FROM node:24-alpine AS frontend-build

WORKDIR /app
ENV CI=true
ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
ENV npm_config_fetch_warn_timeout=60000
RUN corepack enable

ARG VITE_PROJECTBRAIN_API_URL=""
ARG VITE_PROJECTBRAIN_CLIENT_MODE="real"
ARG VITE_PROJECTBRAIN_RELEASE_TAG=""
ARG VITE_PROJECTBRAIN_COMMIT=""
ARG VITE_PROJECTBRAIN_BRANCH=""
ARG VITE_PROJECTBRAIN_BUILD_TIME=""
ARG VITE_PROJECTBRAIN_SOURCE=""
ENV VITE_PROJECTBRAIN_API_URL=$VITE_PROJECTBRAIN_API_URL
ENV VITE_PROJECTBRAIN_CLIENT_MODE=$VITE_PROJECTBRAIN_CLIENT_MODE
ENV VITE_PROJECTBRAIN_RELEASE_TAG=$VITE_PROJECTBRAIN_RELEASE_TAG
ENV VITE_PROJECTBRAIN_COMMIT=$VITE_PROJECTBRAIN_COMMIT
ENV VITE_PROJECTBRAIN_BRANCH=$VITE_PROJECTBRAIN_BRANCH
ENV VITE_PROJECTBRAIN_BUILD_TIME=$VITE_PROJECTBRAIN_BUILD_TIME
ENV VITE_PROJECTBRAIN_SOURCE=$VITE_PROJECTBRAIN_SOURCE

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
COPY backend/package.json backend/package.json
COPY packages/contracts/package.json packages/contracts/package.json
RUN pnpm install --frozen-lockfile --filter projectbrain... > /tmp/pnpm-install.log 2>&1 || (cat /tmp/pnpm-install.log; exit 1); awk 'index($0, "[W" "ARN] Request took") == 0 { print }' /tmp/pnpm-install.log

COPY packages/contracts packages/contracts
COPY index.html components.json postcss.config.js tailwind.config.ts tsconfig.json tsconfig.app.json tsconfig.node.json vite.config.ts ./
COPY public public
COPY src src
RUN pnpm run build

FROM node:24-alpine AS backend-build

WORKDIR /app
ENV CI=true
ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
ENV npm_config_fetch_warn_timeout=60000
ENV PRISMA_SKIP_POSTINSTALL_GENERATE=true
RUN apk add --no-cache openssl libc6-compat ca-certificates
RUN corepack enable

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
COPY backend/package.json backend/package.json
COPY packages/contracts/package.json packages/contracts/package.json
RUN pnpm install --frozen-lockfile --filter projectbrain-api... > /tmp/pnpm-install.log 2>&1 || (cat /tmp/pnpm-install.log; exit 1); awk 'index($0, "[W" "ARN] Request took") == 0 { print }' /tmp/pnpm-install.log

COPY packages/contracts packages/contracts
COPY backend backend
WORKDIR /app/backend
RUN pnpm run prisma:generate && pnpm run build
WORKDIR /app
RUN pnpm --filter projectbrain-api deploy --prod --legacy /runtime
RUN cp -R /app/backend/dist /runtime/dist \
    && cd /runtime \
    && ./node_modules/.bin/prisma generate --schema prisma/schema.prisma

# trivy:ignore:DS-0002 -- Accepted v1.0 single-container exception: the init
# process must create/chown the persistent PostgreSQL volume and then starts
# PostgreSQL as the dedicated postgres user. Nginx drops worker privileges and
# the Fastify service has no Docker socket or additional Linux capabilities.
FROM node:24-alpine

WORKDIR /app
ENV NODE_ENV=production
ENV HOST=127.0.0.1
ENV PORT=4000
ENV PROJECTBRAIN_DATA_SOURCE=database
ENV PROJECTBRAIN_SEED_ON_START=true
ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0

RUN apk add --no-cache nginx openssl libc6-compat ca-certificates curl postgresql16 postgresql16-client
RUN rm -rf /usr/local/lib/node_modules/corepack /usr/local/lib/node_modules/npm \
    /usr/local/bin/corepack /usr/local/bin/npm /usr/local/bin/npx \
    /usr/local/bin/pnpm /usr/local/bin/pnpx

COPY --from=backend-build /runtime /app/backend
COPY --from=frontend-build /app/dist /usr/share/nginx/html
COPY docker/nginx.single.conf /etc/nginx/http.d/default.conf
COPY scripts/unraid-single-entrypoint.sh /usr/local/bin/projectbrain-unraid-entrypoint.sh

RUN chmod +x /usr/local/bin/projectbrain-unraid-entrypoint.sh

EXPOSE 80
VOLUME ["/var/lib/projectbrain"]

HEALTHCHECK --interval=15s --timeout=5s --start-period=35s --retries=10 CMD curl -fsS http://127.0.0.1/api/system/readiness >/dev/null || exit 1

CMD ["sh", "/usr/local/bin/projectbrain-unraid-entrypoint.sh"]