FROM alpine:3.20.1 AS builder

ARG LIGHTTPD_TARBALL="https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.76.tar.gz"
ARG LIGHTTPD_SHA256="ba14a030889518194fd88b33e419d51cc38c8fe917126d5a7a965be79b53e995"

RUN set -eux; \
  \
  apk add --no-cache \
    bsd-compat-headers \
    build-base \
    pcre2-dev \
    scons

RUN set -eux; \
  \
  wget -O lighttpd.tar.gz "$LIGHTTPD_TARBALL"; \
  echo "$LIGHTTPD_SHA256 *lighttpd.tar.gz" | sha256sum -c; \
  mkdir -p /usr/src/lighttpd; \
  tar -xzf lighttpd.tar.gz -C /usr/src/lighttpd --strip-components=1; \
  rm lighttpd.tar.gz; \
  cd /usr/src/lighttpd; \
  nproc="$(getconf _NPROCESSORS_ONLN)"; \
  eval "scons -j '$nproc' build_fullstatic=1 build_dynamic=0"

RUN set -eux; \
  \
  mkdir -p /rootfs/bin; \
  cp /usr/src/lighttpd/sconsbuild/fullstatic/build/lighttpd /rootfs/bin/; \
  mkdir -p /rootfs/etc; \
  echo "nogroup:*:10001:nobody" > /rootfs/etc/group; \
  echo "nobody:*:10001:10001:::" > /rootfs/etc/passwd


FROM scratch

COPY --from=builder --chown=10001:10001 /rootfs /

USER 10001:10001

ENTRYPOINT ["/bin/lighttpd"]
CMD ["-D", "-f", "/lighttpd.conf"]