# kraken-relay for a TLS reverse proxy such as Nginx Proxy Manager (D-72).
# The relay speaks WebSocket on plain HTTP; the proxy terminates TLS.
# Configuration is by flags only (no environment variables, agents.md §15).
#
# Build with the directory holding the wheel as the context:
#   uv build --wheel --out-dir dist
#   docker build -f packaging/docker/relay/Dockerfile -t kraken-relay dist
FROM python:3.13-slim

COPY kraken_mirror-*.whl /tmp/
RUN pip install --no-cache-dir --disable-pip-version-check /tmp/kraken_mirror-*.whl \
    && rm /tmp/kraken_mirror-*.whl \
    && useradd --system --uid 10001 --user-group --home-dir /data --shell /usr/sbin/nologin kraken \
    && mkdir -p /data \
    && chown kraken:kraken /data

USER kraken
# The relay's identity (its node ID and signing key) lives here; keep it.
VOLUME ["/data"]
EXPOSE 8742

# Extra flags go before the command, e.g. --trusted-proxy 172.18.0.0/16 serve
ENTRYPOINT ["kraken-relay", "--mode", "user", "--state-dir", "/data", \
            "--runtime-dir", "/tmp/kraken", "--log-sink", "stderr", "--relay-listen", ":8742"]
CMD ["serve"]
