FROM node:20-bookworm-slim AS base
RUN apt-get update \
  && apt-get install -y --no-install-recommends git openssh-client ca-certificates python3 make g++ libcap2-bin \
  && rm -rf /var/lib/apt/lists/*
RUN corepack enable && corepack prepare pnpm@9.1.0 --activate

FROM base AS deps
WORKDIR /repo
COPY package.json pnpm-workspace.yaml ./
COPY packages/database/package.json packages/database/package.json
COPY packages/permissions/package.json packages/permissions/package.json
COPY packages/types/package.json packages/types/package.json
COPY services/ssh-git/package.json services/ssh-git/package.json
RUN pnpm install --frozen-lockfile=false --filter @khub/ssh-git... --filter @khub/database --filter @khub/permissions --filter @khub/types

FROM deps AS build
WORKDIR /repo
COPY packages/database packages/database
COPY packages/permissions packages/permissions
COPY packages/types packages/types
COPY services/ssh-git services/ssh-git
COPY tsconfig.base.json tsconfig.base.json
RUN pnpm --filter @khub/database generate
RUN pnpm --filter @khub/types build
RUN pnpm --filter @khub/permissions build
RUN pnpm --filter @khub/database build
RUN pnpm --filter @khub/ssh-git build

FROM base AS runtime
WORKDIR /repo
ENV NODE_ENV=production
COPY --from=build /repo/node_modules /repo/node_modules
COPY --from=build /repo/packages /repo/packages
COPY --from=build /repo/services/ssh-git/node_modules /repo/services/ssh-git/node_modules
COPY --from=build /repo/services/ssh-git/dist /repo/services/ssh-git/dist
COPY --from=build /repo/services/ssh-git/package.json /repo/services/ssh-git/package.json
COPY services/ssh-git/docker-entrypoint.sh /repo/docker-entrypoint.sh
WORKDIR /repo/services/ssh-git

RUN groupadd --gid 10001 app \
  && useradd --uid 10001 --gid app --home-dir /repo --shell /usr/sbin/nologin --system app \
  && mkdir -p /data/repos /data/ssh-host-keys \
  && chown -R app:app /repo /data \
  && chmod +x /repo/docker-entrypoint.sh \
  && setcap 'cap_net_bind_service=+ep' "$(readlink -f "$(command -v node)")"

EXPOSE 22
ENTRYPOINT ["/repo/docker-entrypoint.sh"]
