# syntax=docker/dockerfile:1.20.0

FROM golang:1.26.7-alpine3.23@sha256:b17af760035fc2f338eed92d448a6c67f2d45438844fc6c60678fa5f99e44b57 AS builder

ARG TRAEFIK_VERSION=v3.7.10
ARG TRAEFIK_SOURCE_SHA256=31e0e2fbdccd3170b3bc5c3d233a08585bcbc5ede8f753d12a5999d69c21cdd6
ARG TRAEFIK_BUILD_DATE=2026-07-31_12:49:21PM
ARG GRPC_GO_VERSION=v1.82.1
ARG X_MOD_VERSION=v0.40.0

ADD --checksum=sha256:31e0e2fbdccd3170b3bc5c3d233a08585bcbc5ede8f753d12a5999d69c21cdd6 \
  https://github.com/traefik/traefik/releases/download/v3.7.10/traefik-v3.7.10.src.tar.gz \
  /tmp/traefik.tar.gz

WORKDIR /src

RUN test "$TRAEFIK_SOURCE_SHA256" = "31e0e2fbdccd3170b3bc5c3d233a08585bcbc5ede8f753d12a5999d69c21cdd6" \
  && tar -xzf /tmp/traefik.tar.gz --strip-components=1 \
  && go get "google.golang.org/grpc@${GRPC_GO_VERSION}" \
  && go get "golang.org/x/mod@${X_MOD_VERSION}" \
  && test "$(go list -m -f '{{.Version}}' google.golang.org/grpc)" = "$GRPC_GO_VERSION" \
  && test "$(go list -m -f '{{.Version}}' golang.org/x/mod)" = "$X_MOD_VERSION" \
  && CGO_ENABLED=0 go build \
    -trimpath \
    -ldflags "-s -w -X github.com/traefik/traefik/v3/pkg/version.Version=${TRAEFIK_VERSION}-wnh-grpc1.82.1-xmod0.40.0 -X github.com/traefik/traefik/v3/pkg/version.BuildDate=${TRAEFIK_BUILD_DATE}" \
    -installsuffix nocgo \
    -o /out/traefik \
    ./cmd/traefik

FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS certificates

RUN apk add --no-cache \
  ca-certificates=20260611-r0 \
  tzdata=2026c-r0

FROM scratch

COPY --from=certificates /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=certificates /usr/share/zoneinfo /usr/share/zoneinfo
COPY --from=builder /out/traefik /traefik

EXPOSE 80
VOLUME ["/tmp"]

USER 65532:65532

ENTRYPOINT ["/traefik"]