# Patched LiveKit SFU for BROARchat.
#
# Self-contained on purpose: it fetches upstream itself and applies
# h264-profile.patch, so a customer running `docker compose build` gets the
# same SFU production runs without needing a registry account or any
# credentials from us. See README.md for what the patch does and why.
#
# Build directly:
#   docker build -t broarchat-livekit:h264patch deployment/livekit
# Override the version (patch may need re-rolling on a new tag):
#   docker build --build-arg LIVEKIT_VERSION=v1.13.2 -t broarchat-livekit:h264patch .

# Must match upstream's own builder for this tag: v1.13.2 declares `go 1.26`
# in go.mod, and an older toolchain refuses the module outright.
FROM golang:1.26-alpine AS builder

ARG LIVEKIT_VERSION=v1.13.2
ARG TARGETARCH

RUN apk add --no-cache git
WORKDIR /workspace

# --depth 1 on the tag: we only ever build one commit, and the full history is
# ~10x the download.
RUN git clone --depth 1 --branch ${LIVEKIT_VERSION} \
      https://github.com/livekit/livekit.git .

COPY h264-profile.patch /tmp/h264-profile.patch
# Fail the build loudly if the patch no longer applies — upstream moved this
# call site once already (it was positional in v1.10.1, named fields in
# v1.13.2). A silently skipped patch would ship a stock SFU that looks fine
# until someone screen-shares at 4K and lands on software encoding.
RUN git apply --verbose /tmp/h264-profile.patch && \
    grep -q "BROARCHAT PATCH" pkg/rtc/transport.go && \
    echo "H264 profile patch applied and verified"

RUN go mod download
RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} GO111MODULE=on \
      go build -a -o livekit-server ./cmd/server

FROM alpine
COPY --from=builder /workspace/livekit-server /livekit-server
ENTRYPOINT ["/livekit-server"]
