# Build context is the repository root (workspace build):
#   docker build -f apps/web/Dockerfile .

FROM node:22.15.1-alpine AS build
ARG APP_VERSION=0.0.0-dev
WORKDIR /repo
RUN npm install -g pnpm@11
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json tsconfig.base.json ./
COPY packages/shared ./packages/shared
COPY packages/plugin-sdk ./packages/plugin-sdk
COPY apps/web ./apps/web
COPY deploy/fonts ./deploy/fonts
# Build the workspace deps (shared + plugin-sdk), then download the catalog
# fonts into the web app (ADR 0016: self-hosted, baked into the image — never
# fetched from a visitor's browser), then build. The font step fails the image
# build if a family lacks license info.
RUN pnpm install --frozen-lockfile --filter @dorfteich/web... \
  && pnpm --filter @dorfteich/shared build \
  && pnpm --filter @dorfteich/plugin-sdk build \
  && node deploy/fonts/build-fonts.mjs \
  && VITE_APP_VERSION=${APP_VERSION} pnpm --filter @dorfteich/web build

# nginx-unprivileged runs as uid 101 and listens on 8080 — no root needed.
FROM nginxinc/nginx-unprivileged:1.27-alpine
COPY apps/web/nginx.conf /etc/nginx/conf.d/default.conf
COPY --from=build /repo/apps/web/dist /usr/share/nginx/html
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
  CMD wget -q -O /dev/null http://127.0.0.1:8080/healthz || exit 1