# Custom Caddy image with the Cloudflare DNS-01 plugin (standard caddy:2 lacks it,
# and DNS-01 is how the egg gets TLS before/without HTTP reachability — PLAN-002
# §9.4). Built on the VM by components/proxy.ts (ADR-007); the resulting image id
# is what the foundation-caddy container runs.
#
# Determinism (D5): base images pinned by digest, DNS module pinned by version.
# Bump = edit this file → proxy.ts's build command rebuilds (Dockerfile is a trigger).
#   builder  caddy:2.10-builder  sha256:01668408cc26e2e00c9d067c30cb43b2ba14ad1f2808beda55503cb2a31f59dc
#   final    caddy:2.10          sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
#   module   github.com/caddy-dns/cloudflare v0.2.4  (libdns/cloudflare v0.2.2)
FROM caddy@sha256:01668408cc26e2e00c9d067c30cb43b2ba14ad1f2808beda55503cb2a31f59dc AS builder
RUN xcaddy build --with github.com/caddy-dns/cloudflare@v0.2.4

FROM caddy@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
COPY --from=builder /usr/bin/caddy /usr/bin/caddy