FROM node:22-alpine AS base
WORKDIR /app
RUN corepack enable
RUN apk add --no-cache openssl

FROM base AS deps
COPY package.json pnpm-workspace.yaml turbo.json tsconfig.base.json ./
COPY apps/webui/package.json apps/webui/package.json
COPY apps/bot/package.json apps/bot/package.json
COPY packages/shared/package.json packages/shared/package.json
RUN pnpm install --frozen-lockfile=false

FROM deps AS build
COPY apps ./apps
COPY packages ./packages
COPY eslint.config.js .eslintrc.cjs .prettierrc ./
RUN pnpm install --frozen-lockfile=false
RUN pnpm --filter @nexumi/shared build
RUN pnpm --filter @nexumi/webui prisma:generate
# `next build` statically evaluates route/module code while collecting page
# data. Our env schema and Prisma client are validated eagerly at import
# time, so the build needs *some* well-formed values even though no real
# secrets or network access are available at build time. These placeholders
# are only used for that static analysis step and are always overridden by
# the real values from `.env` (via docker-compose `env_file`) at container
# start, since this ENV only applies to this intermediate build stage and is
# never copied into the `runner` stage / final image.
# Note: this intentionally triggers a "SecretsUsedInArgOrEnv" lint warning
# because of the variable names — the values below are non-sensitive
# placeholders, not real secrets.
ENV NODE_ENV=production \
    DATABASE_URL=postgresql://build:build@localhost:5432/build \
    REDIS_URL=redis://localhost:6379 \
    BOT_CLIENT_ID=0000000000000000000 \
    BOT_CLIENT_SECRET=build-time-placeholder \
    WEBUI_URL=http://localhost:3000 \
    SESSION_SECRET=build-time-placeholder-session-secret-32chars \
    DEFAULT_LOCALE=de
RUN pnpm --filter @nexumi/webui build

FROM base AS runner
ENV NODE_ENV=production
COPY --from=build /app/apps/webui/.next/standalone ./
COPY --from=build /app/apps/webui/.next/static ./apps/webui/.next/static
COPY --from=build /app/apps/webui/public ./apps/webui/public
EXPOSE 3000
HEALTHCHECK --interval=15s --timeout=5s --start-period=30s --retries=5 \
  CMD node -e "fetch('http://127.0.0.1:3000/api/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
CMD ["node", "apps/webui/server.js"]