# syntax=docker/dockerfile:1
FROM node:24-bookworm-slim AS dependencies
WORKDIR /app
COPY package.json package-lock.json .npmrc ./
COPY scripts/prepare.mjs ./scripts/prepare.mjs
RUN npm ci --ignore-scripts && npm rebuild argon2

FROM dependencies AS build
COPY vite.config.ts tsconfig.json ./
COPY src ./src
COPY static ./static
RUN npm run build:app

FROM node:24-bookworm-slim AS runtime-dependencies
WORKDIR /app
COPY package.json package-lock.json .npmrc ./
COPY scripts/prepare.mjs ./scripts/prepare.mjs
RUN npm ci --omit=dev --ignore-scripts && npm rebuild argon2 && npm cache clean --force

FROM node:24-bookworm-slim AS runtime
ARG TARGETARCH=amd64
ARG INFISICAL_CLI_VERSION=0.43.116
LABEL org.opencontainers.image.title="shd-build"
ENV NODE_ENV=production \
	HOST=0.0.0.0 \
	PORT=3000 \
	INFISICAL_DOMAIN=https://secrets.jb.codes \
	INFISICAL_DISABLE_UPDATE_CHECK=true \
	TDR_DATABASE_PATH=/app/data/shd-build.db \
	TDR_AVATAR_STORAGE_PATH=/app/data/avatars \
	TDR_GAME_ICON_STORAGE_PATH=/app/data/game-icons
WORKDIR /app
RUN apt-get update \
	&& apt-get install -y --no-install-recommends ca-certificates curl gosu \
	&& useradd --uid 10001 --gid node --no-create-home --shell /usr/sbin/nologin shd-runtime \
	&& case "$TARGETARCH" in \
		amd64) infisical_sha256=53abc96a3bc872ade81efe156275bd30c53f9ee8b52965b0c9cb320a9c814fbc ;; \
		arm64) infisical_sha256=0111d8e7daa5f3c498a8cc6cb9852bde2c5c21e53c935d4738ddd80c764554cc ;; \
		*) echo "Unsupported Infisical CLI architecture: $TARGETARCH" >&2; exit 1 ;; \
	esac \
	&& curl -fsSL "https://github.com/Infisical/cli/releases/download/v${INFISICAL_CLI_VERSION}/cli_${INFISICAL_CLI_VERSION}_linux_${TARGETARCH}.tar.gz" -o /tmp/infisical.tar.gz \
	&& echo "$infisical_sha256  /tmp/infisical.tar.gz" | sha256sum -c - \
	&& tar -xzf /tmp/infisical.tar.gz -C /usr/local/bin infisical \
	&& chmod 755 /usr/local/bin/infisical \
	&& rm -f /tmp/infisical.tar.gz \
	&& rm -rf /var/lib/apt/lists/*
COPY --from=runtime-dependencies --chown=node:node /app/node_modules ./node_modules
COPY --from=build --chown=node:node /app/build ./build
COPY --chown=node:node database ./database
COPY --chown=node:node scripts ./scripts
COPY --chown=node:node deploy/container-entrypoint.sh ./deploy/container-entrypoint.sh
RUN chmod 755 ./deploy/container-entrypoint.sh ./scripts/runtime-launcher.mjs && mkdir -p /app/data && chown node:node /app/data && chmod 0770 /app/data
EXPOSE 3000
VOLUME ["/app/data"]
ENTRYPOINT ["./deploy/container-entrypoint.sh"]
CMD ["serve"]