# syntax=docker/dockerfile:1.7

# ---------------------------------------------------------------------------
# Build
#
# Nx and the Angular compiler need the whole workspace, so this stage is heavy
# and is thrown away: only `dist/landing/analog` crosses into the runtime image.
# ---------------------------------------------------------------------------
FROM node:22-alpine AS build

WORKDIR /app

ENV NX_DAEMON=false \
    CI=true \
    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1

# Manifests first, so a source-only change does not reinstall the world.
COPY package.json package-lock.json .npmrc ./

# `@pi/ui` comes from the private Nexus, so the install needs a token — passed
# as a BuildKit secret rather than a build ARG, which would be readable forever
# in the image history. The npmrc it lands in is written and removed inside one
# layer, so it leaves no trace even in this discarded stage.
RUN --mount=type=secret,id=nexus_token,required=true \
    sh -eu -c '\
      printf "//nexus.pireon.dev/repository/npm-releases/:_authToken=%s\n" \
        "$(cat /run/secrets/nexus_token)" > /tmp/npmrc; \
      NPM_CONFIG_USERCONFIG=/tmp/npmrc npm ci --no-audit --no-fund; \
      rm -f /tmp/npmrc'

COPY nx.json tsconfig.base.json eslint.config.mjs ./
COPY landing ./landing

RUN npx nx build landing

# ---------------------------------------------------------------------------
# Runtime
#
# Nitro vendors its own dependencies into the build output, so there is nothing
# to install here: the whole server is the 17 MB it copies.
# ---------------------------------------------------------------------------
FROM node:22-alpine AS runtime

WORKDIR /app

ENV NODE_ENV=production \
    PORT=3000 \
    HOST=0.0.0.0

# `node` already exists in the base image, unprivileged and with no shell login.
COPY --from=build --chown=node:node /app/dist/landing/analog ./analog

USER node

EXPOSE 3000

# Node rather than curl or wget: neither is in the base image, and adding one
# for a health check is a package more than the job needs.
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

CMD ["node", "analog/server/index.mjs"]