# syntax=docker/dockerfile:1.7

# base node image
FROM --platform=linux/amd64 node:20-bookworm-slim AS base

# set for base and all layer that inherit from it
ENV NODE_ENV="production"
ENV CI="true"
ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"

# Install openssl for Prisma and curl for Coolify HTTP health checks.
RUN apt-get update \
  && apt-get install -y --no-install-recommends openssl curl \
  && rm -rf /var/lib/apt/lists/* \
  && corepack enable \
  && corepack prepare pnpm@10.33.0 --activate

# Install all node_modules, including dev dependencies
FROM base AS deps

WORKDIR /myapp

ADD package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ADD prisma prisma
COPY apps/api/package.json apps/api/package.json
COPY apps/hocuspocus/package.json apps/hocuspocus/package.json
COPY apps/mobile/package.json apps/mobile/package.json
COPY apps/storybook/package.json apps/storybook/package.json
COPY apps/web/package.json apps/web/package.json
COPY apps/worker/package.json apps/worker/package.json
COPY packages/activity/package.json packages/activity/package.json
COPY packages/api-client-ts/package.json packages/api-client-ts/package.json
COPY packages/api-types/package.json packages/api-types/package.json
COPY packages/brand/package.json packages/brand/package.json
COPY packages/captcha/package.json packages/captcha/package.json
COPY packages/cli/package.json packages/cli/package.json
COPY packages/config/package.json packages/config/package.json
COPY packages/create-toolctrl/package.json packages/create-toolctrl/package.json
COPY packages/db/package.json packages/db/package.json
COPY packages/email-sequences/package.json packages/email-sequences/package.json
COPY packages/email-templates/package.json packages/email-templates/package.json
COPY packages/entitlements/package.json packages/entitlements/package.json
COPY packages/error-reporter/package.json packages/error-reporter/package.json
COPY packages/exports/package.json packages/exports/package.json
COPY packages/feature-flags/package.json packages/feature-flags/package.json
COPY packages/form-widget/package.json packages/form-widget/package.json
COPY packages/foundation/package.json packages/foundation/package.json
COPY packages/i18n/package.json packages/i18n/package.json
COPY packages/imports/package.json packages/imports/package.json
COPY packages/logger/package.json packages/logger/package.json
COPY packages/mail/package.json packages/mail/package.json
COPY packages/marketing-outbound/package.json packages/marketing-outbound/package.json
COPY packages/metrics/package.json packages/metrics/package.json
COPY packages/observability/package.json packages/observability/package.json
COPY packages/plugin-runtime/package.json packages/plugin-runtime/package.json
COPY packages/plugin-sdk/package.json packages/plugin-sdk/package.json
COPY packages/plugins/package.json packages/plugins/package.json
COPY packages/queue/package.json packages/queue/package.json
COPY packages/realtime/package.json packages/realtime/package.json
COPY packages/search/package.json packages/search/package.json
COPY packages/shared-store/package.json packages/shared-store/package.json
COPY packages/shared/package.json packages/shared/package.json
COPY packages/storage/package.json packages/storage/package.json
COPY packages/ui-app/package.json packages/ui-app/package.json
COPY packages/ui-mock/package.json packages/ui-mock/package.json
COPY packages/ui-subframe/package.json packages/ui-subframe/package.json
COPY packages/ui/package.json packages/ui/package.json
COPY packages/url/package.json packages/url/package.json
COPY packages/view-models/package.json packages/view-models/package.json
# patchedDependencies (package.json) referenzieren Dateien in patches/ — diese muessen vor
# `pnpm fetch`/`pnpm install` im Build-Context liegen, sonst ERR_PNPM_PATCH_NOT_FOUND.
COPY patches ./patches
RUN --mount=type=cache,id=toolctrl-pnpm-store,target=/pnpm/store \
  pnpm fetch --frozen-lockfile
RUN --mount=type=cache,id=toolctrl-pnpm-store,target=/pnpm/store \
  pnpm install --frozen-lockfile --prod=false --offline

# Setup production node_modules
FROM base AS production-deps

WORKDIR /myapp

COPY --from=deps /myapp /myapp
RUN pnpm prune --prod

# Prepare shared build inputs. Runtime-specific stages below own their
# target builds so web build args do not bust API/worker cache paths.
FROM base AS build

ENV DATABASE_URL="postgresql://toolctrl:toolctrl@localhost:5432/toolctrl?schema=public"
ENV NODE_OPTIONS="--max-old-space-size=4096"

WORKDIR /myapp

COPY --from=deps /myapp/node_modules /myapp/node_modules
COPY --from=deps /myapp/apps /myapp/apps
COPY --from=deps /myapp/packages /myapp/packages

ADD package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ADD prisma prisma
ADD prisma.config.ts prisma.config.ts
ADD tsconfig.json tsconfig.json
ADD packages/db packages/db

ADD . .
RUN pnpm --filter @toolctrl/db prisma:generate
RUN pnpm --filter @toolctrl/db build

# Generate a pnpm-list-based SBOM and ship it inside each runtime image at
# /myapp/sbom-pnpm.json (see scripts/generate-sbom.mjs). Failures must not
# break the build; the SBOM is an audit-traceability artifact, not a gate.
RUN node scripts/generate-sbom.mjs || echo "SBOM generation skipped"

# GeoIP-DB (AD-22): lokale, EU-konforme Land-Auflösung ins Image backen. Non-fatal —
# schlägt der Download fehl, bleibt das Verzeichnis leer und die Auflösung ist zur Laufzeit ein Stub.
RUN bash scripts/update-geoip-db.sh || echo "GeoIP-DB-Download übersprungen"

FROM build AS web-build
# VITE_* build args — Vite inlines these into the client bundle at build time.
# Set as build-time env vars in Coolify (is_buildtime=true). Defaults are empty
# so the build still succeeds when unset; client code falls back to no-op.
ARG VITE_SENTRY_DSN_WEB=""
ARG VITE_SENTRY_ENVIRONMENT=""
ARG VITE_SENTRY_RELEASE=""
ARG VITE_SENTRY_TRACES_SAMPLE_RATE=""
ARG VITE_SENTRY_REPLAYS_SESSION_SAMPLE_RATE=""
ARG VITE_SENTRY_REPLAYS_ON_ERROR_SAMPLE_RATE=""
ARG VITE_OTEL_EXPORTER_OTLP_ENDPOINT=""
ARG VITE_OTEL_PROPAGATE_API_HOST=""
ARG VITE_OTEL_SERVICE_NAME=""
ARG VITE_API_HOST=""
ARG VITE_APP_REVISION=""
ENV VITE_SENTRY_DSN_WEB="${VITE_SENTRY_DSN_WEB}"
ENV VITE_SENTRY_ENVIRONMENT="${VITE_SENTRY_ENVIRONMENT}"
ENV VITE_SENTRY_RELEASE="${VITE_SENTRY_RELEASE}"
ENV VITE_SENTRY_TRACES_SAMPLE_RATE="${VITE_SENTRY_TRACES_SAMPLE_RATE}"
ENV VITE_SENTRY_REPLAYS_SESSION_SAMPLE_RATE="${VITE_SENTRY_REPLAYS_SESSION_SAMPLE_RATE}"
ENV VITE_SENTRY_REPLAYS_ON_ERROR_SAMPLE_RATE="${VITE_SENTRY_REPLAYS_ON_ERROR_SAMPLE_RATE}"
ENV VITE_OTEL_EXPORTER_OTLP_ENDPOINT="${VITE_OTEL_EXPORTER_OTLP_ENDPOINT}"
ENV VITE_OTEL_PROPAGATE_API_HOST="${VITE_OTEL_PROPAGATE_API_HOST}"
ENV VITE_OTEL_SERVICE_NAME="${VITE_OTEL_SERVICE_NAME}"
ENV VITE_API_HOST="${VITE_API_HOST}"
ENV VITE_APP_REVISION="${VITE_APP_REVISION}"
RUN pnpm --filter @toolctrl/web build

FROM build AS api-build
RUN pnpm --filter @toolctrl/api build

FROM build AS worker-build
RUN pnpm --filter @toolctrl/worker build

FROM web-build AS web-runtime-artifacts
RUN find /myapp/build /myapp/apps/web/build -type f -name '*.map' -delete

FROM api-build AS api-runtime-artifacts
RUN find /myapp/apps/api/dist -type f -name '*.map' -delete

FROM worker-build AS worker-runtime-artifacts
RUN find /myapp/apps/worker/dist -type f -name '*.map' -delete

# Build the worker runtime image
FROM base AS worker

ARG APP_REVISION=unknown
ENV NODE_ENV="production"
ENV WORKER_ENABLED="true"
# Default WORKER_QUEUE_GROUP for image users that don't set it explicitly.
# In production each replica overrides this via docker-compose / K8s env to
# one of {general, mail, import, webhook, plugin}. See docs/ops/worker-queues.md.
ENV WORKER_QUEUE_GROUP="general"
ENV WORKER_HEALTH_PORT="9100"
ENV WORKER_ADMIN_PORT="9101"
ENV APP_REVISION="${APP_REVISION}"
LABEL org.opencontainers.image.revision="${APP_REVISION}"
LABEL org.opencontainers.image.sbom="/myapp/sbom-pnpm.json"

WORKDIR /myapp

COPY --from=production-deps /myapp/node_modules /myapp/node_modules

COPY --from=build /myapp/package.json /myapp/package.json
COPY --from=build /myapp/pnpm-lock.yaml /myapp/pnpm-lock.yaml
COPY --from=build /myapp/pnpm-workspace.yaml /myapp/pnpm-workspace.yaml
COPY --from=build /myapp/tsconfig.json /myapp/tsconfig.json
COPY --from=build /myapp/sbom-pnpm.json /myapp/sbom-pnpm.json
COPY --from=build /myapp/apps/worker/package.json /myapp/apps/worker/package.json
COPY --from=deps /myapp/apps/worker/node_modules /myapp/apps/worker/node_modules
COPY --from=worker-runtime-artifacts /myapp/apps/worker/dist /myapp/apps/worker/dist
COPY --from=build /myapp/packages/brand /myapp/packages/brand
COPY --from=build /myapp/packages/config /myapp/packages/config
COPY --from=build /myapp/packages/db /myapp/packages/db
COPY --from=deps /myapp/packages/db/node_modules /myapp/packages/db/node_modules
COPY --from=build /myapp/packages/db/generated/prisma/client /myapp/packages/db/generated/prisma/client
COPY --from=build /myapp/packages/email-sequences /myapp/packages/email-sequences
COPY --from=build /myapp/packages/entitlements /myapp/packages/entitlements
COPY --from=build /myapp/packages/error-reporter /myapp/packages/error-reporter
COPY --from=build /myapp/packages/exports /myapp/packages/exports
COPY --from=deps /myapp/packages/exports/node_modules /myapp/packages/exports/node_modules
COPY --from=build /myapp/packages/form-widget /myapp/packages/form-widget
COPY --from=deps /myapp/packages/form-widget/node_modules /myapp/packages/form-widget/node_modules
COPY --from=build /myapp/packages/imports /myapp/packages/imports
COPY --from=build /myapp/packages/logger /myapp/packages/logger
COPY --from=deps /myapp/packages/logger/node_modules /myapp/packages/logger/node_modules
COPY --from=build /myapp/packages/mail /myapp/packages/mail
COPY --from=deps /myapp/packages/mail/node_modules /myapp/packages/mail/node_modules
COPY --from=build /myapp/packages/marketing-outbound /myapp/packages/marketing-outbound
COPY --from=build /myapp/packages/metrics /myapp/packages/metrics
COPY --from=deps /myapp/packages/metrics/node_modules /myapp/packages/metrics/node_modules
COPY --from=build /myapp/packages/observability /myapp/packages/observability
COPY --from=deps /myapp/packages/observability/node_modules /myapp/packages/observability/node_modules
COPY --from=build /myapp/packages/plugin-runtime /myapp/packages/plugin-runtime
COPY --from=deps /myapp/packages/plugin-runtime/node_modules /myapp/packages/plugin-runtime/node_modules
COPY --from=build /myapp/packages/queue /myapp/packages/queue
COPY --from=deps /myapp/packages/queue/node_modules /myapp/packages/queue/node_modules
COPY --from=build /myapp/packages/search /myapp/packages/search
COPY --from=deps /myapp/packages/search/node_modules /myapp/packages/search/node_modules
COPY --from=build /myapp/packages/shared-store /myapp/packages/shared-store
COPY --from=deps /myapp/packages/shared-store/node_modules /myapp/packages/shared-store/node_modules
COPY --from=build /myapp/packages/storage /myapp/packages/storage
COPY --from=deps /myapp/packages/storage/node_modules /myapp/packages/storage/node_modules
COPY --from=build /myapp/prisma /myapp/prisma
COPY --from=build /myapp/prisma.config.ts /myapp/prisma.config.ts

USER node

HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \
  CMD node apps/worker/dist/health.js

CMD ["node", "apps/worker/dist/index.js"]

# Build the API runtime image
FROM base AS api

ARG APP_REVISION=unknown
ENV PORT="8080"
ENV NODE_ENV="production"
ENV APP_REVISION="${APP_REVISION}"
LABEL org.opencontainers.image.revision="${APP_REVISION}"
LABEL org.opencontainers.image.sbom="/myapp/sbom-pnpm.json"
EXPOSE 8080

WORKDIR /myapp

COPY --from=production-deps /myapp/node_modules /myapp/node_modules

COPY --from=build /myapp/package.json /myapp/package.json
COPY --from=build /myapp/pnpm-lock.yaml /myapp/pnpm-lock.yaml
COPY --from=build /myapp/pnpm-workspace.yaml /myapp/pnpm-workspace.yaml
COPY --from=build /myapp/sbom-pnpm.json /myapp/sbom-pnpm.json
COPY --from=build /myapp/apps/api/package.json /myapp/apps/api/package.json
COPY --from=deps /myapp/apps/api/node_modules /myapp/apps/api/node_modules
COPY --from=api-runtime-artifacts /myapp/apps/api/dist /myapp/apps/api/dist
COPY --from=build /myapp/packages/config /myapp/packages/config
COPY --from=build /myapp/packages/db /myapp/packages/db
COPY --from=deps /myapp/packages/db/node_modules /myapp/packages/db/node_modules
COPY --from=build /myapp/packages/db/generated/prisma/client /myapp/packages/db/generated/prisma/client
COPY --from=build /myapp/packages/error-reporter /myapp/packages/error-reporter
COPY --from=build /myapp/packages/foundation /myapp/packages/foundation
COPY --from=build /myapp/packages/i18n /myapp/packages/i18n
COPY --from=deps /myapp/packages/i18n/node_modules /myapp/packages/i18n/node_modules
COPY --from=build /myapp/packages/logger /myapp/packages/logger
COPY --from=deps /myapp/packages/logger/node_modules /myapp/packages/logger/node_modules
COPY --from=build /myapp/packages/queue /myapp/packages/queue
COPY --from=deps /myapp/packages/queue/node_modules /myapp/packages/queue/node_modules
COPY --from=build /myapp/packages/realtime /myapp/packages/realtime
COPY --from=build /myapp/packages/storage /myapp/packages/storage
COPY --from=deps /myapp/packages/storage/node_modules /myapp/packages/storage/node_modules
COPY --from=build /myapp/packages/url /myapp/packages/url
COPY --from=build /myapp/prisma /myapp/prisma
COPY --from=build /myapp/prisma.config.ts /myapp/prisma.config.ts

USER node

HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \
  CMD curl -fsS "http://127.0.0.1:${API_PORT:-${PORT}}/healthz" >/dev/null || exit 1

CMD ["node", "apps/api/dist/server.js"]

# Finally, build the production web image with minimal footprint
FROM base AS web

ARG APP_REVISION=unknown
ENV PORT="8080"
ENV NODE_ENV="production"
ENV APP_REVISION="${APP_REVISION}"
LABEL org.opencontainers.image.revision="${APP_REVISION}"
LABEL org.opencontainers.image.sbom="/myapp/sbom-pnpm.json"
EXPOSE 8080

WORKDIR /myapp

COPY --from=production-deps /myapp/node_modules /myapp/node_modules

COPY --from=web-runtime-artifacts /myapp/build /myapp/build
COPY --from=web-runtime-artifacts /myapp/build/server-runtime /myapp/build/server-runtime
COPY --from=build /myapp/pnpm-workspace.yaml /myapp/pnpm-workspace.yaml
COPY --from=build /myapp/tsconfig.json /myapp/tsconfig.json
COPY --from=build /myapp/sbom-pnpm.json /myapp/sbom-pnpm.json
COPY --from=build /myapp/apps/web/package.json /myapp/apps/web/package.json
COPY --from=deps /myapp/apps/web/node_modules /myapp/apps/web/node_modules
COPY --from=web-runtime-artifacts /myapp/apps/web/build /myapp/apps/web/build
COPY --from=build /myapp/apps/web/public /myapp/apps/web/public
COPY --from=build /myapp/apps/api/package.json /myapp/apps/api/package.json
COPY --from=build /myapp/apps/api/src /myapp/apps/api/src
COPY --from=build /myapp/package.json /myapp/package.json
COPY --from=build /myapp/start.sh /myapp/start.sh
COPY --from=build /myapp/packages/brand /myapp/packages/brand
COPY --from=build /myapp/packages/config /myapp/packages/config
COPY --from=build /myapp/packages/db /myapp/packages/db
COPY --from=deps /myapp/packages/db/node_modules /myapp/packages/db/node_modules
COPY --from=build /myapp/packages/entitlements /myapp/packages/entitlements
COPY --from=build /myapp/packages/exports /myapp/packages/exports
COPY --from=deps /myapp/packages/exports/node_modules /myapp/packages/exports/node_modules
COPY --from=build /myapp/packages/i18n /myapp/packages/i18n
COPY --from=deps /myapp/packages/i18n/node_modules /myapp/packages/i18n/node_modules
COPY --from=build /myapp/packages/imports /myapp/packages/imports
COPY --from=build /myapp/packages/logger /myapp/packages/logger
COPY --from=deps /myapp/packages/logger/node_modules /myapp/packages/logger/node_modules
COPY --from=build /myapp/packages/mail /myapp/packages/mail
COPY --from=deps /myapp/packages/mail/node_modules /myapp/packages/mail/node_modules
COPY --from=build /myapp/packages/queue /myapp/packages/queue
COPY --from=deps /myapp/packages/queue/node_modules /myapp/packages/queue/node_modules
COPY --from=build /myapp/packages/storage /myapp/packages/storage
COPY --from=deps /myapp/packages/storage/node_modules /myapp/packages/storage/node_modules
COPY --from=build /myapp/packages/ui /myapp/packages/ui
COPY --from=build /myapp/packages/url /myapp/packages/url
COPY --from=build /myapp/packages/view-models /myapp/packages/view-models
COPY --from=build /myapp/prisma /myapp/prisma
COPY --from=build /myapp/prisma.config.ts /myapp/prisma.config.ts
# GeoIP-DB (AD-22) ins Web-Runtime-Image; absoluter Pfad gegen cwd-Ambiguität.
COPY --from=build /myapp/data/geoip /myapp/data/geoip
ENV GEOIP_DB_PATH="/myapp/data/geoip/dbip-country-lite.mmdb"

RUN chmod +x /myapp/start.sh

USER node

HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \
  CMD curl -fsS "http://127.0.0.1:${PORT}/healthz" >/dev/null || exit 1

ENTRYPOINT [ "./start.sh" ]