# grafana-mcp — Grafana's official MCP server (grafana/mcp-grafana) as a
# streamable-HTTP container for cluster0.
#
# Built by Gitea Actions (.gitea/workflows/build.yaml):
#   - on push to main
#   - weekly Mon 06:00 UTC (resolves the newest upstream release, skips if
#     the tag is already published) — lands ~7h BEFORE the cluster0
#     image-update cron (Mon 13:00 UTC) so the Monday pass bumps the
#     deployment tag like any other app.
#   - on manual workflow_dispatch with an explicit version
#
# The upstream release is a SINGLE static Go binary, fetched from the pinned
# GitHub release and verified against the release's own sha256 checksums
# file. No vendored code. Published as
# gitea.williammiceli.systems/hermes/grafana-mcp:v<version> (plus :latest).
#
# The upstream Grafana credentials (GRAFANA_URL is baked in as a default,
# GRAFANA_SERVICE_ACCOUNT_TOKEN is deploy-time only) are NEVER baked into
# this image — the token comes from the server's own Kubernetes secret
# (Kubernetes_Cluster0, namespace ai-0-1) at deploy time.

ARG MCP_GRAFANA_VERSION=v1.1.0

FROM docker.io/library/alpine:3.22 AS fetch

ARG MCP_GRAFANA_VERSION
ARG TARGETARCH

# curl + tar + coreutils (sha256sum/grep) to fetch and verify the pinned
# upstream release. ca-certificates for HTTPS to github.com — and the CA
# bundle is copied into the final scratch image too, because Grafana
# (GF_SERVER_ENFORCE_DOMAIN=true) redirects API calls to its canonical
# https:// domain and Go's TLS verification needs the bundle.
RUN apk add --no-cache curl tar coreutils ca-certificates

WORKDIR /tmp

# Fetch the release checksums file and the linux/${TARGETARCH} tarball, then
# verify the tarball's sha256 against the checksums file. Fails the build on
# any mismatch (checksums.txt entries: "<sha256>  mcp-grafana_Linux_<arch>.tar.gz").
RUN set -eux; \
    SHORT="${MCP_GRAFANA_VERSION#v}"; \
    case "$TARGETARCH" in \
        amd64) ASSET="Linux_x86_64" ;; \
        arm64) ASSET="Linux_arm64" ;; \
        *) echo "unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
    esac; \
    curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${SHORT}_checksums.txt" -o checksums.txt; \
    curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${ASSET}.tar.gz" -o "mcp-grafana_${ASSET}.tar.gz"; \
    grep "mcp-grafana_${ASSET}.tar.gz" checksums.txt | sha256sum -c -; \
    tar -xzf "mcp-grafana_${ASSET}.tar.gz" mcp-grafana; \
    chmod +x mcp-grafana

# The binary is fully static (no INTERP segment) — scratch is sufficient.
# The CA bundle is copied in for TLS verification of redirected Grafana
# requests (Grafana enforces its canonical https:// domain).
FROM scratch

COPY --from=fetch /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=fetch /tmp/mcp-grafana /mcp-grafana

EXPOSE 3000

# streamable-http on all interfaces, port 3000 (the service port).
# --allowed-hosts is supplied by the Deployment args (DNS-rebinding
# protection: only the in-cluster service hostname is trusted).
# GRAFANA_URL + GRAFANA_SERVICE_ACCOUNT_TOKEN come from the pod env.
ENTRYPOINT ["/mcp-grafana", "--transport", "streamable-http", "--address", "0.0.0.0:3000"]