Dockerfile.proxy

# docx-mcp-sse-proxy — HTTP reverse proxy with PAT auth

FROM rust:1.93-slim-bookworm AS builder
WORKDIR /build

RUN apt-get update && apt-get install -y \
    pkg-config protobuf-compiler libssl-dev \
    && rm -rf /var/lib/apt/lists/*

COPY Cargo.toml Cargo.lock ./
COPY proto/ ./proto/
COPY crates/ ./crates/

RUN --mount=type=cache,id=cargo-proxy,target=/usr/local/cargo/registry \
    cargo build --release --package docx-mcp-sse-proxy

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y ca-certificates curl && rm -rf /var/lib/apt/lists/*
RUN useradd -m -u 1000 docx
USER docx
WORKDIR /app

COPY --from=builder /build/target/release/docx-mcp-sse-proxy /app/docx-mcp-sse-proxy

ENV RUST_LOG=info PROXY_HOST=0.0.0.0 PROXY_PORT=8080
EXPOSE 8080

# Required: MCP_BACKEND_URL, CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN, D1_DATABASE_ID

HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD ["curl", "-sf", "http://localhost:8080/health"]

ENTRYPOINT ["/app/docx-mcp-sse-proxy"]