# GoChat Dockerfile — Multi-stage build with security hardening
# Reference: Chatwoot docker/Dockerfile multi-stage pattern + security best practices

# ========== Frontend Build Stage ==========
FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS frontend-builder

ARG SOURCE_DATE_EPOCH=0
ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}

WORKDIR /app

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
COPY frontend/package.json frontend/package.json
RUN corepack enable && pnpm install --frozen-lockfile

COPY frontend/ frontend/
RUN pnpm --dir frontend test:build

# ========== Go Build Stage ==========
FROM golang:1.25.13-alpine@sha256:1e0126852075c9c60731c8ba49088448b91f63e2aed97ca9d1a9791622a05946 AS builder

# Build arguments for version injection
ARG VERSION=dev
ARG COMMIT_SHA=unknown
ARG BUILD_DATE=unknown
ARG SOURCE_DATE_EPOCH=0
ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}

WORKDIR /app

# Dependency layer — cached unless go.mod/go.sum change
COPY backend/go.mod backend/go.sum ./
COPY backend/internal/pgvector_stub/ ./internal/pgvector_stub/
RUN go mod download

# Copy source code (build context = repo root)
COPY backend/ .

# Build with version info injected via ldflags
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -trimpath -buildvcs=false -tags timetzdata -ldflags="-s -w \
    -X github.com/gochat/gochat/internal/config.Version=${VERSION} \
    -X github.com/gochat/gochat/internal/config.CommitSHA=${COMMIT_SHA} \
    -X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
    -o /gochat ./cmd/gochat/

# Build worker binary (same source, --worker-only flag in main)
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -trimpath -buildvcs=false -tags timetzdata -ldflags="-s -w \
    -X github.com/gochat/gochat/internal/config.Version=${VERSION} \
    -X github.com/gochat/gochat/internal/config.CommitSHA=${COMMIT_SHA} \
    -X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
    -o /gochat-worker ./cmd/gochat/

RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -ldflags="-s -w" -o /migrate ./cmd/migrate/

# ========== Production Stage ==========
FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d

ARG VERSION=dev
ARG COMMIT_SHA=unknown
ARG BUILD_DATE=unknown
LABEL org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.revision="${COMMIT_SHA}" \
      org.opencontainers.image.created="${BUILD_DATE}"

# Install runtime and recovery dependencies.
RUN apk --no-cache add bash ca-certificates tzdata curl openssl postgresql16-client && \
    addgroup -S gochat && adduser -S gochat -G gochat

WORKDIR /app

# Copy binary and configs from builder
COPY --from=builder /gochat /app/gochat
COPY --from=builder /gochat-worker /app/gochat-worker
COPY --from=builder /migrate /app/migrate
COPY --chown=gochat:gochat --from=frontend-builder /app/frontend/dist /app/frontend/dist
COPY backend/configs/ /app/configs/
COPY backend/migrations/ /app/migrations/
COPY backend/scripts/db_backup.sh backend/scripts/db_restore.sh deploy/docker/database_client_entrypoint.sh /app/scripts/

ENV GOCHAT_FRONTEND_DIST=/app/frontend/dist

# Set ownership to non-root user
RUN mkdir -p /app/storage/uploads && chown -R gochat:gochat /app/storage

# Switch to non-root user for security
USER gochat

# Health check — references the /health endpoint we will add
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD wget -q -T 3 -O /dev/null http://127.0.0.1:3000/ready || exit 1

EXPOSE 3000

# Default entrypoint — can be overridden for worker mode:
#   docker run gochat/gochat serve            → API server
#   docker run gochat/gochat serve --worker-only → background worker
ENTRYPOINT ["/app/gochat"]
CMD ["serve"]