# syntax=docker/dockerfile:1.7
# All-in-one EvoFirewall (Fastify + SPA + SQLite). Analog evobgp-all.
# Install slugs GET /{slug} stay on the same process — do not split nginx.
ARG BASE_NODE=docker.io/library/node:22-alpine

FROM ${BASE_NODE} AS deps
WORKDIR /repo
RUN apk add --no-cache python3 make g++ \
    && corepack enable && corepack prepare pnpm@10.12.1 --activate
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml turbo.json ./
COPY apps/web/package.json apps/web/
COPY apps/api/package.json apps/api/
COPY packages/ui/package.json packages/ui/
COPY packages/shared/package.json packages/shared/
COPY packages/db/package.json packages/db/
RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
    pnpm install --frozen-lockfile

FROM deps AS api-build
COPY apps/api apps/api
COPY packages/shared packages/shared
COPY packages/db packages/db
RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
    pnpm turbo build --filter=@evofw/api \
    && pnpm --filter @evofw/api deploy --prod /out \
    && find /out -mindepth 1 -maxdepth 1 ! -name dist ! -name node_modules ! -name package.json -exec rm -rf {} + \
    && find /out -name '*.map' -delete

FROM deps AS web-build
COPY apps/web apps/web
COPY packages/ui packages/ui
COPY packages/shared packages/shared
RUN pnpm turbo build --filter=@evofw/web

FROM ${BASE_NODE} AS runtime
WORKDIR /app
RUN apk add --no-cache ca-certificates
ARG VERSION=dev
ARG GIT_SHA=unknown
ARG BUILD_TIME=
ENV NODE_ENV=production \
    STATIC_DIR=/app/static \
    DATABASE_URL=sqlite:/data/app.db \
    SERVER_PORT=8080 \
    APP_VERSION=${VERSION} \
    GIT_SHA=${GIT_SHA} \
    BUILD_TIME=${BUILD_TIME}
COPY --from=api-build /out ./
COPY --from=web-build /repo/apps/web/dist ./static
COPY deploy/docker/evofw/sqlite-backup.mjs ./tools/sqlite-backup.mjs
EXPOSE 8080
VOLUME ["/data"]
HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
  CMD ["node", "-e", "fetch('http://127.0.0.1:'+(process.env.SERVER_PORT||8080)+'/ready',{signal:AbortSignal.timeout(4000)}).then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
STOPSIGNAL SIGTERM
CMD ["node", "dist/server.js"]