FROM node:20-bookworm-slim AS base
RUN apt-get update \
  && apt-get install -y --no-install-recommends git ca-certificates curl openssl \
  && rm -rf /var/lib/apt/lists/*
RUN corepack enable && corepack prepare pnpm@9.1.0 --activate

FROM base AS deps
WORKDIR /repo
COPY package.json pnpm-workspace.yaml ./
COPY apps/api/package.json apps/api/package.json
COPY packages/database/package.json packages/database/package.json
COPY packages/types/package.json packages/types/package.json
COPY packages/permissions/package.json packages/permissions/package.json
RUN pnpm install --frozen-lockfile=false --filter @khub/api... --filter @khub/database --filter @khub/types --filter @khub/permissions

FROM deps AS build
WORKDIR /repo
COPY packages/database packages/database
COPY packages/types packages/types
COPY packages/permissions packages/permissions
COPY apps/api apps/api
COPY tsconfig.base.json tsconfig.base.json
RUN pnpm --filter @khub/database generate
RUN pnpm --filter @khub/types build
RUN pnpm --filter @khub/permissions build
RUN pnpm --filter @khub/database build
RUN pnpm --filter @khub/api build

FROM base AS runtime
WORKDIR /repo
ENV NODE_ENV=production
COPY --from=build /repo/package.json /repo/pnpm-workspace.yaml /repo/tsconfig.base.json ./
COPY --from=build /repo/node_modules /repo/node_modules
COPY --from=build /repo/packages /repo/packages
COPY --from=build /repo/apps/api/node_modules /repo/apps/api/node_modules
COPY --from=build /repo/apps/api/dist /repo/apps/api/dist
COPY --from=build /repo/apps/api/package.json /repo/apps/api/package.json
COPY apps/api/docker-entrypoint.sh /repo/docker-entrypoint.sh
RUN chmod +x /repo/docker-entrypoint.sh

RUN groupadd --gid 10001 app \
  && useradd --uid 10001 --gid app --home-dir /repo --shell /usr/sbin/nologin --system app \
  && mkdir -p /data/repos /data/ci /data/release-assets /data/uploads \
  && chown -R app:app /repo /data

EXPOSE 4000
ENTRYPOINT ["/repo/docker-entrypoint.sh"]
