# syntax=docker/dockerfile:1.7
FROM node:24.18.1-bookworm-slim@sha256:235600a8101ab264e117b1768e925532262668dc9b581ef1dd7d96ced463b8e7 AS web-build

WORKDIR /workspace
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
COPY apps/web/package.json apps/web/package.json
COPY packages/ui/package.json packages/ui/package.json
RUN npm install --global pnpm@10.33.0 \
    && pnpm install --frozen-lockfile --filter @itworx-mcp-hub/web...
COPY apps/web apps/web
RUN pnpm --filter @itworx-mcp-hub/web build

FROM python:3.13.14-slim@sha256:6771159cd4fa5d9bba1258caf0b82e6b73458c694d178ad97c5e925c2d0e1a91

COPY infrastructure/images/install-base-security-updates.sh /tmp/install-base-security-updates.sh
RUN sh /tmp/install-base-security-updates.sh \
    && rm /tmp/install-base-security-updates.sh

ARG SERVICE_NAME=itworx-mcp-hub-service
ARG GIT_REVISION
ARG GIT_SOURCE_TREE
ARG IMAGE_VERSION
ARG SOURCE_DATE_EPOCH
ARG BUILD_DATE

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH=/opt/venv/bin:$PATH \
    SERVICE_NAME=${SERVICE_NAME}

RUN groupadd --gid 10001 hub \
    && useradd --uid 10001 --gid 10001 --create-home --shell /usr/sbin/nologin hub

COPY pyproject.toml uv.lock /opt/hub/
RUN python -m pip install --no-cache-dir uv==0.10.0 \
    && cd /opt/hub \
    && UV_PROJECT_ENVIRONMENT=/opt/venv uv sync --locked --no-dev --no-install-project \
    && /usr/local/bin/python -m pip uninstall --yes uv

COPY packages /opt/hub/packages
COPY services /opt/hub/services
COPY scripts /opt/hub/scripts
COPY connectors /opt/hub/connectors
COPY catalog /opt/hub/catalog
COPY contracts /opt/hub/contracts
COPY plugins/itworx-gitea /opt/hub/plugins/itworx-gitea
COPY infrastructure/database /opt/hub/infrastructure/database
COPY --from=web-build /workspace/apps/web/dist /opt/hub/web-dist
RUN chown -R 10001:10001 /opt/hub

LABEL org.opencontainers.image.title="itworx-mcp-hub-${SERVICE_NAME}" \
      org.opencontainers.image.revision="${GIT_REVISION}" \
      org.opencontainers.image.source="https://gitea.example.com/jens/itworx-mcp-hub" \
      org.opencontainers.image.source-tree="${GIT_SOURCE_TREE}" \
      org.opencontainers.image.version="${IMAGE_VERSION}" \
      org.opencontainers.image.source-date-epoch="${SOURCE_DATE_EPOCH}" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.vendor="ITWorx"

WORKDIR /opt/hub
USER 10001:10001
EXPOSE 8080
ENTRYPOINT ["python", "-m", "services.runtime"]