-certificate https://127.0.0.1/health | grep -q '^ok$' || exit 1