# docker/kong/Dockerfile
# DB-less Kong, config baked in — kong.yml's upstream targets currently point at
# Compose container DNS names (fine for the EC2 test); update to ECS Service Connect
# DNS names when this moves to Fargate.

FROM kong:3.9

COPY kong.yml /kong-config/kong.yml

ENV KONG_DATABASE=off
ENV KONG_DECLARATIVE_CONFIG=/kong-config/kong.yml
ENV KONG_PROXY_ACCESS_LOG=/dev/stdout
ENV KONG_ADMIN_ACCESS_LOG=/dev/stdout
ENV KONG_PROXY_ERROR_LOG=/dev/stderr
ENV KONG_ADMIN_ERROR_LOG=/dev/stderr
# Cap request bodies at the gateway; the backends' nginx/PHP accept at most 64M.
ENV KONG_NGINX_PROXY_CLIENT_MAX_BODY_SIZE=64m
# Admin API (8001) and Kong Manager (8002) — keep these OFF the public ALB listener;
# only expose 8000 externally. Reach 8001/8002 via a bastion/VPN or a separate internal ALB.
ENV KONG_ADMIN_LISTEN=0.0.0.0:8001
ENV KONG_ADMIN_GUI_LISTEN=0.0.0.0:8002

EXPOSE 8000 8001 8002