# episode 10: the stock caddy:2-alpine image cannot rate limit. The directive
# lives in a plugin (github.com/mholt/caddy-ratelimit) that has to be compiled
# in with xcaddy - there is no runtime "enable" for it.
# episode 12: same trick for CrowdSec. The bouncer (http) and the AppSec
# handler (appsec) are plugins too, pinned to a release tag instead of @main.
# episode 17: every version is written down. "caddy:2-alpine" plus an unpinned
# plugin means the next rebuild is an update nobody decided on. docker compose
# pull never touches this image, it only changes when you run a build, so the
# compose file carries the same version in the image tag.
FROM caddy:2.11.7-builder-alpine AS builder
RUN xcaddy build \
    --with github.com/mholt/caddy-ratelimit@v0.1.0 \
    --with github.com/hslatman/caddy-crowdsec-bouncer/http@v0.14.1 \
    --with github.com/hslatman/caddy-crowdsec-bouncer/appsec@v0.14.1

FROM caddy:2.11.7-alpine
COPY --from=builder /usr/bin/caddy /usr/bin/caddy