# secret-rotator — static musl binary in a FROM-scratch image.
#
# Nothing in the final image but the binary: no libc, no shell, no package
# manager, no CA bundle on disk. That means no base-image CVE stream to patch
# and nothing for a compromised rotator to exec.
#
# TLS still works: rustls is compiled in with webpki-roots, so the trust store
# lives inside the binary rather than in /etc/ssl. (In-cluster traffic to
# OpenBao and Home Assistant is plain HTTP anyway; TLS is here so the same
# binary can take over the external-API rotators — Cloudflare, Proxmox.)
FROM rust:1.99-alpine@sha256:0cce0a5e0e8ba67b455257a3a02a1d99005f382748789d6464460028810f1627 AS build

# musl-dev provides the C runtime bits the linker needs for a fully static
# binary; nothing from it ends up in the final image.
RUN apk add --no-cache musl-dev

WORKDIR /build
COPY Cargo.toml Cargo.lock ./
COPY src ./src

RUN cargo build --release --target x86_64-unknown-linux-musl \
 && strip target/x86_64-unknown-linux-musl/release/secret-rotator

FROM scratch
COPY --from=build /build/target/x86_64-unknown-linux-musl/release/secret-rotator /secret-rotator

# Matches runAsUser on the rotation Jobs. There is no /etc/passwd in a scratch
# image, so this is a bare uid by necessity — which is also all Kubernetes needs.
USER 65534:65534

ENTRYPOINT ["/secret-rotator"]