launcher/docker-images/sm121-addon/Dockerfile

# sm121 HA add-on image — THIN: bakes in the Rust toolchain; the
# entrypoint compiles sm121 from the launcher repo on first boot (cached
# in the add-on's data folder). The Pi IS the build host: always the right
# arch, the binary never goes stale, and the image carries no sm121
# binary at all (specs/tech-architecture/ha-addon-recipe-repos.md —
# "build on ha.lan" variant for HAOS, which has no Docker).
#
#   make addon-image      # context = docker-images/sm121-addon/
#   scripts/smoke-addon.sh
#
# The image is arch-generic EXCEPT the baked rustup toolchain (built for
# the build host's arch — build it on an aarch64 host for the Pi; a
# multi-arch buildx push covers x86_64 HA hosts too).

FROM debian:bookworm-slim

# git (launcher-repo fetch + recipe-repo sync) + jq (env → config) +
# ca-certs (https) + gcc/libc6-dev (ring's C backend, via russh)
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      git ca-certificates jq curl gcc libc6-dev \
 && rm -rf /var/lib/apt/lists/*

# Rust toolchain, pinned (edition 2024 + let-chains need rust ≥ 1.88; the
# launcher's Cargo.toml pins the exact version). `minimal` profile — no
# docs/rustfmt/clippy (the Pi only builds, never lints).
ENV RUSTUP_HOME=/usr/local/rustup \
    CARGO_HOME=/usr/local/cargo \
    PATH=/usr/local/cargo/bin:$PATH
RUN curl -sSf https://sh.rustup.rs \
    | sh -s -- -y --profile minimal --default-toolchain 1.98.1 \
 && rustup toolchain list

COPY entrypoint.sh /entrypoint.sh
RUN chmod 755 /entrypoint.sh

ENV SM121_WEB_PORT=3100
EXPOSE 3100
ENTRYPOINT ["/entrypoint.sh"]