# Aere Cloud, Quantum Security Gateway. Imagine minima: Node 24 si un singur fisier, fara nicio dependinta.
# Construita si masurata 2026-10-18 pe rpc2 din octetii comisi (dovezi/imagine-docker-2026-10-18.md): 62,5 MB, Node v24.22.0 cu
# OpenSSL 3.5.8, handshake X25519MLKEM768 reusit, clientul clasic refuzat in hybrid-only. Pe laptopul de dezvoltare nu e docker.
# Gateway-ul o verifica singur la pornire (refuza sub OpenSSL 3.5) si o scrie in randul 'listening' din jurnal.
#
#   docker build -t aere-pq-gateway .
#   docker run --rm -p 443:8443 \
#     -e AERE_PQGW_MODE=hybrid-preferred -e AERE_PQGW_UPSTREAM=http://app:8080 \
#     -v /cale/catre/certificate:/etc/aere-pq-gateway:ro aere-pq-gateway
#
# Ruleaza ca utilizatorul neprivilegiat 'node' (uid 1000) din imaginea oficiala: cheia montata trebuie sa fie
# citibila de el, altfel gateway-ul refuza sa porneasca cu "cannot read KEY (EACCES)".
FROM node:24-alpine

WORKDIR /app
COPY pq-gateway.mjs /app/pq-gateway.mjs

ENV AERE_PQGW_LISTEN=:8443 \
    AERE_PQGW_CERT=/etc/aere-pq-gateway/fullchain.pem \
    AERE_PQGW_KEY=/etc/aere-pq-gateway/privkey.pem

USER node
EXPOSE 8443
STOPSIGNAL SIGTERM
CMD ["node", "/app/pq-gateway.mjs"]