# Multi-stage production Dockerfile for Zyphon Gateway & Dashboard
#
# Production hardening (Compose/Kubernetes):
# - Runs as non-root `node` user in runtime stages
# - Mount config/data as volumes; optional read-only rootfs with tmpfs for /tmp
# - Drop Linux capabilities and set `read_only: true` on the gateway service in Compose
FROM node:20-alpine AS base
ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"
RUN corepack enable && corepack prepare pnpm@12.10.1 --activate

# Build Stage
FROM base AS builder
WORKDIR /app

COPY pnpm-lock.yaml pnpm-workspace.yaml package.json turbo.json tsconfig.base.json ./
COPY packages/ ./packages/
COPY apps/ ./apps/
COPY providers/ ./providers/
COPY sdks/ ./sdks/
COPY docs/openapi.json ./docs/openapi.json

RUN pnpm install --frozen-lockfile || pnpm install
RUN pnpm build

# 1. Gateway Runner Stage
FROM node:20-alpine AS gateway
WORKDIR /app
ENV NODE_ENV=production
RUN apk add --no-cache curl
RUN mkdir -p /app/config /app/data/logs /app/data/state && \
    chown -R node:node /app

COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/packages ./packages
COPY --from=builder /app/providers ./providers
COPY --from=builder /app/apps/gateway ./apps/gateway
COPY --from=builder /app/docs ./docs
COPY --from=builder /app/package.json ./package.json

USER node
EXPOSE 8080 8081
HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://127.0.0.1:8080/api/v1/health || exit 1

CMD ["node", "apps/gateway/dist/index.js"]

# 2. Dashboard Runner Stage
FROM node:20-alpine AS dashboard
WORKDIR /app
ENV NODE_ENV=production
ENV INTERNAL_GATEWAY_URL=http://gateway:8081
RUN apk add --no-cache curl
RUN mkdir -p /app && chown -R node:node /app

COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/packages ./packages
COPY --from=builder /app/apps/dashboard ./apps/dashboard
COPY --from=builder /app/package.json ./package.json

USER node
EXPOSE 3000
HEALTHCHECK --interval=20s --timeout=5s --start-period=10s --retries=3 \
  CMD curl -f http://127.0.0.1:3000 || exit 1

WORKDIR /app/apps/dashboard
CMD ["node_modules/.bin/next", "start", "-p", "3000"]