# syntax=docker/dockerfile:1.7

ARG NODE_IMAGE=node:24.18.0-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d
ARG POSTGRES_IMAGE=postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641

FROM ${NODE_IMAGE} AS base
ENV PNPM_HOME=/pnpm \
    PATH=/pnpm:$PATH \
    NEXT_TELEMETRY_DISABLED=1
WORKDIR /app
RUN corepack enable && corepack prepare pnpm@10.33.0 --activate

FROM base AS development
COPY . .
RUN pnpm install --frozen-lockfile

FROM development AS build
ENV NODE_ENV=production
RUN pnpm build

FROM build AS worker-bundle
RUN mkdir -p /out/worker/dist \
    && cp -a /app/apps/worker/dist/. /out/worker/dist/

FROM base AS migrate
ENV NODE_ENV=production
COPY --from=build --chown=node:node /app /app
USER node
CMD ["./packages/db/node_modules/.bin/tsx", "packages/db/src/migrate.ts"]

FROM ${NODE_IMAGE} AS web
ENV NODE_ENV=production \
    NEXT_TELEMETRY_DISABLED=1 \
    HOSTNAME=0.0.0.0 \
    PORT=3000 \
    CONTENT_ROOT=/content \
    ARTIFACT_ROOT=/artifacts
WORKDIR /app
RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack /opt/yarn-v1.22.22 \
    && rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg \
    && mkdir -p /content/playbooks /content/catalog /artifacts \
    && chown -R node:node /app /content /artifacts
COPY --from=build --chown=node:node /app/apps/web/.next/standalone ./
COPY --from=build --chown=node:node /app/apps/web/.next/static ./apps/web/.next/static
COPY --from=build --chown=node:node /app/content/playbooks /content/playbooks
COPY --from=build --chown=node:node /app/catalog/seed-catalog.yaml /content/catalog/seed-catalog.yaml
USER node
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD ["node", "-e", "fetch('http://127.0.0.1:3000/health/live').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
CMD ["node", "apps/web/server.js"]

FROM ${NODE_IMAGE} AS worker
ENV NODE_ENV=production \
    CONTENT_ROOT=/content \
    ARTIFACT_ROOT=/artifacts
WORKDIR /app
RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack /opt/yarn-v1.22.22 \
    && rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg \
    && mkdir -p /content/playbooks /content/catalog /artifacts \
    && chown -R node:node /app /content /artifacts
COPY --from=worker-bundle --chown=node:node /out/worker ./
COPY --from=build --chown=node:node /app/content/playbooks /content/playbooks
COPY --from=build --chown=node:node /app/catalog/seed-catalog.yaml /content/catalog/seed-catalog.yaml
USER node
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD ["node", "-e", "try{process.kill(1,0)}catch{process.exit(1)}"]
CMD ["node", "dist/index.js"]

FROM ${POSTGRES_IMAGE} AS all-in-one
ENV NODE_ENV=production \
    NEXT_TELEMETRY_DISABLED=1 \
    HOSTNAME=0.0.0.0 \
    PORT=3000 \
    PGDATA=/config/postgres \
    CONTENT_ROOT=/content \
    ARTIFACT_ROOT=/config/artifacts
WORKDIR /app
COPY --from=base /usr/local/bin/node /usr/local/bin/node
COPY --from=build /app /app
COPY --from=build /app/apps/web/.next/static /app/apps/web/.next/standalone/apps/web/.next/static
COPY --from=build /app/content/playbooks /content/playbooks
COPY --from=build /app/catalog/seed-catalog.yaml /content/catalog/seed-catalog.yaml
COPY docker/all-in-one-entrypoint.sh /usr/local/bin/devrunbook-all-in-one
RUN groupadd --gid 1000 node \
    && useradd --uid 1000 --gid 1000 --create-home --shell /usr/sbin/nologin node \
    && mkdir -p /config/postgres /config/artifacts /config/operator-content /content/playbooks /content/catalog \
    && chown -R node:node /app /content \
    && chown -R postgres:postgres /config/postgres \
    && chown -R node:node /config/artifacts /config/operator-content \
    && chmod 0755 /usr/local/bin/devrunbook-all-in-one
EXPOSE 3000
VOLUME ["/config"]
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
  CMD ["node", "-e", "fetch('http://127.0.0.1:3000/health/ready').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
ENTRYPOINT ["/usr/local/bin/devrunbook-all-in-one"]