# GoAlert Cloudron Package
#
# GoAlert is Target's open-source on-call alerting system: escalation
# chains, schedules/rotations, notification rules (SMS/phone via
# Twilio/VictorOps etc., Slack), heartbeat checks, status dashboards —
# a single Go binary serving web UI + REST API on :8081 with
# PostgreSQL as the only backing store.
#
# Upstream: https://github.com/target/goalert (Apache-2.0), v0.34.1.
#   - Official image goalert/goalert (alpine, /usr/bin/goalert, runs a
#     build-time self-test). DB schema migrations run automatically at
#     startup; no separate worker/scheduler processes.
#   - Configuration is envconfig-style: GOALERT_<SECTION>_<FIELD>
#     (GOALERT_DB_URL, GOALERT_PUBLIC_URL, GOALERT_OIDC_*, ...).
#
# Authentication: NATIVE OIDC (preferred). Generic OpenID Connect in
# core (config/config.go OIDC struct; go-oidc against any issuer):
# start.sh wires GOALERT_OIDC_ENABLE/ISSUER_URL/CLIENT_ID/CLIENT_SECRET
# from the Cloudron platform provider (CLOUDRON_OIDC_*), with
# new-user creation enabled. GitHub OAuth and basic-auth also exist.
#
# Pattern: official-image wrapper. Image pinned by tag AND digest
# (amd64 manifest digest of v0.34.1 from docker manifest inspect).
FROM goalert/goalert:v0.34.1@sha256:36b3962e3171de7ba6b964bcba21a9fee3fe331dc01d9716ee8bbd7bc01ba935

# bash for start.sh (alpine's ash lacks /dev/tcp used by the addon wait)
USER root
RUN apk add --no-cache bash

COPY start.sh /app/start.sh

# web UI + REST API; notifications are all outbound (no extra listeners)
EXPOSE 8081

ENTRYPOINT ["/bin/bash", "/app/start.sh"]