# Stage 1 — build frontend
FROM node:20-alpine AS frontend-build
WORKDIR /app
RUN corepack enable && corepack prepare pnpm@9.2.0 --activate
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
COPY packages/api/package.json packages/api/package.json
COPY packages/frontend/package.json packages/frontend/package.json
RUN pnpm install --frozen-lockfile --filter @floci/frontend
COPY packages/frontend/ packages/frontend/
COPY svgAsset/ svgAsset/
COPY aws-icons-svg/ aws-icons-svg/
COPY TheCloud.png TheCloud.png
COPY OS_img/ OS_img/
RUN pnpm --filter @floci/frontend run build

# Stage 2 — compile API to a self-contained binary
FROM oven/bun:1-alpine AS api-build
WORKDIR /app
COPY packages/api/package.json packages/api/bun.lock* ./
RUN bun install
COPY packages/api/src ./src
RUN bun build --compile --minify src/index.ts --outfile server

# Stage 3 — minimal runtime (no bun, no node_modules)
FROM alpine:3
RUN apk add --no-cache ca-certificates libstdc++ \
    && addgroup -S -g 10001 thecloud \
    && adduser -S -D -H -u 10001 -G thecloud thecloud
WORKDIR /app
COPY --from=api-build /app/server ./server
COPY --from=frontend-build /app/packages/frontend/dist ./public
COPY packages/api/public ./public
COPY TheCloud.png ./public/TheCloud.png
COPY svgAsset/authentik.svg ./public/authentik.svg
COPY aws-icons-svg ./public/aws-icons
ENV PORT=4500
EXPOSE 4500
USER thecloud
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD wget -q -O /dev/null "http://127.0.0.1:${PORT:-4500}/api/health" || exit 1
CMD ["./server"]
