# 🚀 Backend (BFF) Dockerfile - Plesk Optimized
# Multi-stage build for NestJS production deployment via Plesk

# =====================================================
# Dependencies Stage - Install all dependencies
# =====================================================
FROM node:22-bookworm-slim AS deps

# Install system dependencies for building
RUN apt-get update && apt-get install -y dumb-init ca-certificates && rm -rf /var/lib/apt/lists/* \
 && corepack enable && corepack prepare pnpm@10.15.0 --activate

WORKDIR /app

# Copy workspace configuration
COPY pnpm-workspace.yaml package.json pnpm-lock.yaml ./

# Copy package.json files for dependency resolution
COPY packages/domain/package.json ./packages/domain/
COPY packages/logging/package.json ./packages/logging/
COPY packages/validation/package.json ./packages/validation/
COPY apps/bff/package.json ./apps/bff/

# Install ALL dependencies (needed for build)
RUN pnpm install --frozen-lockfile --prefer-offline

# =====================================================
# Builder Stage - Build the application
# =====================================================
FROM node:22-bookworm-slim AS builder

# Install pnpm
RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/* \
 && corepack enable && corepack prepare pnpm@10.15.0 --activate

WORKDIR /app

# Copy workspace configuration
COPY pnpm-workspace.yaml package.json pnpm-lock.yaml ./

# Copy source code
COPY packages/ ./packages/
COPY apps/bff/ ./apps/bff/
COPY tsconfig.json tsconfig.base.json ./

# Copy node_modules from deps stage
COPY --from=deps /app/node_modules ./node_modules

WORKDIR /app
# Align workspace modules in builder (ensures proper symlinks and resolution)
RUN pnpm install --frozen-lockfile --prefer-offline
# Build workspace packages so downstream apps can consume compiled artifacts
RUN pnpm --filter @customer-portal/domain build && \
    pnpm --filter @customer-portal/logging build && \
    pnpm --filter @customer-portal/validation build
# Build BFF (generate Prisma client then compile)
RUN pnpm --filter @customer-portal/bff exec prisma generate && \
    pnpm --filter @customer-portal/bff build

# =====================================================
# Production Stage - Final optimized image for Plesk
# =====================================================
FROM node:22-alpine AS production

# Install runtime dependencies including dumb-init for proper signal handling
RUN apk add --no-cache \
    wget \
    curl \
    dumb-init \
    # Toolchain for native rebuilds (bcrypt) and Prisma (openssl), and nc for wait-for
    python3 \
    make \
    g++ \
    pkgconfig \
    openssl \
    netcat-openbsd \
    && rm -rf /var/cache/apk/*

# Install pnpm for production dependencies
RUN corepack enable && corepack prepare pnpm@10.15.0 --activate

WORKDIR /app

# Copy workspace configuration
COPY pnpm-workspace.yaml package.json pnpm-lock.yaml ./

# Copy package.json files for dependency resolution
COPY packages/domain/package.json ./packages/domain/
COPY packages/logging/package.json ./packages/logging/
COPY packages/validation/package.json ./packages/validation/
COPY apps/bff/package.json ./apps/bff/

# Install production dependencies only (clean approach)
ENV HUSKY=0
RUN pnpm install --frozen-lockfile --prod --ignore-scripts

# Rebuild native modules for Alpine environment
RUN pnpm rebuild bcrypt

# Copy built applications and shared package from builder
COPY --from=builder /app/packages/domain/dist ./packages/domain/dist
COPY --from=builder /app/packages/logging/dist ./packages/logging/dist
COPY --from=builder /app/packages/validation/dist ./packages/validation/dist
COPY --from=builder /app/apps/bff/dist ./apps/bff/dist
COPY --from=builder /app/apps/bff/prisma ./apps/bff/prisma

# Generate Prisma client in production environment
WORKDIR /app/apps/bff
RUN pnpm dlx prisma generate

# Strip build toolchain to shrink image
RUN apk del --no-cache python3 make g++ pkgconfig && rm -rf /root/.cache /var/cache/apk/*

# Create non-root user for security [[memory:6689308]]
RUN addgroup --system --gid 1001 nodejs && \
    adduser --system --uid 1001 nestjs

# Create necessary directories and set permissions
RUN mkdir -p /app/secrets /app/logs && \
    chown -R nestjs:nodejs /app

# Switch to non-root user
USER nestjs

# Expose port (required for Plesk port mapping)
EXPOSE 4000

# Environment variables
ENV NODE_ENV=production
ENV PORT=4000

# Set working directory for the app
WORKDIR /app/apps/bff

# Health check for container monitoring
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD wget --no-verbose --tries=1 --spider http://localhost:4000/health || exit 1

# Use dumb-init for proper signal handling in containers
ENTRYPOINT ["dumb-init", "--"]
CMD ["node", "dist/main.js"]