# Build context is the repository root (workspace build):
#   docker build -f apps/backup/Dockerfile .

FROM node:22.15.1-alpine AS build
WORKDIR /repo
RUN npm install -g pnpm@11
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json tsconfig.base.json ./
COPY packages/shared ./packages/shared
COPY apps/backup ./apps/backup
RUN pnpm install --frozen-lockfile --filter @dorfteich/backup... \
  && pnpm --filter @dorfteich/shared build \
  && pnpm --filter @dorfteich/backup build \
  # Self-contained production bundle (prod deps only) at /out.
  && pnpm --filter @dorfteich/backup deploy --prod --legacy /out \
  && cp -r apps/backup/dist /out/dist

FROM node:22.15.1-alpine
ARG APP_VERSION=0.0.0-dev
ENV NODE_ENV=production APP_VERSION=${APP_VERSION} \
    # Baked-in volume paths (self-sufficient without compose env, like the
    # api image's PLUGINS_DIR — issue #71's lesson).
    BACKUPS_DIR=/backups UPLOADS_DIR=/data/uploads PLUGINS_DIR=/data/plugins \
    SECRETS_FILE=/data/secrets/secrets.env
# pg_dump/pg_restore matching the stack's postgres:17 server, GNU tar for the
# volume archives, tzdata so BACKUP_TIME honors a configured TZ, and
# rsync + ssh for the optional off-host mirror (issue #84).
RUN apk add --no-cache postgresql17-client tar tzdata rsync openssh-client \
  && mkdir -p /backups && chown node:node /backups
WORKDIR /app
COPY --from=build --chown=node:node /out /app
USER node
CMD ["node", "dist/index.js"]