# syntax=docker/dockerfile:1.7
# UAT image for @karma/core (apps/core). Build context = monorepo root.
#   docker build -f deploy/Dockerfile.core -t karma/core2:$(git rev-parse --short HEAD) .
# Secrets are NOT baked in: apps/core/.env is mounted read-only at runtime.
ARG NODE_VERSION=20.19.4
ARG PNPM_VERSION=9.15.2

FROM node:${NODE_VERSION}-bookworm-slim AS base
ARG PNPM_VERSION
ENV PNPM_HOME=/pnpm \
    PATH=/pnpm:$PATH \
    npm_config_store_dir=/pnpm/store \
    CI=true
RUN corepack enable && corepack prepare pnpm@${PNPM_VERSION} --activate
WORKDIR /repo

# Full install + esbuild bundle (also compiles dist/migrations)
FROM base AS build
COPY . .
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
    pnpm install --frozen-lockfile --filter "@karma/core..."
RUN pnpm --filter @karma/core build

# Production dependencies only
FROM base AS prod-deps
COPY . .
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
    pnpm install --frozen-lockfile --prod --filter "@karma/core..."

FROM node:${NODE_VERSION}-bookworm-slim AS runtime
ENV NODE_ENV=production
WORKDIR /repo/apps/core
COPY --from=prod-deps /repo/node_modules /repo/node_modules
COPY --from=prod-deps /repo/packages /repo/packages
COPY --from=prod-deps /repo/apps/core /repo/apps/core
COPY --from=prod-deps /repo/package.json /repo/package.json
COPY --from=build /repo/apps/core/dist /repo/apps/core/dist
USER node
# Fail the build early if the native module is broken
RUN node -e "import('bcrypt').then(()=>console.log('bcrypt ok'))"
EXPOSE 9005
HEALTHCHECK --interval=15s --timeout=5s --start-period=40s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:9005/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
CMD ["node", "dist/index.js"]